baidu-translate-client-bin
LOW
maintainer zxp19821005
3 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt Windows .exe from Baidu's official CDN, which is unpacked and repackaged to integrate with the system Electron; while the host is not a standard code forge, it is Baidu's own domain, and the build process is transparent and does not execute untrusted remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Windows .exe from Baidu's official CDN, which is unpacked and repackaged to integrate with the system Electron; while the host is not a standard code forge, it is Baidu's own domain, and the build process is transparent and does not execute untrusted remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:30
"${pkgname%-bin}-${pkgver}.exe::https://fanyiapp.cdn.bcebos.com/fanyi-client/pkg/win/${pkgver}/${_zhsname}_Setup_${pkgver}.exe" -
PKGBUILD:32
"LICENSE-${pkgver}.html::https://fanyi.baidu.com/static/webpage/agreement.html"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
# Contributor: sukanka <su975853527 at gmail dot com>
3
pkgname=baidu-translate-client-bin
4
_pkgname=BdTranslateClient
5
_zhsname='百度翻译'
6
pkgver=2.4.1
7
_electronversion=11
8
pkgrel=1
9
pkgdesc="Baidu translate.(Prebuilt version.Use system-wide electron)${_zhsname}"
10
arch=(
11
'i686'
12
'x86_64'
13
)
14
url="https://fanyi.baidu.com/"
15
license=('LicenseRef-custom')
16
provides=(
17
"${pkgname%-bin}=${pkgver}"
18
"${pkgname%-client-bin}=${pkgver}"
19
)
20
conflicts=("${pkgname%-bin}")
21
depends=(
22
"electron${_electronversion}"
23
'libxkbcommon-x11'
24
)
25
makedepends=(
26
'7zip'
27
'icoutils'
28
)
29
source=(
30
"${pkgname%-bin}-${pkgver}.exe::https://fanyiapp.cdn.bcebos.com/fanyi-client/pkg/win/${pkgver}/${_zhsname}_Setup_${pkgver}.exe"
31
"${pkgname%-bin}.desktop"
32
"LICENSE-${pkgver}.html::https://fanyi.baidu.com/static/webpage/agreement.html"
33
"${pkgname%-bin}.sh"
34
)
35
sha256sums=('0b8bc402f46eed836022fd238f5e54578240796a6aac35cab1ce36027cd50f25'
36
'344f302a9ec12eb2eac18f39c0368291eb7d815aaa3a34c65474b76d01cf3962'
37
'1bac6150492bcebb1b2f74fc4a6712a8cd9317abf3107e6fa8ca357e5023bbf7'
38
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
39
_check_electron_version() {
40
echo "Verifying Electron version..."
41
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
42
local _main_exe="${_zhsname}.exe"
43
if [[ -n "${_main_exe}" ]]; then
44
local _elec_ver=$(strings "${_main_exe}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1 | head -n 1)
45
if [[ -n "${_elec_ver}" ]]; then
46
if [[ "${_elec_ver}" != "${_electronversion}" ]]; then
47
echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m"
48
else
49
echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
50
fi
51
fi
52
else
53
echo -e "\033[1;33mNote: Could not find Electron binary for version verification.\033[0m"
54
fi
55
}
56
prepare(){
57
sed -i -e "
58
s/@electronversion@/${_electronversion}/g
59
s/@appname@/${pkgname%-bin}/g
60
s/@runname@/app.asar/g
61
s/@cfgdirname@/${_pkgname}/g
62
" "${srcdir}/${pkgname%-bin}.sh"
63
7z e "${srcdir}/${pkgname%-bin}-${pkgver}.exe" -aoa
64
_check_electron_version
65
wrestool -x --output="${srcdir}" -t14 "${srcdir}/${pkgname%-bin}-${pkgver}.exe"
66
icotool -i 5 -x "${srcdir}/"*.ico -o "${srcdir}/${pkgname%-bin}.png"
67
case "${CARCH}" in
68
i686)
69
bsdtar -xf "${srcdir}/app-32.7z"
70
;;
71
x86_64)
72
bsdtar -xf "${srcdir}/app-64.7z"
73
;;
74
esac
75
find "${srcdir}/resources/app.asar.unpacked" \( -name "*win32*" -o -name "*darwin*" -o -name "*arm*" \) -exec rm -rf {} +
76
find "${srcdir}/resources" -name "*.exe" -exec rm -rf {} +
77
}
78
package(){
79
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
80
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
81
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
82
cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
83
install -Dm644 "${srcdir}/LICENSE-${pkgver}.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.html"
84
install -Dm644 "${srcdir}/${pkgname%-bin}.png" -t "${pkgdir}/usr/share/pixmaps"
85
install -Dm644 "${srcdir}/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
86
}
87
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |