baidunetdisk-bin

MEDIUM

maintainer Universebenzene 40 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted host (pkg-ant.baidu.com) which is not the official primary domain; this creates a supply-chain risk if the host is compromised or the download is intercepted, despite the checksum verification.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "baidunetdisk-${pkgver}.${CARCH}.deb::https://pkg-ant.baidu.com/issue/netdisk/LinuxGuanjia/${pkgver}/baidunetdisk_${pkgver}_amd64.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (pkg-ant.baidu.com) which is not the official primary domain; this creates a supply-chain risk if the host is compromised or the download is intercepted, despite the checksum verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nastem <nastemwayne at gmail dot com>
    
      2# Maintainer: Astro Benzene <universebenzene at sina dot com>
    
      3# Maintainer: Ariel AxionL <i at axionl dot me>
    
      4# Contributor: lilydjwg <lilydjwg at gmail dot com>
    
      5# Contributor: kearneyBack <191615342 at qq dot com>
    
      6
    
      7pkgname=baidunetdisk-bin
    
      8pkgver=8.7.0
    
      9pkgrel=2
    
      10pkgdesc='Baidu Netdisk - a cloud storage client (Linux Version)'
    
      11arch=('x86_64')
    
      12url='https://pan.baidu.com'
    
      13license=('LicenseRef-custom')
    
      14depends=('gtkmm' 'gtk3' 'alsa-lib' 'nss' 'hicolor-icon-theme' 'libappindicator-gtk3')
    
      15optdepends=(
    
      16  'libnotify: desktop notification support'
    
      17  'libsecret: secure credential storage'
    
      18  'libxss: screensaver inhibition during playback'
    
      19)
    
      20provides=('baidunetdisk')
    
      21conflicts=('baidunetdisk')
    
      22options=('!strip' '!debug')
    
      23
    
      24source=(
    
      25  'baidunetdisk-wrapper.sh'
    
      26)
    
      27source_x86_64=(
    
      28  "baidunetdisk-${pkgver}.${CARCH}.deb::https://pkg-ant.baidu.com/issue/netdisk/LinuxGuanjia/${pkgver}/baidunetdisk_${pkgver}_amd64.deb"
    
      29)
    
      30
    
      31sha256sums=('c371a9c6edb4c55e0d6d1918f82ba4a559e4076960bc956f1576b0c19de2109c')
    
      32sha256sums_x86_64=('ec71c2ad1151609fd0d8b86d95184c0b457d6db5aa18861e0b15fc23ccfe01f7')
    
      33
    
      34_extract_deb() {
    
      35  local deb="$1" dest="$2" data
    
      36  data=$(ar t "$deb" | awk '/^data\.tar\./ { print; exit }')
    
      37  case "$data" in
    
      38  *.xz) ar p "$deb" "$data" | bsdtar -xJf - -C "$dest" ;;
    
      39  *.bz2) ar p "$deb" "$data" | bsdtar -xjf - -C "$dest" ;;
    
      40  *.zst) ar p "$deb" "$data" | bsdtar --zstd -xf - -C "$dest" ;;
    
      41  *.gz) ar p "$deb" "$data" | bsdtar -xzf - -C "$dest" ;;
    
      42  *)
    
      43    printf 'Unsupported Debian archive payload: %s\n' "$data" >&2
    
      44    return 1
    
      45    ;;
    
      46  esac
    
      47}
    
      48
    
      49prepare() {
    
      50  mkdir -p extracted
    
      51  _extract_deb "${srcdir}/baidunetdisk-${pkgver}.${CARCH}.deb" "${srcdir}/extracted"
    
      52}
    
      53
    
      54package() {
    
      55  local appdir="${pkgdir}/usr/lib/baidunetdisk"
    
      56
    
      57  install -dm755 "$appdir"
    
      58  cp -a --no-preserve=ownership "${srcdir}/extracted/opt/baidunetdisk/." "$appdir/"
    
      59
    
      60  # Sentry CLI is only used while building/uploading sourcemaps.
    
      61  rm -rf "$appdir/resources/app.asar.unpacked/node_modules/@sentry"
    
      62
    
      63  sed -i -E 's|^Exec=.*|Exec=/usr/bin/baidunetdisk %U|' "$appdir/baidunetdisk.desktop"
    
      64  sed -i -E \
    
      65    -e 's|^Exec=.*|Exec=/usr/bin/baidunetdisk -diskopen|' \
    
      66    -e 's|^Icon=.*|Icon=baidunetdisk|' \
    
      67    "$appdir/baidunetdiskv.desktop"
    
      68  sed -i -E 's|^Exec=.*|Exec=/usr/bin/baidunetdisk --menuupload %F|' \
    
      69    "$appdir/baiduNetdiskContext.conf"
    
      70
    
      71  install -Dm644 "$appdir/baidunetdisk.desktop" \
    
      72    "${pkgdir}/usr/share/applications/baidunetdisk.desktop"
    
      73  install -Dm644 "$appdir/baidunetdisk.svg" \
    
      74    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/baidunetdisk.svg"
    
      75  install -Dm644 "$appdir/baidunetdiskv.desktop" \
    
      76    "${pkgdir}/usr/share/dde-file-manager/extensions/appEntry/baidunetdiskv.desktop"
    
      77  install -Dm644 "$appdir/baiduNetdiskContext.conf" \
    
      78    "${pkgdir}/usr/share/applications/context-menus/baiduNetdiskContext.conf"
    
      79  install -Dm755 "${srcdir}/baidunetdisk-wrapper.sh" \
    
      80    "${pkgdir}/usr/bin/baidunetdisk"
    
      81
    
      82  install -Dm644 "$appdir/LICENSE.electron.txt" \
    
      83    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      84  install -Dm644 "$appdir/LICENSES.chromium.html" \
    
      85    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      86
    
      87  find "$appdir" -type d -exec chmod 755 {} +
    
      88  find "$appdir" -type f -name '*.so*' -exec chmod 644 {} +
    
      89}
    
      90

Changes since previous scan

--- PKGBUILD @ 2026-10-31 00:07
+++ PKGBUILD @ 2026-11-01 00:21
@@ -6,39 +6,29 @@
 
 pkgname=baidunetdisk-bin
 pkgver=8.7.0
-pkgrel=1
+pkgrel=2
 pkgdesc='Baidu Netdisk - a cloud storage client (Linux Version)'
 arch=('x86_64')
 url='https://pan.baidu.com'
 license=('LicenseRef-custom')
-depends=('gtk3' 'alsa-lib' 'libnotify' 'libsecret' 'libxss' 'nss' 'hicolor-icon-theme'
-  'libappindicator-gtk3')
+depends=('gtkmm' 'gtk3' 'alsa-lib' 'nss' 'hicolor-icon-theme' 'libappindicator-gtk3')
+optdepends=(
+  'libnotify: desktop notification support'
+  'libsecret: secure credential storage'
+  'libxss: screensaver inhibition during playback'
+)
 provides=('baidunetdisk')
 conflicts=('baidunetdisk')
 options=('!strip' '!debug')
 
 source=(
   'baidunetdisk-wrapper.sh'
-  'https://deb.debian.org/debian/pool/main/a/atkmm1.6/libatkmm-1.6-1v5_2.28.3-1_amd64.deb'
-  'https://deb.debian.org/debian/pool/main/c/cairomm/libcairomm-1.0-1v5_1.14.4-2_amd64.deb'
-  'https://deb.debian.org/debian/pool/main/g/glibmm2.4/libglibmm-2.4-1v5_2.66.5-2_amd64.deb'
-  'https://deb.debian.org/debian/pool/main/g/gtk+2.0/libgtk2.0-0_2.24.33-2+deb12u1_amd64.deb'
-  'https://deb.debian.org/debian/pool/main/g/gtkmm2.4/libgtkmm-2.4-1v5_2.24.5-4+b1_amd64.deb'
-  'https://deb.debian.org/debian/pool/main/p/pangomm/libpangomm-1.4-1v5_2.46.3-1_amd64.deb'
-  'https://deb.debian.org/debian/pool/main/libs/libsigc++-2.0/libsigc++-2.0-0v5_2.12.0-1_amd64.deb'
 )
 source_x86_64=(
   "baidunetdisk-${pkgver}.${CARCH}.deb::https://pkg-ant.baidu.com/issue/netdisk/LinuxGuanjia/${pkgver}/baidunetdisk_${pkgver}_amd64.deb"
 )
 
-sha256sums=('3f6655276fe99fec31915e799e044e75853cb3bb180f013cc0e7f21910f9bf72'
-  'f98c29a1962bb98d147c72e05a92eeba36f829ff1538eaaed550301a841fad95'
-  '6cb05750d23a03c4a3161e023e44051240bb27458da06c316fbe0c31b9807a49'
-  'a11c03dd8f9b454eaeae38ce782ceb45d9b52f5695d86d1d262c9062c678a2ba'
-  'd1e9a26a5961748f220c5989c89516fead2a5054b80914f94c71c3fee6fdebe3'
-  '028c21afe635dfcad591118049364f15bacc5dc0af18ea814f3bebb1e9c00afa'
-  '3bcb2bb2c7dece7be81cd12f0c2eb25a0964642ba1e62e7a98264cb0ab4cde9e'
-  '60d62e980e199094e37a09c5896f736fc64354c0b0b9dbefb1b588ec26bc0bf9')
+sha256sums=('c371a9c6edb4c55e0d6d1918f82ba4a559e4076960bc956f1576b0c19de2109c')
 sha256sums_x86_64=('ec71c2ad1151609fd0d8b86d95184c0b457d6db5aa18861e0b15fc23ccfe01f7')
 
 _extract_deb() {
@@ -57,40 +47,15 @@
 }
 
 prepare() {
-  mkdir -p extracted legacy-root
+  mkdir -p extracted
   _extract_deb "${srcdir}/baidunetdisk-${pkgver}.${CARCH}.deb" "${srcdir}/extracted"
-
-  local deb
-  for deb in "${srcdir}"/lib*.deb; do
-    _extract_deb "$deb" "${srcdir}/legacy-root"
-  done
 }
 
 package() {
   local appdir="${pkgdir}/usr/lib/baidunetdisk"
-  local legacy_dir
-  legacy_dir=$(find "${srcdir}/legacy-root/usr/lib" -mindepth 1 -maxdepth 1 -type d -print -quit)
-  local legacy_lib
-  local legacy_libs=(
-    'libatkmm-1.6.so.1*'
-    'libcairomm-1.0.so.1*'
-    'libgdk-x11-2.0.so.0*'
-    'libgdkmm-2.4.so.1*'
-    'libgiomm-2.4.so.1*'
-    'libglibmm-2.4.so.1*'
-    'libgtk-x11-2.0.so.0*'
-    'libgtkmm-2.4.so.1*'
-    'libpangomm-1.4.so.1*'
-    'libsigc-2.0.so.0*'
-  )
 
-  install -dm755 "$appdir" "${appdir}/legacy-libs"
+  install -dm755 "$appdir"
   cp -a --no-preserve=ownership "${srcdir}/extracted/opt/baidunetdisk/." "$appdir/"
-  for legacy_lib in "${legacy_libs[@]}"; do
-    find "$legacy_dir" -maxdepth 1 \( -type f -o -type l \) \
-      -name "$legacy_lib" \
-      -exec cp -a --no-preserve=ownership {} "${appdir}/legacy-libs/" \;
-  done
 
   # Sentry CLI is only used while building/uploading sourcemaps.
   rm -rf "$appdir/resources/app.asar.unpacked/node_modules/@sentry"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 15:58:34	Medium	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2