baidunetdisk-bin

maintainer Universebenzene · 36 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from a Baidu-owned domain (baidupcs.com) for a legitimate Baidu Net Disk client, which is normal for bin packages; the host is not a generic file-sharing site, reducing supply-chain risk despite not being on a whitelist.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from a Baidu-owned domain (baidupcs.com) for a legitimate Baidu Net Disk client, which is normal for bin packages; the host is not a generic file-sharing site, reducing supply-chain risk despite not being on a whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source_x86_64=("${pkgname}-${pkgver}.deb::http://wppkg.baidupcs.com/issue/netdisk/Linuxguanjia/${pkgver}/baidunetdisk_${pkgver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Astro Benzene <universebenzene at sina dot com>
    
      2# Maintainer: Ariel AxionL <i at axionl dot me>
    
      3# Contributor: lilydjwg <lilydjwg at gmail dot com>
    
      4# Contributor: kearneyBack <191615342 at qq dot com>
    
      5
    
      6_pkgname=baidunetdisk
    
      7pkgname=baidunetdisk-bin
    
      8pkgver=4.17.8
    
      9pkgrel=1
    
      10#_mainver=${pkgver%.*}
    
      11pkgdesc="Baidu Net Disk - a cloud storage client (Linux Version)."
    
      12arch=('x86_64')
    
      13depends=('libnotify' 'libsecret' 'libxss' 'gtk3' 'nss')
    
      14provides=("baidunetdisk")
    
      15conflicts=("baidunetdisk")
    
      16url="https://pan.baidu.com"
    
      17license=("custom")
    
      18options=('!strip')
    
      19
    
      20source=("0001-baidunetdisk-bin-desktop-file.patch"
    
      21        "baidunetdisk-wrapper.sh")
    
      22
    
      23#source_x86_64=("${pkgname}-${pkgver}.deb::https://issuecdn.baidupcs.com/issue/netdisk/LinuxGuanjia/${_mainver}/${_pkgname}_linux_${pkgver}.deb")
    
      24source_x86_64=("${pkgname}-${pkgver}.deb::http://wppkg.baidupcs.com/issue/netdisk/Linuxguanjia/${pkgver}/baidunetdisk_${pkgver}_amd64.deb")
    
      25
    
      26sha256sums=('1e0d9616c58d3b772b42d4790625cf2c34ab671f586b8534a2c544c2117bb5d0'
    
      27            'c0035e038344a154421301b7855c274049ad432a5b06b52efc74831daa73e02e')
    
      28sha256sums_x86_64=('ad3a4ce3fdbdbb44d3e157fa072f692c0629be7e6e94e9151cfc3408c0d5ba23')
    
      29
    
      30prepare() {
    
      31    bsdtar -xpf "data.tar.bz2"
    
      32
    
      33    patch -d "usr" -p1 <"0001-baidunetdisk-bin-desktop-file.patch"
    
      34    sed -i '/Name/a Name[zh_CN]=百度网盘' usr/share/applications/${_pkgname}.desktop
    
      35}
    
      36
    
      37package() {
    
      38    cd "${srcdir}"
    
      39
    
      40    # install application data
    
      41    mv "usr" "${pkgdir}"
    
      42    install -dm755 "${pkgdir}/usr/lib" "${pkgdir}/usr/share/licenses/${_pkgname}"
    
      43    mv "opt/${_pkgname}" "${pkgdir}/usr/lib/${_pkgname}"
    
      44#   install -Dm755 "${srcdir}/baidunetdisk-wrapper.sh" "${pkgdir}/usr/bin/baidunetdisk"
    
      45
    
      46    # fix promission
    
      47    chmod 644 "${pkgdir}/usr/lib/${_pkgname}/"*.so
    
      48    find ${pkgdir} -type d -exec chmod 755 {} \;
    
      49
    
      50    # install license
    
      51    ln -s "/usr/lib/${_pkgname}/LICENSE.electron.txt" \
    
      52        "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE.electron.txt"
    
      53    ln -s "/usr/lib/${_pkgname}/LICENSES.chromium.html" \
    
      54        "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSES.chromium.html"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2