baidunetdisk-bin

LOW

maintainer Universebenzene 38 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads official Debian library .deb files and Baidu's own prebuilt client from baidu.com, which is the project's official domain; while non-whitelisted hosts are used, they are legitimate sources for dependencies and the main binary, with no evidence of malicious or obfuscated code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official Debian library .deb files and Baidu's own prebuilt client from baidu.com, which is the project's official domain; while non-whitelisted hosts are used, they are legitimate sources for dependencies and the main binary, with no evidence of malicious or obfuscated code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "baidunetdisk-${pkgver}.${CARCH}.deb::https://pkg-ant.baidu.com/issue/netdisk/LinuxGuanjia/${pkgver}/baidunetdisk_${pkgver}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nastem <nastemwayne at gmail dot com>
    
      2# Maintainer: Astro Benzene <universebenzene at sina dot com>
    
      3# Maintainer: Ariel AxionL <i at axionl dot me>
    
      4# Contributor: lilydjwg <lilydjwg at gmail dot com>
    
      5# Contributor: kearneyBack <191615342 at qq dot com>
    
      6
    
      7pkgname=baidunetdisk-bin
    
      8pkgver=8.7.0
    
      9pkgrel=1
    
      10pkgdesc='Baidu Netdisk - a cloud storage client (Linux Version)'
    
      11arch=('x86_64')
    
      12url='https://pan.baidu.com'
    
      13license=('LicenseRef-custom')
    
      14depends=('gtk3' 'alsa-lib' 'libnotify' 'libsecret' 'libxss' 'nss' 'hicolor-icon-theme'
    
      15  'libappindicator-gtk3')
    
      16provides=('baidunetdisk')
    
      17conflicts=('baidunetdisk')
    
      18options=('!strip' '!debug')
    
      19
    
      20source=(
    
      21  'baidunetdisk-wrapper.sh'
    
      22  'https://deb.debian.org/debian/pool/main/a/atkmm1.6/libatkmm-1.6-1v5_2.28.3-1_amd64.deb'
    
      23  'https://deb.debian.org/debian/pool/main/c/cairomm/libcairomm-1.0-1v5_1.14.4-2_amd64.deb'
    
      24  'https://deb.debian.org/debian/pool/main/g/glibmm2.4/libglibmm-2.4-1v5_2.66.5-2_amd64.deb'
    
      25  'https://deb.debian.org/debian/pool/main/g/gtk+2.0/libgtk2.0-0_2.24.33-2+deb12u1_amd64.deb'
    
      26  'https://deb.debian.org/debian/pool/main/g/gtkmm2.4/libgtkmm-2.4-1v5_2.24.5-4+b1_amd64.deb'
    
      27  'https://deb.debian.org/debian/pool/main/p/pangomm/libpangomm-1.4-1v5_2.46.3-1_amd64.deb'
    
      28  'https://deb.debian.org/debian/pool/main/libs/libsigc++-2.0/libsigc++-2.0-0v5_2.12.0-1_amd64.deb'
    
      29)
    
      30source_x86_64=(
    
      31  "baidunetdisk-${pkgver}.${CARCH}.deb::https://pkg-ant.baidu.com/issue/netdisk/LinuxGuanjia/${pkgver}/baidunetdisk_${pkgver}_amd64.deb"
    
      32)
    
      33
    
      34sha256sums=('3f6655276fe99fec31915e799e044e75853cb3bb180f013cc0e7f21910f9bf72'
    
      35  'f98c29a1962bb98d147c72e05a92eeba36f829ff1538eaaed550301a841fad95'
    
      36  '6cb05750d23a03c4a3161e023e44051240bb27458da06c316fbe0c31b9807a49'
    
      37  'a11c03dd8f9b454eaeae38ce782ceb45d9b52f5695d86d1d262c9062c678a2ba'
    
      38  'd1e9a26a5961748f220c5989c89516fead2a5054b80914f94c71c3fee6fdebe3'
    
      39  '028c21afe635dfcad591118049364f15bacc5dc0af18ea814f3bebb1e9c00afa'
    
      40  '3bcb2bb2c7dece7be81cd12f0c2eb25a0964642ba1e62e7a98264cb0ab4cde9e'
    
      41  '60d62e980e199094e37a09c5896f736fc64354c0b0b9dbefb1b588ec26bc0bf9')
    
      42sha256sums_x86_64=('ec71c2ad1151609fd0d8b86d95184c0b457d6db5aa18861e0b15fc23ccfe01f7')
    
      43
    
      44_extract_deb() {
    
      45  local deb="$1" dest="$2" data
    
      46  data=$(ar t "$deb" | awk '/^data\.tar\./ { print; exit }')
    
      47  case "$data" in
    
      48  *.xz) ar p "$deb" "$data" | bsdtar -xJf - -C "$dest" ;;
    
      49  *.bz2) ar p "$deb" "$data" | bsdtar -xjf - -C "$dest" ;;
    
      50  *.zst) ar p "$deb" "$data" | bsdtar --zstd -xf - -C "$dest" ;;
    
      51  *.gz) ar p "$deb" "$data" | bsdtar -xzf - -C "$dest" ;;
    
      52  *)
    
      53    printf 'Unsupported Debian archive payload: %s\n' "$data" >&2
    
      54    return 1
    
      55    ;;
    
      56  esac
    
      57}
    
      58
    
      59prepare() {
    
      60  mkdir -p extracted legacy-root
    
      61  _extract_deb "${srcdir}/baidunetdisk-${pkgver}.${CARCH}.deb" "${srcdir}/extracted"
    
      62
    
      63  local deb
    
      64  for deb in "${srcdir}"/lib*.deb; do
    
      65    _extract_deb "$deb" "${srcdir}/legacy-root"
    
      66  done
    
      67}
    
      68
    
      69package() {
    
      70  local appdir="${pkgdir}/usr/lib/baidunetdisk"
    
      71  local legacy_dir
    
      72  legacy_dir=$(find "${srcdir}/legacy-root/usr/lib" -mindepth 1 -maxdepth 1 -type d -print -quit)
    
      73  local legacy_lib
    
      74  local legacy_libs=(
    
      75    'libatkmm-1.6.so.1*'
    
      76    'libcairomm-1.0.so.1*'
    
      77    'libgdk-x11-2.0.so.0*'
    
      78    'libgdkmm-2.4.so.1*'
    
      79    'libgiomm-2.4.so.1*'
    
      80    'libglibmm-2.4.so.1*'
    
      81    'libgtk-x11-2.0.so.0*'
    
      82    'libgtkmm-2.4.so.1*'
    
      83    'libpangomm-1.4.so.1*'
    
      84    'libsigc-2.0.so.0*'
    
      85  )
    
      86
    
      87  install -dm755 "$appdir" "${appdir}/legacy-libs"
    
      88  cp -a --no-preserve=ownership "${srcdir}/extracted/opt/baidunetdisk/." "$appdir/"
    
      89  for legacy_lib in "${legacy_libs[@]}"; do
    
      90    find "$legacy_dir" -maxdepth 1 \( -type f -o -type l \) \
    
      91      -name "$legacy_lib" \
    
      92      -exec cp -a --no-preserve=ownership {} "${appdir}/legacy-libs/" \;
    
      93  done
    
      94
    
      95  # Sentry CLI is only used while building/uploading sourcemaps.
    
      96  rm -rf "$appdir/resources/app.asar.unpacked/node_modules/@sentry"
    
      97
    
      98  sed -i -E 's|^Exec=.*|Exec=/usr/bin/baidunetdisk %U|' "$appdir/baidunetdisk.desktop"
    
      99  sed -i -E \
    
      100    -e 's|^Exec=.*|Exec=/usr/bin/baidunetdisk -diskopen|' \
    
      101    -e 's|^Icon=.*|Icon=baidunetdisk|' \
    
      102    "$appdir/baidunetdiskv.desktop"
    
      103  sed -i -E 's|^Exec=.*|Exec=/usr/bin/baidunetdisk --menuupload %F|' \
    
      104    "$appdir/baiduNetdiskContext.conf"
    
      105
    
      106  install -Dm644 "$appdir/baidunetdisk.desktop" \
    
      107    "${pkgdir}/usr/share/applications/baidunetdisk.desktop"
    
      108  install -Dm644 "$appdir/baidunetdisk.svg" \
    
      109    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/baidunetdisk.svg"
    
      110  install -Dm644 "$appdir/baidunetdiskv.desktop" \
    
      111    "${pkgdir}/usr/share/dde-file-manager/extensions/appEntry/baidunetdiskv.desktop"
    
      112  install -Dm644 "$appdir/baiduNetdiskContext.conf" \
    
      113    "${pkgdir}/usr/share/applications/context-menus/baiduNetdiskContext.conf"
    
      114  install -Dm755 "${srcdir}/baidunetdisk-wrapper.sh" \
    
      115    "${pkgdir}/usr/bin/baidunetdisk"
    
      116
    
      117  install -Dm644 "$appdir/LICENSE.electron.txt" \
    
      118    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      119  install -Dm644 "$appdir/LICENSES.chromium.html" \
    
      120    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      121
    
      122  find "$appdir" -type d -exec chmod 755 {} +
    
      123  find "$appdir" -type f -name '*.so*' -exec chmod 644 {} +
    
      124}
    
      125

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2