baidunetdisk-electron

MEDIUM

maintainer KafCoppelia 14 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (wppkg.baidupcs.com), which is not the official project domain, posing a supply-chain risk if the host is compromised or the artifact is silently swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "https://wppkg.baidupcs.com/issue/netdisk/Linuxguanjia/${pkgver}/${_pkgname}_${pkgver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard host (wppkg.baidupcs.com), which is not the official project domain, posing a supply-chain risk if the host is compromised or the artifact is silently swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Ariel AxionL <i at axionl dot me>
    
      2# Contributor: Astro Benzene <universebenzene at sina dot com>
    
      3# Contributor: lilydjwg <lilydjwg at gmail dot com>
    
      4# Maintainer: KafCoppelia <k740677208@gmail.com>
    
      5
    
      6_pkgname=baidunetdisk
    
      7pkgname=${_pkgname}-electron
    
      8pkgver=8.9.6
    
      9pkgrel=1
    
      10pkgdesc="Baidu Nedisk - a cloud storage client (Linux Version). Run with system electron."
    
      11arch=('x86_64')
    
      12depends=('gtkmm' 'electron26' 'libatomic')
    
      13makedepends=('asar' 'patchelf')
    
      14provides=("baidunetdisk")
    
      15conflicts=("baidunetdisk")
    
      16url="https://pan.baidu.com"
    
      17license=("LicenseRef-${_pkgname}")
    
      18options=('!strip' '!debug')
    
      19source=("0001-baidunetdisk-bin-desktop-file.patch"
    
      20        "baidunetdisk-wrapper.sh"
    
      21        "baidunetdisk-main.js"
    
      22        "https://wppkg.baidupcs.com/issue/netdisk/Linuxguanjia/${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
    
      23sha256sums=('17bda6036e07916971257f25731130fb1b760b80798fa13273db39268ab9f28c'
    
      24            '93d8ff804233f0b8957e5c38f2993e5c646b9afb3427bafaed13b7d7ef2263c6'
    
      25            '73494c86a0484f2ea7d5cbac7c00752367796413bec2980ba295ecdab8fc9afb'
    
      26            'ae6b20a2b2fd84313e1da722dfe14e39d5b446649b46db600f83b25caf7541e2')
    
      27
    
      28prepare() {
    
      29    bsdtar -xpf "data.tar.bz2"
    
      30    patch -d "usr" -p1 < "0001-baidunetdisk-bin-desktop-file.patch"
    
      31
    
      32    # Koffi 2.8.8's executable-stack flag prevents dlopen with current glibc.
    
      33    asar extract-file "opt/${_pkgname}/resources/app.asar" node_modules/koffi/build/koffi/linux_x64/koffi.node
    
      34    patchelf --clear-execstack koffi.node
    
      35}
    
      36
    
      37package() {
    
      38    cd "${srcdir}"
    
      39
    
      40    # install application data
    
      41    mv "usr" "${pkgdir}"
    
      42    install -dm755 "${pkgdir}/usr/lib" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      43    mv "opt/${_pkgname}" "${pkgdir}/usr/lib/${_pkgname}"
    
      44    install -Dm755 "${srcdir}/baidunetdisk-wrapper.sh" "${pkgdir}/usr/bin/baidunetdisk"
    
      45    install -Dm644 "${srcdir}/baidunetdisk-main.js" "${pkgdir}/usr/lib/${_pkgname}/baidunetdisk-main.js"
    
      46    install -Dm644 "${srcdir}/koffi.node" "${pkgdir}/usr/lib/${_pkgname}/koffi.node"
    
      47
    
      48    # fix promission
    
      49    chmod 644 "${pkgdir}/usr/lib/${_pkgname}/"*.so
    
      50    find ${pkgdir} -type d -exec chmod 755 {} \;
    
      51
    
      52    # remove unnecessary libs
    
      53    cd "${pkgdir}/usr/lib/${_pkgname}"
    
      54    rm -rf baidunetdisk swiftshader chrome_100_percent.pak libEGL.so locales v8_context_snapshot.bin chrome_200_percent.pak libffmpeg.so libvk_swiftshader.so vk_swiftshader_icd.json chrome-sandbox chrome_crashpad_handler libGLESv2.so libvulkan.so libvulkan.so.1 resources.pak icudtl.dat snapshot_blob.bin baiduNetdiskContext.conf baidunetdisk.svg baidunetdiskv.desktop baidunetdisk.desktop
    
      55
    
      56    # install license
    
      57    mv LICENSE* "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      58}
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,11 +5,12 @@
 
 _pkgname=baidunetdisk
 pkgname=${_pkgname}-electron
-pkgver=8.6.0
+pkgver=8.9.6
 pkgrel=1
-pkgdesc="Baidu Net Disk - a cloud storage client (Linux Version). Run with system electron."
+pkgdesc="Baidu Nedisk - a cloud storage client (Linux Version). Run with system electron."
 arch=('x86_64')
-depends=('electron22' 'gtkmm')
+depends=('gtkmm' 'electron26' 'libatomic')
+makedepends=('asar' 'patchelf')
 provides=("baidunetdisk")
 conflicts=("baidunetdisk")
 url="https://pan.baidu.com"
@@ -20,13 +21,17 @@
         "baidunetdisk-main.js"
         "https://wppkg.baidupcs.com/issue/netdisk/Linuxguanjia/${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
 sha256sums=('17bda6036e07916971257f25731130fb1b760b80798fa13273db39268ab9f28c'
-            '1985035bf0bde478f3d638819f638eab8244d5f2abd85adb9602729b4d7fddf2'
-            '12141ff8d85741a0ecba7ad923d982ce75bb3632698f4b04ccbbcce85c02502d'
-            '28f62882fe35469b4008c1324e43d2a9109395bcbdfc05207e048a8487759d56')
+            '93d8ff804233f0b8957e5c38f2993e5c646b9afb3427bafaed13b7d7ef2263c6'
+            '73494c86a0484f2ea7d5cbac7c00752367796413bec2980ba295ecdab8fc9afb'
+            'ae6b20a2b2fd84313e1da722dfe14e39d5b446649b46db600f83b25caf7541e2')
 
 prepare() {
     bsdtar -xpf "data.tar.bz2"
     patch -d "usr" -p1 < "0001-baidunetdisk-bin-desktop-file.patch"
+
+    # Koffi 2.8.8's executable-stack flag prevents dlopen with current glibc.
+    asar extract-file "opt/${_pkgname}/resources/app.asar" node_modules/koffi/build/koffi/linux_x64/koffi.node
+    patchelf --clear-execstack koffi.node
 }
 
 package() {
@@ -34,10 +39,11 @@
 
     # install application data
     mv "usr" "${pkgdir}"
-    install -dm755 "${pkgdir}/usr/lib" "${pkgdir}/usr/share/licenses/${_pkgname}"
+    install -dm755 "${pkgdir}/usr/lib" "${pkgdir}/usr/share/licenses/${pkgname}"
     mv "opt/${_pkgname}" "${pkgdir}/usr/lib/${_pkgname}"
     install -Dm755 "${srcdir}/baidunetdisk-wrapper.sh" "${pkgdir}/usr/bin/baidunetdisk"
     install -Dm644 "${srcdir}/baidunetdisk-main.js" "${pkgdir}/usr/lib/${_pkgname}/baidunetdisk-main.js"
+    install -Dm644 "${srcdir}/koffi.node" "${pkgdir}/usr/lib/${_pkgname}/koffi.node"
 
     # fix promission
     chmod 644 "${pkgdir}/usr/lib/${_pkgname}/"*.so
@@ -48,6 +54,6 @@
     rm -rf baidunetdisk swiftshader chrome_100_percent.pak libEGL.so locales v8_context_snapshot.bin chrome_200_percent.pak libffmpeg.so libvk_swiftshader.so vk_swiftshader_icd.json chrome-sandbox chrome_crashpad_handler libGLESv2.so libvulkan.so libvulkan.so.1 resources.pak icudtl.dat snapshot_blob.bin baiduNetdiskContext.conf baidunetdisk.svg baidunetdiskv.desktop baidunetdisk.desktop
 
     # install license
-    mv LICENSE* "${pkgdir}/usr/share/licenses/${_pkgname}/"
+    mv LICENSE* "${pkgdir}/usr/share/licenses/${pkgname}/"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 13:58:24	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 09:47:05	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2