bcm-convertor-uos

maintainer Integral · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from home-store-packages.uniontech.com, which is the official Deepin/UOS app store package repository operated by Uniontech (统信软件), the company behind UOS/Deepin Linux. This is not a random personal host — it is the canonical distribution channel for UOS applications, analogous to how some AUR packages pull from Ubuntu's Launchpad or Fedora's COPR. However, from an Arch packaging perspective, this is still a prebuilt closed-source binary (an Electron/Chromium-based app) extracted from a .deb and installed directly, with no source build. The sha512sum is pinned, which mitigates substitution risk. The concern is real but moderate: users are trusting Uniontech's binary distribution infrastructure to deliver an unmodified executable that will run on their system. This is a genuine supply-chain concern (prebuilt binary from a third-party vendor host, not built from source), but it is a well-known and common AUR pattern for proprietary software, and the host is the vendor's own official app store mirror rather than an unofficial or personal host. Severity remains medium due to the executed prebuilt binary nature, not because of any detected malicious behavior.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "https://home-store-packages.uniontech.com/appstore/pool/appstore/b/bcm-convertor.yzf/bcm-convertor.yzf_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from home-store-packages.uniontech.com, which is the official Deepin/UOS app store package repository operated by Uniontech (统信软件), the company behind UOS/Deepin Linux. This is not a random personal host — it is the canonical distribution channel for UOS applications, analogous to how some AUR packages pull from Ubuntu's Launchpad or Fedora's COPR. However, from an Arch packaging perspective, this is still a prebuilt closed-source binary (an Electron/Chromium-based app) extracted from a .deb and installed directly, with no source build. The sha512sum is pinned, which mitigates substitution risk. The concern is real but moderate: users are trusting Uniontech's binary distribution infrastructure to deliver an unmodified executable that will run on their system. This is a genuine supply-chain concern (prebuilt binary from a third-party vendor host, not built from source), but it is a well-known and common AUR pattern for proprietary software, and the host is the vendor's own official app store mirror rather than an unofficial or personal host. Severity remains medium due to the executed prebuilt binary nature, not because of any detected malicious behavior.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Integral <integral@member.fsf.org>
    
      2
    
      3pkgname=bcm-convertor-uos
    
      4pkgver=1.3.0
    
      5pkgrel=1
    
      6pkgdesc="编程猫格式工厂 (A tool software to compile source code of codemao-kitten3-uos into applications)."
    
      7arch=('x86_64')
    
      8url="https://shequ.codemao.cn/"
    
      9license=('custom')
    
      10depends=('gtk3' 'nss' 'alsa-lib')
    
      11source=(
    
      12	"https://home-store-packages.uniontech.com/appstore/pool/appstore/b/bcm-convertor.yzf/bcm-convertor.yzf_${pkgver}_amd64.deb"
    
      13)
    
      14sha512sums=('d2e8064f025f75e64b91698124a52def2d1dd165df0d1c239453af28a511631e95bbf36af17eec26da83177a00ebef87c9356cd7cd0b2f9a3a5c78885995e3ed')
    
      15
    
      16package() {
    
      17	echo "  -> Extracting the data.tar.xz..."
    
      18	bsdtar -xvf data.tar.xz -C "${pkgdir}/"
    
      19	chmod -R 755 "${pkgdir}/"
    
      20
    
      21	echo "  -> Installing..."
    
      22	# Launcher
    
      23	mkdir -p "${pkgdir}/usr/bin/"
    
      24	ln -s "/opt/apps/bcm-convertor.yzf/files/bcm_convertor" "${pkgdir}/usr/bin/${pkgname}"
    
      25	# Desktop Entry
    
      26	install -Dm644 "${pkgdir}/opt/apps/bcm-convertor.yzf/entries/applications/bcm-convertor.yzf.desktop" -t "${pkgdir}/usr/share/applications/"
    
      27	# Icon
    
      28	cp -r "${pkgdir}/opt/apps/bcm-convertor.yzf/entries/icons" "${pkgdir}/usr/share/"
    
      29	chmod -R 755 "${pkgdir}/usr/share/icons/"
    
      30	# License
    
      31	install -Dm644 "${pkgdir}/opt/apps/bcm-convertor.yzf/files/LICENSE.electron.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      32	install -Dm644 "${pkgdir}/opt/apps/bcm-convertor.yzf/files/LICENSES.chromium.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2