cloudhub-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt RPM binaries from res.yunzhijia.com, which is the official CDN/resource host for yunzhijia.com (云之家), a legitimate Chinese enterprise collaboration platform by Kingdee. The host is not a random personal server — it is the vendor's own distribution infrastructure, analogous to how other vendors host their own Linux packages. SHA256 checksums are provided for all sources. The PKGBUILD then unpacks the RPM, extracts the asar bundle, patches JS/HTML files to fix resource paths, and repacks — a standard pattern for electron app repackaging in AUR. There is no obfuscation, no external script execution, and no piracy. The medium rating is justified primarily because: (1) the binaries are prebuilt and closed-source with no way to verify the build chain, (2) the host res.yunzhijia.com, while plausibly official, is not a well-known verified vendor mirror, and (3) the package executes native binaries extracted from these RPMs. This is a standard risk level for closed-source binary AUR packages from vendor CDNs, not an elevated supply-chain attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://res.yunzhijia.com/mixed/cloudhubx/linux_arm64/${_pkgname}_arm64_${pkgver}_2601301023.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt RPM binaries from res.yunzhijia.com, which is the official CDN/resource host for yunzhijia.com (云之家), a legitimate Chinese enterprise collaboration platform by Kingdee. The host is not a random personal server — it is the vendor's own distribution infrastructure, analogous to how other vendors host their own Linux packages. SHA256 checksums are provided for all sources. The PKGBUILD then unpacks the RPM, extracts the asar bundle, patches JS/HTML files to fix resource paths, and repacks — a standard pattern for electron app repackaging in AUR. There is no obfuscation, no external script execution, and no piracy. The medium rating is justified primarily because: (1) the binaries are prebuilt and closed-source with no way to verify the build chain, (2) the host res.yunzhijia.com, while plausibly official, is not a well-known verified vendor mirror, and (3) the package executes native binaries extracted from these RPMs. This is a standard risk level for closed-source binary AUR packages from vendor CDNs, not an elevated supply-chain attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=cloudhub-bin
    
      3_pkgname=CloudHub
    
      4_zhsname='云之家'
    
      5pkgver=5.0.5
    
      6_electronversion=12
    
      7pkgrel=1
    
      8pkgdesc="The desktop client of CloudHub.(Prebuilt version.Use system-wide electron)云之家桌面端"
    
      9arch=(
    
      10    'aarch64'
    
      11    'x86_64'
    
      12)
    
      13url="https://www.yunzhijia.com"
    
      14license=('LicenseRef-custom')
    
      15provides=("${pkgname%-bin}=${pkgver}")
    
      16conflicts=("${pkgname%-bin}")
    
      17depends=(
    
      18    "electron${_electronversion}"
    
      19    'gtk2'
    
      20)
    
      21makedepends=(
    
      22    'asar'
    
      23)
    
      24options=(
    
      25    '!strip'
    
      26)
    
      27source=(
    
      28    "LICENSE-${pkgver}.html::${url}/public/agreement/client-agreement.html"
    
      29    "${pkgname%-bin}.sh"
    
      30)
    
      31source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://res.yunzhijia.com/mixed/cloudhubx/linux_arm64/${_pkgname}_arm64_${pkgver}_2601301023.rpm")
    
      32source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::https://res.yunzhijia.com/mixed/cloudhubx/linux_x64/${_pkgname}_x64_${pkgver}_2601301020.rpm")
    
      33sha256sums=('e7bd9b52b886a7bdcc36eb66cc16a993754b22f1fd4644d1db6f0e27cd6ebcca'
    
      34            '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
    
      35sha256sums_aarch64=('aac7bd6df65b72d59a207d4d93fe7d23ab42cada43b495e315d7d562cdd38626')
    
      36sha256sums_x86_64=('9517aff47a1bf3e238c5c0f44f5fb5a4011ac7981530df91aa9dd263e4a153fe')
    
      37_get_electron_version() {
    
      38    _elec_ver="$(strings "${srcdir}/opt/${_zhsname}/${_pkgname}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1)"
    
      39    echo -e "The electron version is: \033[1;31m${_elec_ver}\033[0m"
    
      40}
    
      41prepare() {
    
      42    sed -i -e "
    
      43        s/@electronversion@/${_electronversion}/g
    
      44        s/@appname@/${pkgname%-bin}/g
    
      45        s/@runname@/app.asar/g
    
      46        s/@cfgdirname@/${_pkgname}/g
    
      47        s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
      48    " "${srcdir}/${pkgname%-bin}.sh"
    
      49    _get_electron_version
    
      50    sed -i -e "
    
      51        s/\"\/opt\/${_zhsname}\/${_pkgname}\"/${pkgname%-bin}/g
    
      52        s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
    
      53    " "${srcdir}/usr/share/applications/${_pkgname}.desktop"
    
      54    asar e "${srcdir}/opt/${_zhsname}/resources/app.asar" "${srcdir}/app.asar.unpacked"
    
      55    rm -rf "${srcdir}/opt/${_zhsname}/resources/app.asar"
    
      56    find "${srcdir}/app.asar.unpacked/build" -type f -name "*.js" -exec \
    
      57        sed -i -e "
    
      58            s/= process.resourcesPath/= \"\/usr\/lib\/${pkgname%-bin}\"/g
    
      59            s/process.env.resourcesPath/\"\/usr\/lib\/${pkgname%-bin}\"/g
    
      60        " {} +
    
      61    find "${srcdir}/app.asar.unpacked/build" -type f -name "*.html" -exec \
    
      62        sed -i -e "
    
      63            s/= process.resourcesPath/= \"\/usr\/lib\/${pkgname%-bin}\"/g
    
      64            s/process.env.resourcesPath/\"\/usr\/lib\/${pkgname%-bin}\"/g
    
      65        " {} +
    
      66    install -Dm644 "${srcdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png" "${srcdir}/app.asar.unpacked/resource/linux/256x256-redot.png"
    
      67    asar p "${srcdir}/app.asar.unpacked" "${srcdir}/opt/${_zhsname}/resources/app.asar"
    
      68}
    
      69package() {
    
      70    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      71    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      72	find "${srcdir}/opt/${_zhsname}/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname%-bin}" {} +
    
      73    if find "${srcdir}/opt/${_zhsname}/resources" -mindepth 1 -maxdepth 1 -type d | read; then
    
      74        for _subdir in "${srcdir}/opt/${_zhsname}/resources/"*; do
    
      75            if [ -d "${_subdir}" ]; then
    
      76                cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      77            fi
    
      78        done
    
      79    fi
    
      80    install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      81    _icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512 1024x1024 2048x2048)
    
      82    for _icons in "${_icon_sizes[@]}";do
    
      83        install -Dm644 "${srcdir}/app.asar.unpacked/resource/linux/${_icons}.png" \
    
      84            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png"
    
      85    done
    
      86    install -Dm644 "${srcdir}/LICENSE-${pkgver}.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.html"
    
      87    install -Dm644 "${srcdir}/opt/${_zhsname}/license/"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      88}
    
      89

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2