cnkiexpress

maintainer fansuregrin · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .deb from download.cnki.net (the official CNKI/China National Knowledge Infrastructure distribution host, matching the stated url cajviewer.cnki.net), extracts it, then executes the embedded AppImage binary (chmod +x and ./${_pkgname}.AppImage --appimage-extract) at build time. The sha256sum is pinned, which mitigates silent substitution risk somewhat. However: (1) the binary is executed during the build phase, not just installed; (2) download.cnki.net is a vendor-controlled host but not a widely audited/mirrored source; (3) the AppImage is a closed-source Electron app from a Chinese state-affiliated academic publisher with no reproducibility guarantees. This is a classic medium-risk pattern: a prebuilt, executed binary from a single vendor host with a pinned checksum but no source build. The cheaper model's MEDIUM rating is correct — this is not a false positive, but it is also not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://download.cnki.net/cnkiexpress/cnkiexpress_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt .deb from download.cnki.net (the official CNKI/China National Knowledge Infrastructure distribution host, matching the stated url cajviewer.cnki.net), extracts it, then executes the embedded AppImage binary (chmod +x and ./${_pkgname}.AppImage --appimage-extract) at build time. The sha256sum is pinned, which mitigates silent substitution risk somewhat. However: (1) the binary is executed during the build phase, not just installed; (2) download.cnki.net is a vendor-controlled host but not a widely audited/mirrored source; (3) the AppImage is a closed-source Electron app from a Chinese state-affiliated academic publisher with no reproducibility guarantees. This is a classic medium-risk pattern: a prebuilt, executed binary from a single vendor host with a pinned checksum but no source build. The cheaper model's MEDIUM rating is correct — this is not a false positive, but it is also not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fansuregrin <quarlong@qq.com>
    
      2pkgname=cnkiexpress
    
      3_pkgname=$pkgname
    
      4pkgver=0.1.22
    
      5pkgrel=2
    
      6pkgdesc="A software for academic research articles developed by CNKI"
    
      7arch=("x86_64")
    
      8url="https://cajviewer.cnki.net"
    
      9license=('custom')
    
      10depends=('hicolor-icon-theme'
    
      11         'gtk3'
    
      12         'libnotify'
    
      13         'nss'
    
      14         'libxss'
    
      15         'libxtst'
    
      16         'xdg-utils'
    
      17         'at-spi2-core'
    
      18         'util-linux-libs'
    
      19         'libappindicator-gtk3'
    
      20         'libsecret')
    
      21makedepends=('sed' 'tar')
    
      22source=("https://download.cnki.net/cnkiexpress/cnkiexpress_${pkgver}_amd64.deb")
    
      23sha256sums=('e402f22c9e005882b2e97fe1622a8dead7dd82766055f1c073ce023ca2ef877f')
    
      24options=(!strip)
    
      25
    
      26prepare() {
    
      27	tar -xJf data.tar.xz
    
      28	cd ${srcdir}/opt/${_pkgname}
    
      29
    
      30	# making .AppImage file executable
    
      31	chmod -v +x ${_pkgname}.AppImage
    
      32
    
      33	# extract .AppImage file
    
      34	./${_pkgname}.AppImage --appimage-extract
    
      35}
    
      36
    
      37build() {
    
      38	cd ${srcdir}/opt/${_pkgname}
    
      39	# modifying .desktop file
    
      40	sed -i -E "s|Exec=AppRun|Exec=/usr/bin/${_pkgname}|" squashfs-root/${_pkgname}.desktop
    
      41	sed -i "s/Name/Name[zh_CN]/g" squashfs-root/${_pkgname}.desktop 
    
      42	sed -i "/Name/i\Name=CNKI Express" squashfs-root/${_pkgname}.desktop 
    
      43}
    
      44
    
      45package() {
    
      46	cd ${srcdir}
    
      47
    
      48	# Copy app files
    
      49	install -vdm 755 ${pkgdir}/opt/${_pkgname}/
    
      50	cp -va opt/${_pkgname}/squashfs-root/* ${pkgdir}/opt/${_pkgname}
    
      51
    
      52	# Fix permissions
    
      53	for d in locales resources Resource; do
    
      54		chmod -v 755 ${pkgdir}/opt/${_pkgname}/${d}
    
      55		find ${pkgdir}/opt/${_pkgname}/${d} -type d -exec chmod -v 755 {} +
    
      56	done
    
      57	chown root:root ${pkgdir}/opt/${_pkgname}/chrome-sandbox
    
      58	chmod 4755 ${pkgdir}/opt/${_pkgname}/chrome-sandbox
    
      59
    
      60	# Install mime file
    
      61	install -vDm 644 usr/share/mime/packages/${_pkgname}.xml -t ${pkgdir}/usr/share/mime/packages 
    
      62
    
      63	# Link entry point	
    
      64	install -vdm 755 ${pkgdir}/usr/bin/
    
      65	ln -vsf /opt/${_pkgname}/${_pkgname}  ${pkgdir}/usr/bin/${_pkgname}
    
      66
    
      67	# Install LICENSE file
    
      68	install -Dm644 ${pkgdir}/opt/${_pkgname}/license.txt -t ${pkgdir}/usr/share/licenses/${_pkgname}
    
      69
    
      70	# Copy icons files
    
      71	install -vdm 755 ${pkgdir}/usr/share/icons/
    
      72	find usr/share/icons -type d -exec chmod -v 755 {} +
    
      73	cp -va usr/share/icons/* ${pkgdir}/usr/share/icons/
    
      74
    
      75	# Copy desktop file
    
      76	install -vDm 644 opt/${_pkgname}/squashfs-root/${_pkgname}.desktop ${pkgdir}/usr/share/applications/${_pkgname}.desktop
    
      77
    
      78	# Remove unused files
    
      79	rm -vrf ${pkgdir}/opt/${_pkgname}/{usr,swiftshader,AppRun,${pkgname}.{desktop,png}}
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2