com.seewo.easinote5

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

piracy

Why flagged The PKGBUILD downloads the official Seewo/CVTE vendor binary (static.cvte.com is the legitimate parent company's CDN), so the supply-chain concern is low. However, the package explicitly patches getBiosVendor.js and getMachineID.js to return fake/dummy values, and writes a hardcoded 'seewo' string to bypass BIOS vendor verification — the comment '绕过启动校验' (bypass startup verification) confirms this is intentional circumvention of the software's hardware-binding/activation checks. Bypassing license activation or hardware-binding DRM of proprietary software constitutes piracy and does not belong in the AUR, regardless of whether malware is present. Severity is rated high due to the piracy flag.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://static.cvte.com/file/myou/uploads/android_rom/8983aa56f595c4eb56f2828281e830d17a554b96/EasiNote_5.2.1.7.10161.39c-a136b.deb"

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 82%): The PKGBUILD downloads the official Seewo/CVTE vendor binary (static.cvte.com is the legitimate parent company's CDN), so the supply-chain concern is low. However, the package explicitly patches getBiosVendor.js and getMachineID.js to return fake/dummy values, and writes a hardcoded 'seewo' string to bypass BIOS vendor verification — the comment '绕过启动校验' (bypass startup verification) confirms this is intentional circumvention of the software's hardware-binding/activation checks. Bypassing license activation or hardware-binding DRM of proprietary software constitutes piracy and does not belong in the AUR, regardless of whether malware is present. Severity is rated high due to the piracy flag.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kirikaze Chiyuki <me@chyk.ink>
    
      2pkgname=com.seewo.easinote5
    
      3pkgver=5.2.1.7.10161
    
      4pkgrel=1
    
      5pkgdesc="Seewo EasiNote5 希沃白板 5，为互动教学而生。"
    
      6arch=('x86_64')
    
      7url="https://easinote.seewo.com/"
    
      8# url="https://gitlab.gz.cvte.cn/front-end/enow-cloud"
    
      9license=('custom')
    
      10depends=('desktop-file-utils' 'gtk3' 'libnotify' 'libxss' 'libxtst' 'openssl' 'xdg-utils' 'ffmpeg' 'curl' 'jsoncpp' 'libidn2' 'lsof')
    
      11makedepends=('patch' 'asar')
    
      12options=('!strip' '!emptydirs')
    
      13install=${pkgname}.install
    
      14source=(
    
      15	"https://static.cvte.com/file/myou/uploads/android_rom/8983aa56f595c4eb56f2828281e830d17a554b96/EasiNote_5.2.1.7.10161.39c-a136b.deb"
    
      16	"0001-patch-startup-script.patch"
    
      17	"0002-fake-bios-vendor.patch"
    
      18	"0003-dummy-machine-id.patch"
    
      19)
    
      20md5sums=(
    
      21	'a136b215ac4ab92b486b21ed1b9813c8'  # EasiNote5.deb
    
      22	'4b7afbc7035fc724e9dc76f517415b2b'  # 0001-patch-startup-script.patch
    
      23	'2a2dedcef4690c6bda0c751e71509476'  # 0002-fake-bios-vendor.patch
    
      24	'1b61732e47c34396f8b4cd8ce55d416a'  # 0003-dummy-machine-id.patch
    
      25)
    
      26
    
      27package() {
    
      28	tar xf "${srcdir}/data.tar.xz" -C "${pkgdir}"
    
      29
    
      30	APP_ROOT="${pkgdir}/opt/apps/${pkgname}/files"
    
      31	LIBS_DIR="${APP_ROOT}/resources/public/lib"
    
      32
    
      33	# 剥离动态链接库
    
      34	rm "${LIBS_DIR}/libcrypto"*
    
      35	rm "${LIBS_DIR}/libcurl"*
    
      36	rm "${LIBS_DIR}/libidn2"*
    
      37	rm "${LIBS_DIR}/libjsoncpp"*
    
      38	rm "${LIBS_DIR}/libssl"*
    
      39
    
      40	# 启动器和图标
    
      41	mkdir -p "${pkgdir}/usr/share/"
    
      42	mv "${pkgdir}/opt/apps/${pkgname}/entries/icons" "${pkgdir}/usr/share/icons"
    
      43	mv "${pkgdir}/opt/apps/${pkgname}/entries/applications" "${pkgdir}/usr/share/applications"
    
      44	sed -i "s#Icon\=/opt/apps/com.seewo.easinote5/entries/icons/hicolor/256x256/apps/EasiNote5.png#Icon\=EasiNote5#" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      45
    
      46	# 编辑启动脚本
    
      47	STARTUP_SCRIPT="${APP_ROOT}/${pkgname}.sh"
    
      48	patch "$STARTUP_SCRIPT" <"${srcdir}/0001-patch-startup-script.patch"
    
      49
    
      50	# 删除 alfred
    
      51	rm -rf "${APP_ROOT}/alfred"
    
      52
    
      53	# 权限
    
      54	chmod +x "${APP_ROOT}/mirror/ENMirror"
    
      55
    
      56	# 绕过启动校验
    
      57	echo 'seewo' >"${APP_ROOT}/resources/public/bios_version"
    
      58
    
      59	asar e "${APP_ROOT}/resources/app.asar" "${APP_ROOT}/resources/app"
    
      60	rm "${APP_ROOT}/resources/app.asar"
    
      61	patch "${APP_ROOT}/resources/app/dist/utils/getBiosVendor.js" < "${srcdir}/0002-fake-bios-vendor.patch"
    
      62	patch "${APP_ROOT}/resources/app/dist/utils/getMachineID.js" < "${srcdir}/0003-dummy-machine-id.patch"
    
      63	rm -rf "${APP_ROOT}/resources/app/code"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2