coremail

maintainer ernest · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from lunkrcdn.icoremail.net, which is a CDN subdomain of icoremail.net — the company behind Coremail (a well-known Chinese enterprise email platform). The domain is plausibly the vendor's own CDN rather than a random personal host. However, the package installs a closed-source, prebuilt binary (an Electron-based email client) directly from this CDN with only an MD5 checksum (which is cryptographically weak and provides minimal integrity assurance). There is no GPG signature verification. The binary runs with full user privileges and could exfiltrate email credentials. The host is not the project's primary marketing domain (www-lunkr.coremail.cn) but is a CDN subdomain, which is a common pattern for software distribution. The risk is a real supply-chain concern: if the CDN host is compromised or the binary is swapped, the MD5 check provides little protection. This is a classic medium-severity AUR pattern — prebuilt proprietary binary from a vendor-adjacent but not primary domain, with weak integrity verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("https://lunkrcdn.icoremail.net/cab/publish/lunkr4mail/cn.coremail.cmclient-ubuntu_${pkgver}-${pkgrel}_amd64.ubuntu.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from lunkrcdn.icoremail.net, which is a CDN subdomain of icoremail.net — the company behind Coremail (a well-known Chinese enterprise email platform). The domain is plausibly the vendor's own CDN rather than a random personal host. However, the package installs a closed-source, prebuilt binary (an Electron-based email client) directly from this CDN with only an MD5 checksum (which is cryptographically weak and provides minimal integrity assurance). There is no GPG signature verification. The binary runs with full user privileges and could exfiltrate email credentials. The host is not the project's primary marketing domain (www-lunkr.coremail.cn) but is a CDN subdomain, which is a common pattern for software distribution. The risk is a real supply-chain concern: if the CDN host is compromised or the binary is swapped, the MD5 check provides little protection. This is a classic medium-severity AUR pattern — prebuilt proprietary binary from a vendor-adjacent but not primary domain, with weak integrity verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ernest <307141632@qq.com>
    
      2pkgname=coremail
    
      3pkgdesc="Coremail 邮箱客户端 安全省心，轻松连通世界" 
    
      4pkgver=4.2.1
    
      5pkgrel=1427
    
      6arch=('x86_64')
    
      7url="https://www-lunkr.coremail.cn/"
    
      8license=('LicenseRef-coremail')
    
      9source=("https://lunkrcdn.icoremail.net/cab/publish/lunkr4mail/cn.coremail.cmclient-ubuntu_${pkgver}-${pkgrel}_amd64.ubuntu.deb")
    
      10md5sums=('4b37ad3c5048634932c46b57847e9de8')
    
      11options=('!strip' '!debug')
    
      12DLAGENTS=('https::/usr/bin/curl -A "Mozilla/5.0" -fLC - --retry 3 --retry-delay 3 -o %o %u')
    
      13
    
      14prepare() {
    
      15    mv "cn.coremail.cmclient-ubuntu_${pkgver}-${pkgrel}_amd64.ubuntu.deb" "${pkgver}.deb"
    
      16    ar -x "${pkgver}.deb"
    
      17    mkdir -p "${pkgname}-${pkgver}"
    
      18    tar -xf data.tar.xz --directory="${pkgname}-${pkgver}"
    
      19}
    
      20
    
      21package() {
    
      22    cd "$pkgname-$pkgver"
    
      23    cp -r ./ ${pkgdir}/
    
      24    
    
      25    # 安装图标到hicolor主题
    
      26    install -dm755 "${pkgdir}/usr/share/icons/hicolor/scalable/apps"
    
      27    if [ -f "${pkgdir}/opt/apps/cmclient/entries/icons/cmclient.svg" ]; then
    
      28        cp "${pkgdir}/opt/apps/cmclient/entries/icons/cmclient.svg" \
    
      29           "${pkgdir}/usr/share/icons/hicolor/scalable/apps/coremail.svg"
    
      30    fi
    
      31    
    
      32    # 修改desktop文件，添加Path
    
      33    find "${pkgdir}" -name "*.desktop" -type f -exec \
    
      34        sed -i 's/Icon=.*/Icon=coremail/' {} \;
    
      35    find "${pkgdir}" -name "*.desktop" -type f -exec \
    
      36        sed -i '/^Exec=/i Path=/opt/apps/cmclient/files/' {} \;
    
      37    
    
      38    # 解决 Wayland 兼容性问题
    
      39    sed -i '/^[[:space:]]*export LD_LIBRARY_PATH/i \
    
      40if [ "$XDG_SESSION_TYPE" = "wayland" ]; then\
    
      41  export GDK_BACKEND=x11\
    
      42fi' "${pkgdir}/opt/apps/cmclient/files/cmclient.sh"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2