cxstudy-wine

maintainer jingluwei · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD has multiple severe issues beyond the non-standard git host: (1) It runs 'sudo wine regedit' inside the package() function, which executes Wine and modifies the user's Windows registry during package installation — this is arbitrary code execution in the build/install phase. (2) It uses 'sudo' inside package(), which is explicitly forbidden in AUR packaging and indicates the author expects to run privileged commands outside the normal makepkg sandbox. (3) It extracts opaque tar.gz archives (cxstudy.tar.gz, app.tar.gz) that are stored inside the git repository with no integrity verification (SKIP checksum on the git source, and no separate checksums for the embedded tarballs). (4) The git source is from gitcode.com (a Chinese mirror/forge) rather than the canonical atomgit.com URL referenced in the comments, meaning the actual source being fetched differs from the stated upstream. (5) The combination of unverifiable binary blobs in a git repo, execution of Wine with registry modification, and use of sudo constitutes a real code-execution supply-chain risk during installation.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 'cxstudy-wine::git+https://gitcode.com/JingluWei_chn/cxstudy-wine.git')

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 85%): This PKGBUILD has multiple severe issues beyond the non-standard git host: (1) It runs 'sudo wine regedit' inside the package() function, which executes Wine and modifies the user's Windows registry during package installation — this is arbitrary code execution in the build/install phase. (2) It uses 'sudo' inside package(), which is explicitly forbidden in AUR packaging and indicates the author expects to run privileged commands outside the normal makepkg sandbox. (3) It extracts opaque tar.gz archives (cxstudy.tar.gz, app.tar.gz) that are stored inside the git repository with no integrity verification (SKIP checksum on the git source, and no separate checksums for the embedded tarballs). (4) The git source is from gitcode.com (a Chinese mirror/forge) rather than the canonical atomgit.com URL referenced in the comments, meaning the actual source being fetched differs from the stated upstream. (5) The combination of unverifiable binary blobs in a git repo, execution of Wine with registry modification, and use of sudo constitutes a real code-execution supply-chain risk during installation.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jingluwei <weijinglu at qq dot com>
    
      2pkgname=cxstudy-wine
    
      3pkgver=1.4.1
    
      4pkgrel=1
    
      5# https://atomgit.com/JingluWei_chn/cxstudy-wine/tree/master
    
      6pkgdesc="a version of repacked wine app of cxstudy(学习通)"
    
      7arch=('x86_64')
    
      8url=""https://atomgit.com/JingluWei_chn/cxstudy-wine/tree/master
    
      9license=('MIT')
    
      10depends=('wine>=9.22' 'wine-mono' 'wine-gecko' 'noto-fonts-cjk' 'tar' 'git')
    
      11source=(
    
      12  'cxstudy-wine::git+https://gitcode.com/JingluWei_chn/cxstudy-wine.git')
    
      13sha256sums=('SKIP')
    
      14conflict=('cxstudy<=1.4.0')
    
      15
    
      16package() {
    
      17  cd "$srcdir"
    
      18  #$pkgdir/usr/bin/lib/cxstudy-wine
    
      19  mkdir -p "$pkgdir/usr/bin/lib"
    
      20  cp -r "$srcdir/cxstudy-wine" "$pkgdir/usr/bin/lib" 
    
      21  cd "$pkgdir/usr/bin/lib/cxstudy-wine/1.4.0/1.4.0"
    
      22  tar -zxvf "$pkgdir/usr/bin/lib/cxstudy-wine/1.4.0/1.4.0/cxstudy.tar.gz"
    
      23  rm "$pkgdir/usr/bin/lib/cxstudy-wine/1.4.0/1.4.0/cxstudy.tar.gz"
    
      24  cd "$pkgdir/usr/bin/lib/cxstudy-wine/1.4.0/1.4.0/resources"
    
      25  tar -zxvf "$pkgdir/usr/bin/lib/cxstudy-wine/1.4.0/1.4.0/resources/app.tar.gz"
    
      26  rm "$pkgdir/usr/bin/lib/cxstudy-wine/1.4.0/1.4.0/resources/app.tar.gz"
    
      27  sudo mv $pkgdir/usr/bin/lib/cxstudy-wine/1.4.0/cxstudy-wine.desktop /usr/share/applications/cxstudy-wine.desktop
    
      28  sudo chmod +x /usr/share/applications/cxstudy-wine.desktop
    
      29  sudo wine regedit "$pkgdir/usr/bin/lib/cxstudy-wine/1.4.0/share/fontreplace.reg"
    
      30  #wineboot -r
    
      31  #reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.学习通 /f
    
      32}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2