deepin-wine-aliyun-mail
LOW
maintainer zxp19821005
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads official binaries from Alibaba and a Deepin app store, plus a non-executable font file; all sources are checksummed and the build process is transparent, repackaging only for native integration, with no evidence of malicious behavior.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official binaries from Alibaba and a Deepin app store, plus a non-executable font file; all sources are checksummed and the build process is transparent, repackaging only for native integration, with no evidence of malicious behavior.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
"${_pkgname}_${_deepinver}_i386.deb::https://com-store-packages.uniontech.com/appstore/pool/appstore/c/${_pkgname}/${_pkgname}_${_deepinver}_i386.deb" -
PKGBUILD:26
"${_officalname}-${pkgver}.exe::https://aliyun-alimail-desktop.oss-cn-hangzhou.aliyuncs.com/alimail/alimail-standard/latest/${_officalname}.exe" -
PKGBUILD:27
"fake_simsun.ttc::https://images.xuthus.cc/images/fake_simsun.ttc" -
PKGBUILD:28
"LICENSE.html::https://help.aliyun.com/document_detail/464805.html"
PKGBUILD
4 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=deepin-wine-aliyun-mail
3
_pkgname=com.aliyun.mail.deepin
4
_officalname=AliMail
5
_providername=Alibaba
6
pkgver=2.7.1.13834
7
_deepinver=1.6.7.0deepin2
8
pkgrel=8
9
pkgdesc="Aliyun Mail client on Deepin Wine 6"
10
arch=("x86_64")
11
url="https://mail.aliyun.com/"
12
license=('LicenseRef-custom')
13
depends=(
14
'deepin-wine6-stable'
15
'deepin-wine-helper'
16
'xdg-utils'
17
'gtk2'
18
)
19
makedepends=(
20
'p7zip'
21
)
22
conflicts=("${pkgname}")
23
install="${pkgname}.install"
24
source=(
25
"${_pkgname}_${_deepinver}_i386.deb::https://com-store-packages.uniontech.com/appstore/pool/appstore/c/${_pkgname}/${_pkgname}_${_deepinver}_i386.deb"
26
"${_officalname}-${pkgver}.exe::https://aliyun-alimail-desktop.oss-cn-hangzhou.aliyuncs.com/alimail/alimail-standard/latest/${_officalname}.exe"
27
"fake_simsun.ttc::https://images.xuthus.cc/images/fake_simsun.ttc"
28
"LICENSE.html::https://help.aliyun.com/document_detail/464805.html"
29
"${pkgname}.sh"
30
)
31
noextract=("${_officalname}-${pkgver}.exe")
32
sha256sums=('7e020363732d448a29a394afa3f6a5f2c54e600987af599e3a4b6c0edec3a61e'
33
'f85e4a06c6da0781c4148dbe3ca4cf591996e445449aafb4198a747e22f9c1ce'
34
'3e2ed9203a5ce3b2f00b6c942d8fac6b24e7a6e7b1ebc863cee2e27d3ff487db'
35
'4e1c8cac900b9eb08b5830106c32913d3a5680230e073648f788dad479fdb0f2'
36
'2383c785f8b72f3d3a3529f0a9d8c2be0f03fc01b0b98218601eab421a3301e4')
37
build() {
38
sed -e "s|@bottlename@|Deepin-${_officalname}|g" \
39
-e "s|@sparkver@|${_deepinver}|g" \
40
-e "s|@appver@|${pkgver}|g" \
41
-e "s|@appname@|${pkgname}|g" \
42
-e "s|@pathname@|${_officalname}|g" \
43
-e "s|@providername@|${_providername}|g" \
44
-i "${srcdir}/${pkgname}.sh"
45
bsdtar -xf "${srcdir}/data."*
46
mv "${srcdir}/opt/apps/${_pkgname}" "${srcdir}/opt/apps/${pkgname}"
47
mkdir -p "${srcdir}/tmp"
48
msg "Extracting Deepin Wine ${_officalname} archive ..."
49
bsdtar -xf "${srcdir}/opt/apps/${pkgname}/files/files.7z" -C "${srcdir}/tmp"
50
msg "Copying latest ${_officalname} files to ${srcdir}/tmp/drive_c/ProgramData/Alibaba/${_officalname} ..."
51
rm -r "${srcdir}/tmp/drive_c/ProgramData/Alibaba"
52
mkdir -p "${srcdir}/tmp/drive_c/ProgramData/Alibaba/${_officalname}"
53
bsdtar -xf "${srcdir}/${_officalname}-${pkgver}.exe" -C "${srcdir}/tmp/drive_c/ProgramData/Alibaba/${_officalname}/"
54
cp "${srcdir}/fake_simsun.ttc" "${srcdir}/tmp/drive_c/windows/fonts/"
55
msg "Repackaging app archive ..."
56
rm -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/opt/apps/${pkgname}/info"
57
7z a -t7z -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/tmp/*"
58
sed -e "s|Icon=${_pkgname}|Icon=${pkgname}|g" \
59
-e "s|\"/opt/apps/${_pkgname}/files/run.sh\"|${pkgname}|g" \
60
-i "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop"
61
}
62
package() {
63
cp -r "${srcdir}/opt" "${pkgdir}"
64
md5sum "${srcdir}/opt/apps/${pkgname}/files/files.7z" | awk '{ print $1 }' > "${pkgdir}/opt/apps/${pkgname}/files/files.md5sum"
65
install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
66
for _icons in 16x16 24x24 32x32 48x48 64x64;do
67
install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/icons/hicolor/${_icons}/apps/${_pkgname}.png" \
68
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
69
done
70
install -Dm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
71
install -Dm644 "LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
72
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |