deepin-wine-cntv-cbox

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads two prebuilt binaries: a .deb from com-store-packages.uniontech.com (Deepin/UnionTech's official app store CDN, so reasonably legitimate) and a Windows .exe installer from download.cntv.cn (CCTV/CGTN's official download server, also plausibly legitimate). Both are executed/extracted and their contents are repackaged into the final installation. The sha256sums are present and pinned, which mitigates silent upstream substitution at the time of packaging, but does not protect against the upstream host being compromised and the maintainer updating the sums. The .exe is extracted with 7z and its inner CBox.7z is unpacked into a Wine prefix that gets installed system-wide — this is executed foreign binary code from a Chinese state broadcaster's CDN. The overall pattern (deepin-wine wrapper for a Chinese streaming app) is common in the AUR and not inherently malicious, but the combination of a Windows executable from a non-Western CDN being unpacked and run via Wine, with no GPG/vendor signature verification beyond sha256, constitutes a real supply-chain concern. The cheaper model's MEDIUM rating is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "${pkgname}-${_deepinver}.deb::https://com-store-packages.uniontech.com/appstore/pool/appstore/c/${_pkgname}/${_pkgname}_${_deepinver}_i386.deb"
PKGBUILD:23 "${pkgname}-${pkgver}.exe::https://download.cntv.cn/cbox/v6/ysyy_v${pkgver}_1001_setup_x86.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads two prebuilt binaries: a .deb from com-store-packages.uniontech.com (Deepin/UnionTech's official app store CDN, so reasonably legitimate) and a Windows .exe installer from download.cntv.cn (CCTV/CGTN's official download server, also plausibly legitimate). Both are executed/extracted and their contents are repackaged into the final installation. The sha256sums are present and pinned, which mitigates silent upstream substitution at the time of packaging, but does not protect against the upstream host being compromised and the maintainer updating the sums. The .exe is extracted with 7z and its inner CBox.7z is unpacked into a Wine prefix that gets installed system-wide — this is executed foreign binary code from a Chinese state broadcaster's CDN. The overall pattern (deepin-wine wrapper for a Chinese streaming app) is common in the AUR and not inherently malicious, but the combination of a Windows executable from a non-Western CDN being unpacked and run via Wine, with no GPG/vendor signature verification beyond sha256, constitutes a real supply-chain concern. The cheaper model's MEDIUM rating is appropriate.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=deepin-wine-cntv-cbox
    
      3_pkgname=com.cctv.deepin
    
      4_officalname=CBox
    
      5pkgver=6.0.0.2
    
      6_deepinver=1.0.0deepin9
    
      7pkgrel=3
    
      8pkgdesc="CGTN CBox on Deepin Wine 6"
    
      9arch=("x86_64")
    
      10url="https://app.cctv.com/"
    
      11license=('LicenseRef-freeware')
    
      12depends=(
    
      13    'deepin-wine6-stable'
    
      14    'deepin-wine-helper'
    
      15    'xdg-utils'
    
      16)
    
      17makedepends=(
    
      18    'p7zip'
    
      19)
    
      20install="${pkgname}.install"
    
      21source=(
    
      22    "${pkgname}-${_deepinver}.deb::https://com-store-packages.uniontech.com/appstore/pool/appstore/c/${_pkgname}/${_pkgname}_${_deepinver}_i386.deb"
    
      23    "${pkgname}-${pkgver}.exe::https://download.cntv.cn/cbox/v6/ysyy_v${pkgver}_1001_setup_x86.exe"
    
      24    "${pkgname}.sh"
    
      25)
    
      26sha256sums=('6e6ca3250a3a82dd46b29df450f508eff74f22cebcead9890677210b0610a4bd'
    
      27            '519b04ac61a4b3e9422de238ce5e76d2fafefe58f93776f99494f3eb59005264'
    
      28            '806668282a5e3cd44ba5b7020c556cdcc8de0284b24e1c146cf3e602dcdae333')
    
      29build() {
    
      30    sed -e "s|@appname@|${_officalname}|g" \
    
      31        -e "s|@pkgname@|${pkgname}|g" \
    
      32        -e "s|@appver@|${pkgver}|g" \
    
      33        -i "${srcdir}/${pkgname}.sh"
    
      34    bsdtar -xf "${srcdir}/data."* -C "${srcdir}"
    
      35    mv "${srcdir}/opt/apps/${_pkgname}" "${srcdir}/opt/apps/${pkgname}"
    
      36    sed -e "s|Icon=${_pkgname}|Icon=${pkgname}|g" \
    
      37        -e "s|Audio Video;|AudioVideo;|g" \
    
      38        -e "s|\"/opt/apps/${_pkgname}/files/run.sh\"|${pkgname}|g" \
    
      39        -i "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop"
    
      40    mkdir -p "${srcdir}/tmp" "${srcdir}/extractfiles"
    
      41    msg "Extracting Deepin Wine ${_officalname} archive ..."
    
      42    bsdtar -xf "${srcdir}/opt/apps/${pkgname}/files/files.7z" -C "${srcdir}/tmp"
    
      43    msg "Extracting latest ${_officalname} files to ${srcdir}/tmp/drive_c/Program Files/CNTV/${_officalname} ..."
    
      44    7z e -aoa "${pkgname}-${pkgver}.exe" -o"${srcdir}/extractfiles"
    
      45    bsdtar -xf "${srcdir}/extractfiles/${_officalname}.7z" -C "${srcdir}/tmp/drive_c/Program Files/CNTV/${_officalname}"
    
      46    msg "Repackaging app archive ..."
    
      47    rm -r "${srcdir}/opt/apps/${pkgname}/files/files.7z"
    
      48    7z a -t7z -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/tmp/*"
    
      49    rm -rf "${srcdir}/opt/apps/${pkgname}/info"
    
      50}
    
      51package() {
    
      52    cp -r "${srcdir}/opt" "${pkgdir}"
    
      53    md5sum "${srcdir}/opt/apps/${pkgname}/files/files.7z" | awk '{ print $1 }' > "${pkgdir}/opt/apps/${pkgname}/files/files.md5sum"
    
      54    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      55    for _icons in 32x32 128x128;do
    
      56        install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/icons/hicolor/${_icons}/apps/${_pkgname}.png" \
    
      57            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
    
      58    done
    
      59    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      60    install -Dm644 "${srcdir}/tmp/drive_c/Program Files/CNTV/${_officalname}/Licenses/"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      61}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2