deepin-wine-douyin

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads two binary artifacts: (1) a .deb from a university Spark Store mirror (mirrors.sdu.edu.cn), which is a third-party repackaging of proprietary software, and (2) a Windows .exe from the maintainer's own GitHub personal repository (zxp19821005/My_AUR_Files). The .exe is extracted and its contents replace the application binaries inside the Wine bottle before repackaging. Both sources have SHA256 checksums pinned, which mitigates casual tampering, but the fundamental concern remains: the .exe is sourced from the maintainer's personal GitHub releases rather than the official Douyin/ByteDance distribution channel, creating a supply-chain risk if that account is compromised or the file is substituted. The Spark Store .deb is also a third-party repackaging. Neither source is the official upstream vendor binary. The build process executes no shell code from these sources directly, but the extracted binaries will be run under deepin-wine6-stable at runtime. This is a genuine medium-severity supply-chain concern: unofficial/personal hosting of an executed binary, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "${_pkgname}_${_sparkver}_i386.deb::https://mirrors.sdu.edu.cn/spark-store//store/video/${_pkgname}/${_pkgname}_${_sparkver}_all.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): This PKGBUILD downloads two binary artifacts: (1) a .deb from a university Spark Store mirror (mirrors.sdu.edu.cn), which is a third-party repackaging of proprietary software, and (2) a Windows .exe from the maintainer's own GitHub personal repository (zxp19821005/My_AUR_Files). The .exe is extracted and its contents replace the application binaries inside the Wine bottle before repackaging. Both sources have SHA256 checksums pinned, which mitigates casual tampering, but the fundamental concern remains: the .exe is sourced from the maintainer's personal GitHub releases rather than the official Douyin/ByteDance distribution channel, creating a supply-chain risk if that account is compromised or the file is substituted. The Spark Store .deb is also a third-party repackaging. Neither source is the official upstream vendor binary. The build process executes no shell code from these sources directly, but the extracted binaries will be run under deepin-wine6-stable at runtime. This is a genuine medium-severity supply-chain concern: unofficial/personal hosting of an executed binary, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_appname=douyin
    
      3pkgname="deepin-wine-${_appname}"
    
      4_pkgname="com.${_appname}.spark"
    
      5_providername=ByteDance
    
      6pkgver=3.4.0
    
      7_sparkver=2.9.2spark7
    
      8pkgrel=2
    
      9pkgdesc="douyin,record beautify life;抖音，记录美好生活"
    
      10arch=('x86_64')
    
      11url="https://www.douyin.com"
    
      12_downurl="https://github.com/zxp19821005/My_AUR_Files"
    
      13license=('LicenseRef-custom')
    
      14depends=(
    
      15    'deepin-wine6-stable'
    
      16    'spark-dwine-helper'
    
      17    'xdg-utils'
    
      18)
    
      19makedepends=(
    
      20    'p7zip'
    
      21)
    
      22optdepends=(
    
      23    'wqy-microhei'
    
      24    'wqy-zenhei'
    
      25)
    
      26conflicts=("${_appname}")
    
      27install="${pkgname}.install"
    
      28source=(
    
      29    "${_pkgname}_${_sparkver}_i386.deb::https://mirrors.sdu.edu.cn/spark-store//store/video/${_pkgname}/${_pkgname}_${_sparkver}_all.deb"
    
      30	"${_appname}-${pkgver}.exe::${_downurl}/releases/download/${_appname}-v${pkgver}/${_appname}-v${pkgver}.exe"
    
      31    "LICENSE-${pkgver}.html"
    
      32    "${pkgname}.sh"
    
      33)
    
      34sha256sums=('f5bb3df57822718590e0bc432ed33f1548350add863a11e6a39058ea784c7c17'
    
      35            '5f50da1063c6cb68ee5ed2610a381cba79893689054644a70864a798be315bc1'
    
      36            '8a18c6c9d84fe0c25f838ced53aef6b031c58ab18ce687f0b0432599f65f4596'
    
      37            '2449301dc19b0fb82afaa7692f2e74cc8bad01296c7d3c5ac6e4f09bcc7f68ae')
    
      38build() {
    
      39    sed -e "s|@bottlename@|Deepin-${_appname}|g" \
    
      40        -e "s|@appver@|${pkgver}|g" \
    
      41        -e "s|@appname@|${_appname}|g" \
    
      42        -e "s|@packagename@|${pkgname}|g" \
    
      43        -e "s|@pathname@|${_providername}|g" \
    
      44        -i "${srcdir}/${pkgname}.sh"
    
      45    bsdtar -xf "${srcdir}/data."*
    
      46    mv "${srcdir}/opt/apps/${_pkgname}" "${srcdir}/opt/apps/${pkgname}"
    
      47    mkdir -p "${srcdir}/tmp" "${srcdir}/extracted_exe"
    
      48    msg "Extracting Deepin Wine ${_appname} archive ..."
    
      49    7z x -aoa "${srcdir}/opt/apps/${pkgname}/files/files.7z" -o"${srcdir}/tmp"
    
      50    7z e -aoa "${srcdir}/${_appname}-${pkgver}.exe" -o"${srcdir}/extracted_exe"    
    
      51    msg "Extract latest ${_appname} installer to ${srcdir}/tmp/drive_c/Program Files/${_providername}/${_appname} ..."
    
      52    rm -rf "${srcdir}/tmp/drive_c/Program Files/${_providername}/${_appname}"
    
      53    mkdir -p "${srcdir}/tmp/drive_c/Program Files/${_providername}/${_appname}"
    
      54    bsdtar -xf "${srcdir}/extracted_exe/app.7z" -C "${srcdir}/tmp/drive_c/Program Files/${_providername}/${_appname}"
    
      55    msg "Repackaging app archive ..."
    
      56    rm -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/opt/apps/${pkgname}/info"
    
      57    7z a -t7z -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/tmp/"*
    
      58    sed -e "s|Icon=${_pkgname}|Icon=${pkgname}|g" \
    
      59        -e "s|\"/opt/apps/${_pkgname}/files/run.sh\"|${pkgname}|g" \
    
      60        -i "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop"
    
      61}
    
      62package() {
    
      63    cp -r "${srcdir}/opt" "${pkgdir}"
    
      64    md5sum "${pkgdir}/opt/apps/${pkgname}/files/files.7z" | awk '{ print $1 }' > "${pkgdir}/opt/apps/${pkgname}/files/files.md5sum"
    
      65    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      66    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/icons/hicolor/scalable/apps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      67    install -Dm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      68    install -Dm644 "LICENSE-${pkgver}.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.html"
    
      69}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2