deepin-wine-ecloud

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt .deb package from mirrors.sdu.edu.cn (Shandong University mirror), which hosts the Spark Store repository. The .deb contains a files.7z archive with a Windows application to be run under deepin-wine8. The mirror is a Chinese university mirror that redistributes Spark Store packages, not the official upstream release infrastructure (cloud.189.cn). While Spark Store mirrors at Chinese universities are commonly used in this ecosystem of deepin-wine AUR packages, the source is still a third-party repackaged binary (Spark Store repackages Windows apps for deepin-wine), not the official vendor release. The package installs an executed binary/wine application from this non-official host. The sha256sum is pinned, which mitigates MITM risk but not a compromised host serving a malicious package at the same hash. This is a genuine medium-severity supply-chain concern: a prebuilt executable payload sourced from a non-official third-party host (Spark Store via a university mirror), not the official vendor. This pattern is consistent with many similar deepin-wine AUR packages and is not clearly malicious, but the risk is real.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "${pkgname}-${pkgver}.deb::https://mirrors.sdu.edu.cn/spark-store/store/network/${_sparkname}/${_sparkname}_${pkgver}_all.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt .deb package from mirrors.sdu.edu.cn (Shandong University mirror), which hosts the Spark Store repository. The .deb contains a files.7z archive with a Windows application to be run under deepin-wine8. The mirror is a Chinese university mirror that redistributes Spark Store packages, not the official upstream release infrastructure (cloud.189.cn). While Spark Store mirrors at Chinese universities are commonly used in this ecosystem of deepin-wine AUR packages, the source is still a third-party repackaged binary (Spark Store repackages Windows apps for deepin-wine), not the official vendor release. The package installs an executed binary/wine application from this non-official host. The sha256sum is pinned, which mitigates MITM risk but not a compromised host serving a malicious package at the same hash. This is a genuine medium-severity supply-chain concern: a prebuilt executable payload sourced from a non-official third-party host (Spark Store via a university mirror), not the official vendor. This pattern is consistent with many similar deepin-wine AUR packages and is not clearly malicious, but the risk is real.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_appname=eCloud
    
      3_officalname=ecloud
    
      4pkgname="deepin-wine-${_officalname}"
    
      5pkgver=6.6.0spark10
    
      6_sparkname=cn.189.cloud.spark
    
      7pkgrel=1
    
      8pkgdesc="China Telecom eCloud Client on Deepin Wine6.天翼云盘客户端,文件云端存储,从此抛弃U盘,文件自动同步,便捷上传下载."
    
      9arch=("x86_64")
    
      10url="https://cloud.189.cn/"
    
      11license=('LicenseRef-freeware')
    
      12depends=(
    
      13    'deepin-wine8-stable'
    
      14    'spark-dwine-helper'
    
      15    'xdg-utils'
    
      16)
    
      17optdepends=(
    
      18    'wqy-microhei'
    
      19    'wqy-zenhei'
    
      20)
    
      21makedepends=(
    
      22    'p7zip'
    
      23)
    
      24conflicts=()
    
      25provides=("${_officalname}")
    
      26install="${pkgname}.install"
    
      27source=(
    
      28    "${pkgname}-${pkgver}.deb::https://mirrors.sdu.edu.cn/spark-store/store/network/${_sparkname}/${_sparkname}_${pkgver}_all.deb"
    
      29    "LICENSE.html"
    
      30    "${pkgname}.sh"
    
      31)
    
      32sha256sums=('93eef97dac4a7ec9556c45a18b68a7d804138bdf0a6f447bbb8afbb12a3a7475'
    
      33            '1ed45cc3d1362c9a00f995dc22ad452203fc9e786f703e8d73eed4ecc3b97d35'
    
      34            'f9ff267382d6615dfe133b84453f34da7cd037edec432055396b62b6869492a5')
    
      35build() {
    
      36    sed -e "s|@bottlename@|${_appname}|g" \
    
      37        -e "s|@appver@|${pkgver}|g" \
    
      38        -e "s|@appname@|${pkgname}|g" \
    
      39        -e "s|@pathname@|${_officalname}|g" \
    
      40        -e "s|@runname@|${_appname}|g" \
    
      41        -i "${srcdir}/${pkgname}.sh"
    
      42    bsdtar -xf "${srcdir}/data."*
    
      43    mv "${srcdir}/opt/apps/${_sparkname}" "${srcdir}/opt/apps/${pkgname}"
    
      44    rm -rf "${srcdir}/opt/apps/${pkgname}/info"
    
      45    sed -e "s|\"/opt/apps/${_sparkname}/files/run.sh\"|${pkgname}|g" \
    
      46        -e "s|Icon=${_sparkname}|Icon=${pkgname}|g" \
    
      47        -i "${srcdir}/opt/apps/${pkgname}/entries/applications/${_sparkname}.desktop"
    
      48}
    
      49package() {
    
      50    mkdir -p "${pkgdir}/opt/apps"
    
      51    cp -rf "${srcdir}/opt/apps/${pkgname}" "${pkgdir}/opt/apps"
    
      52    md5sum "${pkgdir}/opt/apps/${pkgname}/files/files.7z" | awk '{ print $1 }' > "${pkgdir}/opt/apps/${pkgname}/files/files.md5sum"
    
      53    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/applications/${_sparkname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      54    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/icons/hicolor/scalable/apps/${_sparkname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      55    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      56    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      57}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2