deepin-wine-tencent-edu

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads two prebuilt binaries: a .deb from uniontech.com (the Deepin/UOS official app store, a semi-official but not universally trusted host) and a .exe installer from down.qq.com (Tencent's official CDN for QQ-family products). Both have sha256sums pinned, which mitigates silent substitution risk. The .exe is extracted (not run during build) via 7z and repackaged into a Wine bottle; it will be executed at runtime inside Wine. The .deb is also from a vendor-controlled host. While down.qq.com is Tencent's legitimate download CDN and uniontech.com is the official Deepin store, neither is a standard upstream source in the Arch/AUR sense — they are proprietary vendor binaries with no source build. The pinned checksums reduce supply-chain risk significantly compared to an unpinned case. The pattern (deepin-wine wrapper + official vendor .exe) is extremely common in the AUR for Chinese software. Given pinned checksums and that both hosts are the actual official vendor CDNs for these products, this is closer to a borderline clean/low case, but the execution of a prebuilt proprietary .exe in Wine from a non-open-source vendor host with no reproducibility keeps it at medium by strict supply-chain standards.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "${_pkgname}_${_deepinver}.deb::https://com-store-packages.uniontech.com/appstore/pool/appstore/c/${_pkgname}/${_pkgname}_${_deepinver}_i386.deb"
PKGBUILD:23 "${_officalname}-${pkgver}.exe::https://down.qq.com/txedupc/EduInstall_${pkgver}_10193.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads two prebuilt binaries: a .deb from uniontech.com (the Deepin/UOS official app store, a semi-official but not universally trusted host) and a .exe installer from down.qq.com (Tencent's official CDN for QQ-family products). Both have sha256sums pinned, which mitigates silent substitution risk. The .exe is extracted (not run during build) via 7z and repackaged into a Wine bottle; it will be executed at runtime inside Wine. The .deb is also from a vendor-controlled host. While down.qq.com is Tencent's legitimate download CDN and uniontech.com is the official Deepin store, neither is a standard upstream source in the Arch/AUR sense — they are proprietary vendor binaries with no source build. The pinned checksums reduce supply-chain risk significantly compared to an unpinned case. The pattern (deepin-wine wrapper + official vendor .exe) is extremely common in the AUR for Chinese software. Given pinned checksums and that both hosts are the actual official vendor CDNs for these products, this is closer to a borderline clean/low case, but the execution of a prebuilt proprietary .exe in Wine from a non-open-source vendor host with no reproducibility keeps it at medium by strict supply-chain standards.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com> 
    
      2pkgname=deepin-wine-tencent-edu
    
      3pkgver=4.6.1.2
    
      4_pkgname=com.tencent.edu.deepin
    
      5_deepinver=3.0.3.55deepin6
    
      6_officalname=TXEDU
    
      7pkgrel=6
    
      8pkgdesc="Tencent Classroom on Deepin Wine 6.腾讯课堂"
    
      9arch=("x86_64")
    
      10url="https://ke.qq.com"
    
      11license=('LicenseRef-custom')
    
      12depends=(
    
      13    'deepin-wine6-stable'
    
      14    'spark-dwine-helper'
    
      15    'xdg-utils'
    
      16)
    
      17makedepends=(
    
      18    'p7zip'
    
      19)
    
      20install="${pkgname}.install"
    
      21source=(
    
      22    "${_pkgname}_${_deepinver}.deb::https://com-store-packages.uniontech.com/appstore/pool/appstore/c/${_pkgname}/${_pkgname}_${_deepinver}_i386.deb"
    
      23    "${_officalname}-${pkgver}.exe::https://down.qq.com/txedupc/EduInstall_${pkgver}_10193.exe"
    
      24    "LICENSE.html::${url}/article/645"
    
      25    "${pkgname}.sh"
    
      26)
    
      27sha256sums=('c61e98e1cff8eb5274c79499d807d08712f5092bff1e73c263849780c000da41'
    
      28            '0898729e7784b2fc63aad5cef7bda66a5a2853c3b156deea2280ede56ace218d'
    
      29            'e7c9efe5e722cfc9c66420d5d111202a28bbbdaa14832dfaa676e9da6e44c367'
    
      30            'a0c3e6aeee5f2a4a7f9fec3e5e6d2e4372eba13785fe8339c446e184093bf729')
    
      31build() {
    
      32    sed -e "s|@bottlename@|Deepin-${_officalname}|g" \
    
      33        -e "s|@appver@|${pkgver}|g" \
    
      34        -e "s|@packagename@|${pkgname}|g" \
    
      35        -e "s|@appname@|${_officalname}|g" \
    
      36        -i "${srcdir}/${pkgname}.sh"
    
      37    bsdtar -xf "${srcdir}/data."*
    
      38    mv "${srcdir}/opt/apps/${_pkgname}" "${srcdir}/opt/apps/${pkgname}"
    
      39    sed -e "s|Icon=${_pkgname}|Icon=${pkgname}|g" \
    
      40        -e "s|\"/opt/apps/${_pkgname}/files/run.sh\"|${pkgname}|g" \
    
      41        -i "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop"
    
      42
    
      43    mkdir -p "${srcdir}/tmp"
    
      44    msg "Extracting Deepin Wine ${_officalname} archive ..."
    
      45    bsdtar -xf "${srcdir}/opt/apps/${pkgname}/files/files.7z" -C "${srcdir}/tmp"
    
      46
    
      47    msg "Extracting latest ${_officalname} files to ${srcdir}/tmp/drive_c/Program Files/Tencent/EDU/bin ..."
    
      48    7z x -aoa "${srcdir}/${_officalname}-${pkgver}.exe" -o"${srcdir}/tmp/drive_c/Program Files/Tencent/EDU"
    
      49    rm -rf "${srcdir}/tmp/drive_c/Program Files/Tencent/EDU/\$PLUGINSDIR"
    
      50
    
      51    msg "Repackaging app archive ..."
    
      52    rm -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/opt/apps/${pkgname}/info"
    
      53    7z a -t7z -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/tmp/*"
    
      54}
    
      55package() {
    
      56    mkdir -p "${pkgdir}/opt/apps"
    
      57    cp -r "${srcdir}/opt/apps/${pkgname}" "${pkgdir}/opt/apps"
    
      58    md5sum "${srcdir}/opt/apps/${pkgname}/files/files.7z" | awk '{ print $1 }' > "${pkgdir}/opt/apps/${pkgname}/files/files.md5sum"
    
      59    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      60    for _icons in 32x32 48x48 128x128;do
    
      61        install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/icons/hicolor/${_icons}/apps/${_pkgname}.png" \
    
      62            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
    
      63    done
    
      64    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      65    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      66}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2