deepin-wine-welink

maintainer zxp19821005 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs two executed binary artifacts: (1) a prebuilt .deb from mirrors.sdu.edu.cn (a Chinese university Spark Store mirror, not an official Huawei source), and (2) a .exe installer from welink.huaweicloud.com (which is the official Huawei WeLink download domain). The .deb contains a Wine prefix with a 7z archive (files.7z) that gets extracted and repacked with the .exe injected into it, then installed system-wide. The sha256sums are pinned, which mitigates the risk of silent substitution at the time of packaging, but the SDU mirror is a third-party redistributor of Spark Store packages — not an official Huawei source — meaning the original .deb could have been tampered with before the checksum was recorded. The .exe from welink.huaweicloud.com is the official vendor download URL, which is legitimate. The overall pattern (deepin-wine wrapper pulling from Spark Store mirrors) is common in the AUR Chinese software ecosystem and not inherently malicious, but the non-official mirror for the .deb base package containing executed code constitutes a genuine supply-chain concern. The MEDIUM rating from the cheaper model is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "${pkgname}_${_sparkver}.deb::https://mirrors.sdu.edu.cn/spark-store-repository/store//chat/${_sparkname}/${_sparkname}_${_sparkver}_i386.deb"
PKGBUILD:32 "${_appname}-${pkgver}.exe::https://welink.huaweicloud.com/download/${_appname}_setup.exe"
PKGBUILD:34 "LICENSE.html::https://www.huaweicloud.com/declaration/sa_cua_computing.html"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs two executed binary artifacts: (1) a prebuilt .deb from mirrors.sdu.edu.cn (a Chinese university Spark Store mirror, not an official Huawei source), and (2) a .exe installer from welink.huaweicloud.com (which is the official Huawei WeLink download domain). The .deb contains a Wine prefix with a 7z archive (files.7z) that gets extracted and repacked with the .exe injected into it, then installed system-wide. The sha256sums are pinned, which mitigates the risk of silent substitution at the time of packaging, but the SDU mirror is a third-party redistributor of Spark Store packages — not an official Huawei source — meaning the original .deb could have been tampered with before the checksum was recorded. The .exe from welink.huaweicloud.com is the official vendor download URL, which is legitimate. The overall pattern (deepin-wine wrapper pulling from Spark Store mirrors) is common in the AUR Chinese software ecosystem and not inherently malicious, but the non-official mirror for the .deb base package containing executed code constitutes a genuine supply-chain concern. The MEDIUM rating from the cheaper model is appropriate.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_pkgname=welink
    
      3pkgname="deepin-wine-${_pkgname}"
    
      4_sparkname="com.huaweicloud.${_pkgname}.spark"
    
      5_appname=WeLink
    
      6pkgver=7.37.3
    
      7_sparkver=7.21.3.403spark1
    
      8pkgrel=2
    
      9pkgdesc="华为数字化办公实践,服务政企、高校等主要客户,是全场景安全、智能、的数字化办公平台,帮助AnyBody、AnyWhere、AnyDevice、doAnyBusiness4A办公。"
    
      10arch=("x86_64")
    
      11url="https://www.huaweicloud.com/product/welink.html"
    
      12license=('LicenseRef-custom')
    
      13depends=(
    
      14    'deepin-wine6-stable'
    
      15    'spark-dwine-helper'
    
      16    'xdg-utils'
    
      17)
    
      18makededpends=(
    
      19    'p7zip'
    
      20)
    
      21optdepends=(
    
      22    'wqy-microhei'
    
      23    'wqy-zenhei'
    
      24)
    
      25conflicts=(
    
      26    "${_pkgname}"
    
      27    "huaweicloudmeeting"
    
      28)
    
      29install="${pkgname}.install"
    
      30source=(
    
      31    "${pkgname}_${_sparkver}.deb::https://mirrors.sdu.edu.cn/spark-store-repository/store//chat/${_sparkname}/${_sparkname}_${_sparkver}_i386.deb"
    
      32    "${_appname}-${pkgver}.exe::https://welink.huaweicloud.com/download/${_appname}_setup.exe"
    
      33    #"fake_simsun.ttc::https://images.xuthus.cc/images/fake_simsun.ttc"
    
      34    "LICENSE.html::https://www.huaweicloud.com/declaration/sa_cua_computing.html"
    
      35    "${pkgname}.sh"
    
      36)
    
      37sha256sums=('2a5046177ad2f57ebeff4176ffe4ae2717eed19c8fd2e84fad5b9f44305d16d1'
    
      38            '045c334577032f51d963188d30254a0e1d8fea7876fbd7b00e78bd5b7bb59685'
    
      39            'd5d83468ded64766fdfdb7e0e5b0510fcaa3c3102bcd01d57ac213d2b9d09e1b'
    
      40            '457847c22fc306279a20070ee7578403653e5c2ed8c602065f5996cf353c4722')
    
      41build() {
    
      42    sed -e "s|@appname@|${_appname}|g" \
    
      43        -e "s|@pkgname@|${pkgname}|g" \
    
      44        -e "s|@sparkver@|${_sparkver%spark1}|g" \
    
      45        -e "s|@appver@|${pkgver}|g" \
    
      46        -i "${srcdir}/${pkgname}.sh"
    
      47    bsdtar -xf "${srcdir}/data.tar.xz"
    
      48    mv "${srcdir}/opt/apps/${_sparkname}" "${srcdir}/opt/apps/${pkgname}"
    
      49    mkdir -p "${srcdir}/tmp"
    
      50    msg "Extracting Deepin Wine ${_appname} archive ..."
    
      51    7z x -aoa "${srcdir}/opt/apps/${pkgname}/files/files.7z" -o"${srcdir}/tmp"     
    
      52    msg "Copying latest ${_appname} installer to ${srcdir}/tmp/drive_c/Program Files/${_appname} ..."
    
      53    rm -rf "${srcdir}/tmp/drive_c/Program Files/${_appname}/" "${srcdir}/tmp/drive_c/Program Files (x86)"
    
      54    mkdir -p "${srcdir}/tmp/drive_c/Program Files/${_appname}/"
    
      55    install -m644 "${srcdir}/${_appname}-${pkgver}.exe" "${srcdir}/tmp/drive_c/Program Files/${_appname}/${_appname}-${pkgver}.exe"
    
      56    #cp "${srcdir}/fake_simsun.ttc" "${srcdir}/tmp/drive_c/windows/Fonts/"
    
      57    msg "Repackaging app archive ..."
    
      58    rm -r "${srcdir}/opt/apps/${pkgname}/files/files.7z"
    
      59    7z a -t7z -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/tmp/*"
    
      60    sed -e "s|chat|Network|g" \
    
      61        -e "s|/opt/apps/${_sparkname}/entries/icons/hicolor/scalable/apps/${_sparkname}.png|${pkgname}|g" \
    
      62        -e "s|\"/opt/apps/${_sparkname}/files/run.sh\"|${pkgname}|g" \
    
      63        -i "${srcdir}/opt/apps/${pkgname}/entries/applications/${_sparkname}.desktop"
    
      64    rm -rf "${srcdir}/opt/apps/${pkgname}/info"
    
      65}
    
      66package() {
    
      67    cp -r "${srcdir}/opt" "${pkgdir}"
    
      68    md5sum "${pkgdir}/opt/apps/${pkgname}/files/files.7z" | awk '{ print $1 }' > "${pkgdir}/opt/apps/${pkgname}/files/files.md5sum"
    
      69    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/applications/${_sparkname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      70    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/icons/hicolor/scalable/apps/${_sparkname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      71    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      72    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      73}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2