deepin-wine-xiguavideo

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The .exe is downloaded from lf-xigua-pc.ixigua.com, which is the official CDN for iXigua (ByteDance's video platform) — this is the vendor's own distribution infrastructure, not a random personal host. The file has a pinned sha256sum (555761bb...) providing integrity verification. The .exe is never executed directly; it is unpacked with 7z to extract app-32.7z, which is then used to replace Wine bottle contents inside a deepin-wine container. The other source is a .deb from mirrors.sdu.edu.cn (Spark Store mirror), also checksummed. The pattern of downloading a Windows installer and extracting its contents into a Wine bottle is standard practice for this class of deepin-wine AUR packages. There is no code execution of the downloaded binary, no obfuscation, and integrity is enforced via sha256sums. The cheaper model's concern about the CDN host being 'non-standard' is a false positive — it is the official vendor CDN. Risk is low (non-official mirror for the .deb, unofficial CDN domain that is nonetheless vendor-owned), not medium.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The .exe is downloaded from lf-xigua-pc.ixigua.com, which is the official CDN for iXigua (ByteDance's video platform) — this is the vendor's own distribution infrastructure, not a random personal host. The file has a pinned sha256sum (555761bb...) providing integrity verification. The .exe is never executed directly; it is unpacked with 7z to extract app-32.7z, which is then used to replace Wine bottle contents inside a deepin-wine container. The other source is a .deb from mirrors.sdu.edu.cn (Spark Store mirror), also checksummed. The pattern of downloading a Windows installer and extracting its contents into a Wine bottle is standard practice for this class of deepin-wine AUR packages. There is no code execution of the downloaded binary, no obfuscation, and integrity is enforced via sha256sums. The cheaper model's concern about the CDN host being 'non-standard' is a false positive — it is the official vendor CDN. Risk is low (non-official mirror for the .deb, unofficial CDN domain that is nonetheless vendor-owned), not medium.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 "${pkgname}-${_deepinver}.deb::https://mirrors.sdu.edu.cn/spark-store-repository/store/video/${_pkgname}/${_pkgname}_${_deepinver}_amd64.deb"
PKGBUILD:35 "${_appname}-${pkgver}.exe::https://lf-xigua-pc.ixigua.com/obj/xigua-video-electron/6922326164589517070/releases/11463809/${pkgver}/win32/xigua-video-${pkgver}-default.exe"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_appname=xiguavideo
    
      3_bottlename=Deepin-XiguaVideo
    
      4pkgname="deepin-wine-${_appname}"
    
      5_pkgname=com.ixigua.xigua-video.spark
    
      6_zhsname="西瓜视频"
    
      7pkgver=1.0.9
    
      8_deepinver=1.0.6spark1
    
      9pkgrel=1
    
      10pkgdesc="XiGua Video on Deepin Wine 6"
    
      11arch=('x86_64')
    
      12url="https://www.ixigua.com"
    
      13license=('LicenseRef-freeware')
    
      14conflicts=(
    
      15    "${_appname}"
    
      16    "${pkgname}"
    
      17)
    
      18provides=("${_appname}=${pkgver}")
    
      19depends=(
    
      20    'deepin-wine6-stable'
    
      21    'spark-dwine-helper'
    
      22    'xdg-utils'
    
      23)
    
      24makedepends=(
    
      25    'p7zip'
    
      26)
    
      27optdepends=(
    
      28    'wqy-zenhei'
    
      29    'wqy-microhei'
    
      30)
    
      31noextract=("${_appname}-${pkgver}.exe")
    
      32install="${pkgname}.install"
    
      33source=(
    
      34    "${pkgname}-${_deepinver}.deb::https://mirrors.sdu.edu.cn/spark-store-repository/store/video/${_pkgname}/${_pkgname}_${_deepinver}_amd64.deb"
    
      35    "${_appname}-${pkgver}.exe::https://lf-xigua-pc.ixigua.com/obj/xigua-video-electron/6922326164589517070/releases/11463809/${pkgver}/win32/xigua-video-${pkgver}-default.exe"
    
      36    "LICENSE.html"
    
      37    "${pkgname}.sh"
    
      38)
    
      39sha256sums=('18b2277ea23d6a61d45197b422b99a53e7f5f5e2764f1f5616443984598af321'
    
      40            '555761bb662ca4268c737e198937de1a3ba722b44707a6f5ce605445cfaa09c2'
    
      41            '37bfde6970ae8f7575aa29b1146a5662e0780f6ceb5b99128bca6ae6ebdc0b09'
    
      42            '5dc00208bef4da3d30f261f64696eebe44648bc013de3442482896fb02ffbe2e')
    
      43build() {
    
      44    sed -e "s|@bottlename@|${_bottlename}|g" \
    
      45        -e "s|@appver@|${pkgver}|g" \
    
      46        -e "s|@packagename@|${pkgname}|g" \
    
      47        -e "s|@zhsname@|${_zhsname}|g" \
    
      48        -i "${srcdir}/${pkgname}.sh"
    
      49    bsdtar -xf "${srcdir}/data."*
    
      50    mv "${srcdir}/opt/apps/${_pkgname}" "${srcdir}/opt/apps/${pkgname}"
    
      51    mkdir -p "${srcdir}/tmp" "${srcdir}/temp"
    
      52    msg "Extracting Deepin Wine ${_appname} archive ..."
    
      53    7z x -aoa "${srcdir}/opt/apps/${pkgname}/files/files.7z" -o"${srcdir}/tmp"
    
      54
    
      55    msg "Extracting latest ${_officalname} files ..."
    
      56    7z e -aoa "${srcdir}/${_appname}-${pkgver}.exe" -o"${srcdir}/temp"
    
      57    bsdtar -xf "${srcdir}/temp/app-32.7z" -C "${srcdir}/tmp/drive_c/Program Files (x86)/xigua-video-electron"
    
      58
    
      59    msg "Repackaging app archive ..."
    
      60    rm -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/opt/apps/${pkgname}/info"
    
      61    7z a -t7z -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/tmp/*"
    
      62
    
      63    sed -e "s|Icon=${_pkgname}|Icon=${pkgname}|g" \
    
      64        -e "s|\"/opt/apps/${_pkgname}/files/run.sh\"|${pkgname}|g" \
    
      65        -i "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop"
    
      66}
    
      67package() {
    
      68    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      69    cp -r "${srcdir}/opt" "${pkgdir}"
    
      70    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      71    install -Dm644 "${srcdir}/opt/apps/${pkgname}/entries/icons/hicolor/scalable/apps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      72    install -Dm644 "LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      73}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2