deepin-wine-ximalaya

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a .deb and an .exe from a university mirror and the official site, respectively, to repackage legitimate Deepin Wine application files; both are verified by checksum and are part of normal AUR packaging for repackaged Windows apps, with no evidence of remote code execution or obfuscated payloads.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a .deb and an .exe from a university mirror and the official site, respectively, to repackage legitimate Deepin Wine application files; both are verified by checksum and are part of normal AUR packaging for repackaged Windows apps, with no evidence of remote code execution or obfuscated payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "${_sparkpkgname}_${_sparkver}_amd64.deb::https://mirrors.sdu.edu.cn/spark-store/store/music/${_sparkpkgname}/${_sparkpkgname}_${_sparkver}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_appname=ximalaya
    
      3pkgname="deepin-wine-${_appname}"
    
      4pkgver=4.0.2
    
      5pkgrel=3
    
      6_sparkpkgname="com.${_appname}.spark"
    
      7_sparkver=4.0.0spark9
    
      8pkgdesc="喜马拉雅，是中国领先的音频分享平台。用声音分享人类智慧，用声音服务美好生活，做一家人一辈子的精神食粮，是平台的使命和初心。"
    
      9arch=("x86_64")
    
      10url="https://www.ximalaya.com"
    
      11license=('LicenseRef-custom')
    
      12depends=(
    
      13    'deepin-wine6-stable'
    
      14    'spark-dwine-helper'
    
      15    'xdg-utils'
    
      16)
    
      17optdepends=(
    
      18    'wqy-microhei'
    
      19    'wqy-zenhei'
    
      20    'ttf-ms-fonts'
    
      21)
    
      22makedepends=(
    
      23    'p7zip'
    
      24)
    
      25provides=("${_appname}")
    
      26conflicts=("${_appname}" "${_sparkpkgname}")
    
      27install="${pkgname}.install"
    
      28source=(
    
      29    "${_sparkpkgname}_${_sparkver}_amd64.deb::https://mirrors.sdu.edu.cn/spark-store/store/music/${_sparkpkgname}/${_sparkpkgname}_${_sparkver}_amd64.deb"
    
      30    "${_appname}-${pkgver}.exe::${url}/down/lite/v2?client=win&channelId=99&subChannelId=100001"
    
      31    "LICENSE.html"
    
      32    "${pkgname}".sh
    
      33)
    
      34sha256sums=('95834bc4ad16e4822331adac43b5f4feb9aeba50d103788a2cefad72cd8dc941'
    
      35            '7bb0647d70828858fcccba3af63cffc8ac0179defaba674fb120bd3786c703be'
    
      36            '95b52ed4c2b0ef19d4a091da847c7dd20761699aa63a12bf933fa2064f49cd01'
    
      37            '8303c95e1a707be4e418d1750a47eaebf861f2cdff81a9e0c0212ae2edacef2a')
    
      38build() {
    
      39    sed -e "s|@appname@|${_appname}|g" \
    
      40        -e "s|@appver@|${pkgver}|g" \
    
      41        -e "s|@packagename@|${pkgname}|g" \
    
      42        -i "${pkgname}.sh"
    
      43    
    
      44    bsdtar -xf "${srcdir}/data."*
    
      45    mkdir -p "${srcdir}/tmp"
    
      46
    
      47    msg "Extracting Deepin Wine ${_appname} archive ..."
    
      48    bsdtar -xf "${srcdir}/opt/apps/${_sparkpkgname}/files/files.7z" -C "${srcdir}/tmp"
    
      49
    
      50    msg "Extracting latest ${_appname} installer to ${srcdir}/tmp/drive_c/Program Files (x86)/${_appname} ..."
    
      51    7z x -aoa "${_appname}-${pkgver}.exe"
    
      52    bsdtar -xf "${srcdir}/${_appname}-${pkgver%.804}-ia32.nsis.7z" -C "${srcdir}/tmp/drive_c/Program Files (x86)/${_appname}"
    
      53
    
      54    msg "Repackaging app archive ..."
    
      55    rm -rf "${srcdir}/opt/apps/${_sparkpkgname}/files/files.7z"
    
      56    7z a -t7z -r "${srcdir}/opt/apps/${_sparkpkgname}/files/files.7z" "${srcdir}/tmp/*"
    
      57
    
      58    sed "s|${_sparkpkgname}|${pkgname}|g;s|\"/opt/apps/${pkgname}/files/run.sh\" -u %u|${pkgname} -u %U|g" \
    
      59        -i "${srcdir}/opt/apps/${_sparkpkgname}/entries/applications/${_sparkpkgname}.desktop"
    
      60    md5sum "${srcdir}/opt/apps/${_sparkpkgname}/files/files.7z" | awk '{ print $1 }' > "${srcdir}/opt/apps/${_sparkpkgname}/files/files.md5sum"
    
      61}
    
      62package() {
    
      63    install -Dm755 -d "${pkgdir}/opt/apps/${pkgname}"
    
      64    cp -r "${srcdir}/opt/apps/${_sparkpkgname}/"{entries,files} "${pkgdir}/opt/apps/${pkgname}"
    
      65    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      66    ln -sf "/opt/apps/${pkgname}/files/run.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      67    install -Dm644 "${srcdir}/opt/apps/${_sparkpkgname}/entries/applications/${_sparkpkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      68    install -Dm644 "${srcdir}/opt/apps/${_sparkpkgname}/entries/icons/hicolor/scalable/apps/${_sparkpkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      69    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      70}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2