deepin-wine-yuque

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt .deb package from d.store.deepinos.org.cn, which is the Deepin/Spark Store CDN — a Chinese third-party app store, not an official upstream vendor host. The .deb contains a Windows application wrapped in deepin-wine, including a files.7z archive that gets unpacked, modified (a DLL is injected into it), and repacked. The DLL (msmpeg2vdec.dll) is pulled from a personal GitHub repository (zxp19821005/My_AUR_Files), not from Microsoft or any official source. Both artifacts are executed/installed code: the .deb contains binaries that run under Wine, and the DLL is injected into the Wine prefix. While the sha256sums are pinned (providing some integrity guarantee), the source host is not the official yuque.com distribution channel, and the DLL comes from a personal repo. This is a genuine supply-chain concern: a compromised personal GitHub repo or CDN could substitute malicious binaries. The pattern is common in AUR deepin-wine packages and is not clearly malicious, but the combination of a third-party CDN binary + personal-repo DLL injection warrants medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "LICENSE-${pkgver}::https://www.yuque.com/terms"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt .deb package from d.store.deepinos.org.cn, which is the Deepin/Spark Store CDN — a Chinese third-party app store, not an official upstream vendor host. The .deb contains a Windows application wrapped in deepin-wine, including a files.7z archive that gets unpacked, modified (a DLL is injected into it), and repacked. The DLL (msmpeg2vdec.dll) is pulled from a personal GitHub repository (zxp19821005/My_AUR_Files), not from Microsoft or any official source. Both artifacts are executed/installed code: the .deb contains binaries that run under Wine, and the DLL is injected into the Wine prefix. While the sha256sums are pinned (providing some integrity guarantee), the source host is not the official yuque.com distribution channel, and the DLL comes from a personal repo. This is a genuine supply-chain concern: a compromised personal GitHub repo or CDN could substitute malicious binaries. The pattern is common in AUR deepin-wine packages and is not clearly malicious, but the combination of a third-party CDN binary + personal-repo DLL injection warrants medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_officalname=yuque
    
      3pkgname="deepin-wine-${_officalname}"
    
      4_pkgname="com.${_officalname}.spark"
    
      5_appname=YuQue
    
      6pkgver=3.2.2.1107
    
      7pkgrel=4
    
      8pkgdesc="新一代云端知识库，用于个人笔记与知识创作，团队协同与知识沉淀"
    
      9arch=("x86_64")
    
      10url="https://www.yuque.com/"
    
      11_downurl="https://d.store.deepinos.org.cn/"
    
      12license=('LicenseRef-custom')
    
      13conflicts=(
    
      14    "${_officalname}"
    
      15    "${_officalname}-pake"
    
      16)
    
      17depends=(
    
      18    'deepin-wine6-stable'
    
      19    'spark-dwine-helper'
    
      20    'libx11'
    
      21    'xdg-utils'
    
      22)
    
      23makedepends=(
    
      24    'p7zip'
    
      25)
    
      26install="${pkgname}.install"
    
      27source=(
    
      28    "${pkgname}-${pkgver}.deb::${_downurl}/store/office/${_pkgname}/${_pkgname}_${pkgver}spark14_all.deb"
    
      29    "msmpeg2vdec.dll.7z::https://raw.githubusercontent.com/zxp19821005/My_AUR_Files/main/${pkgname}/msmpeg2vdec.dll.7z"
    
      30    "LICENSE-${pkgver}::https://www.yuque.com/terms"
    
      31    "${pkgname}.sh"
    
      32)
    
      33sha256sums=('165ab89ecfa89c1639b3607599cb1e35393cde66251d9e470dbb23592a72a3c7'
    
      34            'f66967eb394b93a61c01b30efb2f03128e6d9d019526808d7db687aee29a8bb3'
    
      35            '79b82aa631d01a625dc18021c30234a03029bb69011460de83c4395928f75f36'
    
      36            '99ebf377576c233e2c7b54bdc2ecc983ef735a615697943f093b47ca55a448a1')
    
      37build() {
    
      38    sed -e "s|@bottlename@|${_appname}|g" \
    
      39        -e "s|@pkgname@|${pkgname}|g" \
    
      40        -e "s|@appver@|${pkgver}|g" \
    
      41        -i "${srcdir}/${pkgname}.sh"
    
      42    bsdtar -xf "${srcdir}/data."*
    
      43    mv "${srcdir}/opt/apps/${_pkgname}" "${srcdir}/opt/apps/${pkgname}"
    
      44    install -Dm755 -d "${srcdir}/tmp"
    
      45    bsdtar -xf "${srcdir}/opt/apps/${pkgname}/files/files.7z" -C "${srcdir}/tmp"
    
      46    install -Dm644 "${srcdir}/msmpeg2vdec.dll" "${srcdir}/tmp/drive_c/windows/system32"
    
      47    7z a -t7z -r "${srcdir}/opt/apps/${pkgname}/files/files.7z" "${srcdir}/tmp/*"
    
      48    sed "s|\"/opt/apps/${_pkgname}/files/run.sh\"|${pkgname} --disable-gpu|g;s|Icon=${_pkgname}|Icon=${pkgname}|g" \
    
      49        -i "${srcdir}/usr/share/applications/${_pkgname}.desktop"
    
      50    rm -rf "${srcdir}/opt/apps/${pkgname}/info"
    
      51}
    
      52package() {
    
      53    cp -r "${srcdir}/opt" "${pkgdir}"
    
      54    md5sum "${srcdir}/opt/apps/${pkgname}/files/files.7z" | awk '{ print $1 }' > "${pkgdir}/opt/apps/${pkgname}/files/files.md5sum"
    
      55    install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      56    install -Dm644 "${srcdir}/usr/share/icons/hicolor/scalable/apps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      57    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      58    install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      59}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2