deepin-wine10-stable

maintainer mzwing · 1 votes · scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged The package downloads a prebuilt .deb binary from a non-whitelisted host (pro-store-packages.uniontech.com), which is not a standard or widely recognized software distribution domain, creating a supply-chain risk if the host is compromised or the package is swapped.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:13 "https://pro-store-packages.uniontech.com/appstore/pool/appstore/d/deepin-wine10-stable/deepin-wine10-stable_${_pkgver}_amd64.deb"
MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted host (pro-store-packages.uniontech.com), which is not a standard or widely recognized software distribution domain, creating a supply-chain risk if the host is compromised or the package is swapped.

PKGBUILD

1 offending line(s) highlighted
1# Contributer: mzwing <mzwing@mzwing.eu.org>
2
3pkgname='deepin-wine10-stable'
4_pkgver=10.14deepin8
5pkgver=${_pkgver//-/_}
6pkgrel=2
7pkgdesc="Deepin wine10 stable"
8arch=('x86_64')
9url="http://www.deepin.org"
10license=('Proprietary')
11makedepends=('tar')
12source=(
13 "https://pro-store-packages.uniontech.com/appstore/pool/appstore/d/deepin-wine10-stable/deepin-wine10-stable_${_pkgver}_amd64.deb"
14)
15noextract=(
16 "deepin-wine10-stable_${_pkgver}_amd64.deb"
17)
18sha256sums=('fa1119f2050e35273345909f84ec72091d565633ddde9bae8f3dd930b7cf8021')
19DLAGENTS=("https::/usr/bin/curl -A 'Debian\ APT-HTTP/1.3' -fLC - --retry 3 --retry-delay 3 -o %o %u")
20depends=(
21 alsa-lib # libasound2 (>= 1.0.16)
22 glibc # libc6 (>= 2.26)
23 libcapi # libcapi20-3
24 dbus # libdbus-1-3 (>= 1.9.16)
25 gcc-libs # libgcc1 (>= 1:3.0)
26 glib2 # libglib2.0-0 (>= 2.37.3)
27 libgphoto2 # libgphoto2-6 (>= 2.5.10), libgphoto2-port12 (>= 2.5.10)
28 gst-plugins-base-libs # libgstreamer-plugins-base1.0-0 (>= 1.8.0)
29 gstreamer # libgstreamer1.0-0 (>= 1.14.0)
30 pcsclite # libpcsclite1 (>= 1.3.3)
31 libpng # libpng16-16 (>= 1.6.2-1)
32 libpulse # libpulse0 (>= 0.99.1)
33 sane # libsane (>= 1.0.24)
34 systemd-libs # libudev1 (>= 183)
35 libusb # libusb-1.0-0 (>= 2:1.0.21)
36 libx11 # libx11-6
37 libxext # libxext6
38 ocl-icd # ocl-icd-libopencl1 | libopencl1, ocl-icd-libopencl1 (>= 1.0) | libopencl-1.2-1
39 alsa-plugins # libasound2-plugins
40 ncurses # libncurses6 | libncurses5 | libncurses
41)
42
43optdepends=(
44 libcap # libcap2-bin
45 cups # libcups2
46 fontconfig # libfontconfig1
47 freetype2 # libfreetype6
48 glu # libglu1-mesa | libglu1
49 gnutls # libgnutls30 | libgnutls28 | libgnutls26
50 libjpeg-turbo # libjpeg62-turbo | libjpeg8
51 krb5 # libgssapi-krb5-2, libkrb5-3
52 unixodbc # libodbc1
53 mesa # libosmesa6
54 sdl2-compat # libsdl2-2.0-0
55 v4l-utils # libv4l-0
56 libxcomposite # libxcomposite1
57 libxcursor # libxcursor1
58 libxfixes # libxfixes3
59 libxi # libxi6
60 libxinerama # libxinerama1
61 libxrandr # libxrandr2
62 libxrender # libxrender1
63 libxxf86vm # libxxf86vm1
64)
65
66package() {
67
68 mkdir -p "deepin-wine10-stable_${_pkgver}"
69 ar -x "deepin-wine10-stable_${_pkgver}_amd64.deb" data.tar.xz --output "deepin-wine10-stable_${_pkgver}"
70 tar -xf "deepin-wine10-stable_${_pkgver}/data.tar.xz" --directory="${pkgdir}"
71}
72

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 MEDIUM 2
2026-08-02 00:16:08 MEDIUM 2
2026-08-01 00:11:18 MEDIUM 2
2026-07-31 00:14:10 MEDIUM 2
2026-07-30 00:17:23 MEDIUM 2
2026-07-29 00:25:53 MEDIUM 2
2026-07-28 00:07:28 MEDIUM 2
2026-07-27 00:24:32 MEDIUM 2
2026-07-26 00:07:32 MEDIUM 2
2026-07-25 00:13:44 MEDIUM 2
2026-07-24 00:02:28 MEDIUM 2
2026-07-23 00:14:47 MEDIUM 2
2026-07-22 00:29:32 MEDIUM 2
2026-07-21 00:24:15 MEDIUM 2
2026-07-20 00:19:49 MEDIUM 2
2026-07-19 00:17:08 MEDIUM 2
2026-07-18 00:14:48 MEDIUM 2
2026-07-17 00:06:16 MEDIUM 2
2026-07-16 00:05:41 MEDIUM 2
2026-07-15 00:09:25 MEDIUM 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion