deepin-wine8-stable

maintainer tocer · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb (deepin-wine8-stable) from com-store-packages.uniontech.com, which is Deepin/UnionTech's official app store CDN — not a random personal host. UnionTech is the company behind Deepin Linux, so this is effectively the upstream vendor's own distribution server. However, the package is still a prebuilt closed-source Wine binary extracted and installed directly into the system, with no build-from-source step. The sha256sum is pinned, which mitigates casual tampering, but the binary is executed at runtime as a full Wine implementation with broad system access. The host is semi-official (vendor CDN) but not a widely recognized upstream like GitHub releases or a distro mirror. The DLAGENTS trick to spoof the APT User-Agent is a minor red flag (server restricts access to APT clients only), but is a known workaround for Deepin packages in the AUR community. Overall this is a real medium-risk supply-chain concern: a prebuilt binary from a vendor CDN that requires trust in UnionTech's infrastructure integrity, with no source build available.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://com-store-packages.uniontech.com/appstorev23/pool/appstore/d/deepin-wine8-stable/deepin-wine8-stable_${_pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb (deepin-wine8-stable) from com-store-packages.uniontech.com, which is Deepin/UnionTech's official app store CDN — not a random personal host. UnionTech is the company behind Deepin Linux, so this is effectively the upstream vendor's own distribution server. However, the package is still a prebuilt closed-source Wine binary extracted and installed directly into the system, with no build-from-source step. The sha256sum is pinned, which mitigates casual tampering, but the binary is executed at runtime as a full Wine implementation with broad system access. The host is semi-official (vendor CDN) but not a widely recognized upstream like GitHub releases or a distro mirror. The DLAGENTS trick to spoof the APT User-Agent is a minor red flag (server restricts access to APT clients only), but is a known workaround for Deepin packages in the AUR community. Overall this is a real medium-risk supply-chain concern: a prebuilt binary from a vendor CDN that requires trust in UnionTech's infrastructure integrity, with no source build available.

PKGBUILD

1 offending line(s) highlighted

      1# Contributer: abcfy2 <abcfy2@163.com>
    
      2
    
      3# DLAGENTS required to bypass User-Agent restriction on deepin's download server
    
      4DLAGENTS=("https::/usr/bin/curl -A 'APT' -fLC - --retry 3 --retry-delay 3 -o %o %u")
    
      5
    
      6pkgname='deepin-wine8-stable'
    
      7_pkgver=8.16deepin25-1
    
      8pkgver=${_pkgver//-/_}
    
      9pkgrel=1
    
      10pkgdesc="Deepin wine8 stable"
    
      11arch=('x86_64')
    
      12url="http://www.deepin.org"
    
      13license=('Proprietary')
    
      14makedepends=('tar')
    
      15source=(
    
      16    "https://com-store-packages.uniontech.com/appstorev23/pool/appstore/d/deepin-wine8-stable/deepin-wine8-stable_${_pkgver}_amd64.deb"
    
      17)
    
      18noextract=(
    
      19    "deepin-wine8-stable_${_pkgver}_amd64.deb"
    
      20)
    
      21sha256sums=('a272fe1259eab5dc2df4eb32212a1b580a8138bb312a18b0662f54d44592b167')
    
      22depends=(
    
      23    alsa-lib                   # libasound2 (>= 1.0.16)
    
      24    glibc                       # libc6 (>= 2.38)
    
      25    #libcapi                     # libcapi20-3
    
      26    dbus                        # libdbus-1-3 (>= 1.9.16)
    
      27    gcc-libs                    # libgcc-s1 (>= 3.0)
    
      28    #glib2                       # libglib2.0-0 (>= 2.37.3)
    
      29    libgphoto2                  # libgphoto2-6 (>= 2.5.10),  libgphoto2-port12 (>= 2.5.10)
    
      30    #gst-plugins-base            # libgstreamer-plugins-base1.0-0 (>= 1.0.0)
    
      31    #gstreamer                   # libgstreamer1.0-0 (>= 1.4.0)
    
      32    libpulse                    # libpulse0 (>= 0.99.1)
    
      33    sane                        # libsane (>= 1.0.27)
    
      34    systemd-libs                # libudev1 (>= 183)
    
      35    #libusb                      # libusb-1.0-0 (>= 2:1.0.21)
    
      36    wayland                     # libwayland-client0 (>= 1.20.0)
    
      37    libx11                      # libx11-6
    
      38    libxext                     # libxext6
    
      39    ocl-icd                     # ocl-icd-libopencl1 | libopencl1,  ocl-icd-libopencl1 (>= 1.0) | libopencl-1.2-1
    
      40    alsa-plugins                # libasound2-plugins
    
      41    ncurses                     # libncurses6 | libncurses5 | libncurses
    
      42)
    
      43
    
      44optdepends=(
    
      45    libcap                      # libcap2-bin
    
      46    cups                        # libcups2
    
      47    nss                         # libnss-myhostname
    
      48    fontconfig                  # libfontconfig1
    
      49    freetype2                    # libfreetype6
    
      50    mesa                        # libglu1-mesa | libglu1
    
      51    gnutls                      # libgnutls30 | libgnutls28 | libgnutls26
    
      52    libjpeg-turbo               # libjpeg62-turbo | libjpeg8
    
      53    krb5                        # libgssapi-krb5-2, libkrb5-3
    
      54    unixodbc                    # libodbc1
    
      55    mesa                        # libosmesa6
    
      56    sdl2                        # libsdl2-2.0-0
    
      57    v4l-utils                   # libv4l-0
    
      58    libxcomposite               # libxcomposite1
    
      59    libxcursor                  # libxcursor1
    
      60    libxfixes                   # libxfixes3
    
      61    libxi                       # libxi6
    
      62    libxinerama                 # libxinerama1
    
      63    libxrandr                   # libxrandr2
    
      64    libxrender                  # libxrender1
    
      65    libxxf86vm                  # libxxf86vm1
    
      66)
    
      67
    
      68package() {
    
      69
    
      70    mkdir -p "deepin-wine8-stable_${_pkgver}"
    
      71    ar -x "deepin-wine8-stable_${_pkgver}_amd64.deb" data.tar.xz --output "deepin-wine8-stable_${_pkgver}"
    
      72    tar -xf "deepin-wine8-stable_${_pkgver}/data.tar.xz" --directory="${pkgdir}"
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2