deepin-wine8-stable

MEDIUM
maintainer tocer 3 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

This PKGBUILD downloads a prebuilt binary .deb (deepin-wine8-stable) from com-store-packages.uniontech.com, which is Deepin/UnionTech's official app store CDN — not a random personal host. UnionTech is the company behind Deepin Linux, so this is effectively the upstream vendor's own distribution server. However, the package is still a prebuilt closed-source Wine binary extracted and installed directly into the system, with no build-from-source step. The sha256sum is pinned, which mitigates casual tampering, but the binary is executed at runtime as a full Wine implementation with broad system access. The host is semi-official (vendor CDN) but not a widely recognized upstream like GitHub releases or a distro mirror. The DLAGENTS trick to spoof the APT User-Agent is a minor red flag (server restricts access to APT clients only), but is a known workaround for Deepin packages in the AUR community. Overall this is a real medium-risk supply-chain concern: a prebuilt binary from a vendor CDN that requires trust in UnionTech's infrastructure integrity, with no source build available.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:16 "https://com-store-packages.uniontech.com/appstorev23/pool/appstore/d/deepin-wine8-stable/deepin-wine8-stable_${_pkgver}_amd64.deb"
Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb (deepin-wine8-stable) from com-store-packages.uniontech.com, which is Deepin/UnionTech's official app store CDN — not a random personal host. UnionTech is the company behind Deepin Linux, so this is effectively the upstream vendor's own distribution server. However, the package is still a prebuilt closed-source Wine binary extracted and installed directly into the system, with no build-from-source step. The sha256sum is pinned, which mitigates casual tampering, but the binary is executed at runtime as a full Wine implementation with broad system access. The host is semi-official (vendor CDN) but not a widely recognized upstream like GitHub releases or a distro mirror. The DLAGENTS trick to spoof the APT User-Agent is a minor red flag (server restricts access to APT clients only), but is a known workaround for Deepin packages in the AUR community. Overall this is a real medium-risk supply-chain concern: a prebuilt binary from a vendor CDN that requires trust in UnionTech's infrastructure integrity, with no source build available.

PKGBUILD

1 offending line(s) highlighted
1# Contributer: abcfy2 <abcfy2@163.com>
2
3# DLAGENTS required to bypass User-Agent restriction on deepin's download server
4DLAGENTS=("https::/usr/bin/curl -A 'APT' -fLC - --retry 3 --retry-delay 3 -o %o %u")
5
6pkgname='deepin-wine8-stable'
7_pkgver=8.16deepin25-1
8pkgver=${_pkgver//-/_}
9pkgrel=1
10pkgdesc="Deepin wine8 stable"
11arch=('x86_64')
12url="http://www.deepin.org"
13license=('Proprietary')
14makedepends=('tar')
15source=(
16 "https://com-store-packages.uniontech.com/appstorev23/pool/appstore/d/deepin-wine8-stable/deepin-wine8-stable_${_pkgver}_amd64.deb"
17)
18noextract=(
19 "deepin-wine8-stable_${_pkgver}_amd64.deb"
20)
21sha256sums=('a272fe1259eab5dc2df4eb32212a1b580a8138bb312a18b0662f54d44592b167')
22depends=(
23 alsa-lib # libasound2 (>= 1.0.16)
24 glibc # libc6 (>= 2.38)
25 #libcapi # libcapi20-3
26 dbus # libdbus-1-3 (>= 1.9.16)
27 gcc-libs # libgcc-s1 (>= 3.0)
28 #glib2 # libglib2.0-0 (>= 2.37.3)
29 libgphoto2 # libgphoto2-6 (>= 2.5.10), libgphoto2-port12 (>= 2.5.10)
30 #gst-plugins-base # libgstreamer-plugins-base1.0-0 (>= 1.0.0)
31 #gstreamer # libgstreamer1.0-0 (>= 1.4.0)
32 libpulse # libpulse0 (>= 0.99.1)
33 sane # libsane (>= 1.0.27)
34 systemd-libs # libudev1 (>= 183)
35 #libusb # libusb-1.0-0 (>= 2:1.0.21)
36 wayland # libwayland-client0 (>= 1.20.0)
37 libx11 # libx11-6
38 libxext # libxext6
39 ocl-icd # ocl-icd-libopencl1 | libopencl1, ocl-icd-libopencl1 (>= 1.0) | libopencl-1.2-1
40 alsa-plugins # libasound2-plugins
41 ncurses # libncurses6 | libncurses5 | libncurses
42)
43
44optdepends=(
45 libcap # libcap2-bin
46 cups # libcups2
47 nss # libnss-myhostname
48 fontconfig # libfontconfig1
49 freetype2 # libfreetype6
50 mesa # libglu1-mesa | libglu1
51 gnutls # libgnutls30 | libgnutls28 | libgnutls26
52 libjpeg-turbo # libjpeg62-turbo | libjpeg8
53 krb5 # libgssapi-krb5-2, libkrb5-3
54 unixodbc # libodbc1
55 mesa # libosmesa6
56 sdl2 # libsdl2-2.0-0
57 v4l-utils # libv4l-0
58 libxcomposite # libxcomposite1
59 libxcursor # libxcursor1
60 libxfixes # libxfixes3
61 libxi # libxi6
62 libxinerama # libxinerama1
63 libxrandr # libxrandr2
64 libxrender # libxrender1
65 libxxf86vm # libxxf86vm1
66)
67
68package() {
69
70 mkdir -p "deepin-wine8-stable_${_pkgver}"
71 ar -x "deepin-wine8-stable_${_pkgver}_amd64.deb" data.tar.xz --output "deepin-wine8-stable_${_pkgver}"
72 tar -xf "deepin-wine8-stable_${_pkgver}/data.tar.xz" --directory="${pkgdir}"
73}
74

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Medium 2
2026-09-16 00:03:17 Medium 2
2026-09-15 00:25:31 Medium 2
2026-09-14 00:27:57 Medium 2
2026-09-13 00:19:54 Medium 2
2026-09-12 00:25:17 Medium 2
2026-09-11 00:19:22 Medium 2
2026-09-10 00:22:44 Medium 2
2026-09-09 00:04:09 Medium 2
2026-09-08 00:18:08 Medium 2
2026-09-07 00:30:15 Medium 2
2026-09-06 00:17:06 Medium 2
2026-09-05 00:16:27 Medium 2
2026-09-04 00:03:13 Medium 2
2026-09-03 00:15:47 Medium 2
2026-09-02 00:02:31 Medium 2
2026-09-01 00:11:19 Medium 2
2026-08-31 00:19:57 Medium 2
2026-08-30 00:04:14 Medium 2
2026-08-29 00:29:17 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion