dida365-bin
LOW
maintainer zxp19821005
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt RPMs from the project's official CDN (cdn.dida365.cn), which is plausibly controlled by the software vendor; while the host is not on a standard whitelist, the binaries are verified via sha256sums and used in a standard AUR packaging manner without obfuscation or remote code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt RPMs from the project's official CDN (cdn.dida365.cn), which is plausibly controlled by the software vendor; while the host is not on a standard whitelist, the binaries are verified via sha256sums and used in a standard AUR packaging manner without obfuscation or remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://cdn.dida365.cn/download/linux/linux_rpm_arm64/${_pkgname}-${pkgver}-aarch64.rpm")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
_pkgname=dida
3
pkgname="${_pkgname}365-bin"
4
pkgver=8.0.10
5
_electronversion=21
6
pkgrel=1
7
pkgdesc='Todo list, checklist and task manager app, Linux desktop application.(Prebuilt version.Use system-wide electron)'
8
arch=(
9
'aarch64'
10
'x86_64'
11
)
12
url='https://www.dida365.com'
13
license=('LicenseRef-custom')
14
provides=("${pkgname%-bin}=${pkgver}")
15
conflicts=(
16
"${_pkgname}"
17
"${pkgname%-bin}"
18
)
19
depends=(
20
"electron${_electronversion}"
21
)
22
source=(
23
"LICENSE-opensource.html::${url}/license/web"
24
"LICENSE-custom.html::${url}/about/tos"
25
"${pkgname%-bin}.sh"
26
)
27
source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://cdn.dida365.cn/download/linux/linux_rpm_arm64/${_pkgname}-${pkgver}-aarch64.rpm")
28
source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::https://cdn.dida365.cn/download/linux/linux_rpm_x64/${_pkgname}-${pkgver}-x86_64.rpm")
29
sha256sums=('48336e82f51c7d161813d66e3a17d526e1752d955565f6d0b4b39bb54ff6843e'
30
'26a594d04e629aabe1283578016591008019e9c932b696ad49f2db007c514c5a'
31
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
32
sha256sums_aarch64=('4bbbdbd66f0cd21d9fefdb96e67b3ed600c23770840d733de81970b08bf94f49')
33
sha256sums_x86_64=('170648d04df55805b43cff89f429fd53becb6dd1468bc63bbfa5549199c6bbf0')
34
_check_electron_version() {
35
echo "Verifying Electron version..."
36
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
37
local _main_exe=""
38
if [[ -n "${_app_dir}" ]]; then
39
_main_exe=$(find "${_app_dir}" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -n 1 | cut -d' ' -f2-)
40
fi
41
if [[ -n "${_main_exe}" ]]; then
42
local _elec_ver=$(strings "${_main_exe}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1 | head -n 1)
43
if [[ -n "${_elec_ver}" ]]; then
44
if [[ "${_elec_ver}" != "${_electronversion}" ]]; then
45
echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m"
46
else
47
echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
48
fi
49
fi
50
else
51
echo -e "\033[1;33mNote: Could not find Electron binary for version verification.\033[0m"
52
fi
53
}
54
prepare() {
55
sed -i -e "
56
s/@electronversion@/${_electronversion}/g
57
s/@appname@/${pkgname%-bin}/g
58
s/@runname@/app.asar/g
59
s/@cfgdirname@/${_pkgname}/g
60
" "${srcdir}/${pkgname%-bin}.sh"
61
_check_electron_version
62
sed -i -e "
63
s/\/opt\/${_pkgname}\/${_pkgname}/${pkgname%-bin}/g
64
s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
65
" "${srcdir}/usr/share/applications/${_pkgname}.desktop"
66
}
67
package() {
68
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
69
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
70
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
71
cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
72
install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
73
find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
74
_extension="${_i##*.}"
75
_icon_path="${_i#*share/icons/}"
76
_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
77
install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
78
done
79
install -Dm644 "${srcdir}/LICENSE-"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
80
}
81
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |