easyconnect

LOW

maintainer zxp19821005 9 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from the official vendor's domain (sangfor.com.cn), which is plausibly the project's own source; the binary is part of building a wrapper package, not executing remote code, and the host, while not standard, is the vendor's official site.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a prebuilt .deb from the official vendor's domain (sangfor.com.cn), which is plausibly the project's own source; the binary is part of building a wrapper package, not executing remote code, and the host, while not standard, is the vendor's official site.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 "${pkgname}-${pkgver}.deb::https://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_767/${_pkgname}_x64_${pkgver//./_}.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: arthur_0 <maxc@stateoftheart.pw>
    
      3# Contributor: attenuation <ouyangjun1999@gmail.com>
    
      4pkgname=easyconnect
    
      5_pkgname=EasyConnect
    
      6pkgver=7.6.7.3
    
      7_electronversion=1
    
      8pkgrel=13
    
      9_pangover=1.42.4
    
      10pkgdesc="Support access to ssl vpn. With easyconect,you can secure and speed up connection to cooperate network at ease!"
    
      11arch=('x86_64')
    
      12url="http://www.sangfor.com.cn"
    
      13license=('LicenseRef-custom')
    
      14conflicts=(
    
      15    "${pkgname}"
    
      16    "${pkgname}-rpc"
    
      17    "${pkgname}-zjjy"
    
      18    "${pkgname}-sdu"
    
      19    "${pkgname}-cas"
    
      20)
    
      21depends=(
    
      22    'gtk2'
    
      23    'alsa-lib'
    
      24    'nss'
    
      25    'sqlite'
    
      26    'nspr'
    
      27    'dbus-glib'
    
      28    'psmisc'
    
      29)
    
      30makedepends=(
    
      31    'gobject-introspection'
    
      32    'glib2-devel'
    
      33)
    
      34install="${pkgname}.install"
    
      35options=(
    
      36    '!strip'
    
      37    '!emptydirs'
    
      38)
    
      39source=(
    
      40    "${pkgname}-${pkgver}.deb::https://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_767/${_pkgname}_x64_${pkgver//./_}.deb"
    
      41    "pango-${_pangover}.tar.xz::https://download.gnome.org/sources/pango/${_pangover%.4}/pango-${_pangover}.tar.xz"
    
      42    "LICENSE"
    
      43    "${pkgname}.sh"
    
      44)
    
      45sha256sums=('ae623c6dc0354ff87afefbb770de5013bfd943051c9a653b93db708253b2f0d3'
    
      46            '1d2b74cd63e8bd41961f2f8d952355aa0f9be6002b52c8aa7699d9f5da597c9d'
    
      47            'b4b0db5e577c1b565a7f065ce8f9a4f9622b673fbcffa27ccbaf68f061a67a68'
    
      48            'a199da9f4f1579865094a2fbc768631e04fabcf84415882859eeba47ae1708d2')
    
      49build() {
    
      50    sed -i -e "
    
      51        s/@appname@/sangfor/g
    
      52        s/@runpath@/${_pkgname}/g
    
      53        s/@runname@/${_pkgname}/g
    
      54    " "${srcdir}/${pkgname}.sh"
    
      55    bsdtar -xf "${srcdir}/data."*
    
      56    cd "${srcdir}/pango-${_pangover}"
    
      57    ./configure --prefix=/usr
    
      58    make -j4 && make DESTDIR="${srcdir}/pango" install
    
      59    sed -i -e "
    
      60        s/\/usr\/share\/sangfor\/${_pkgname}\/${_pkgname}/${pkgname}/g
    
      61        s/Icon=${_pkgname}/Icon=${pkgname}/g
    
      62    " "${srcdir}/usr/share/applications/${_pkgname}.desktop"
    
      63    chmod 755 "${srcdir}/usr/share/sangfor/${_pkgname}/${_pkgname}"
    
      64}
    
      65package() {
    
      66    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      67    install -Dm644 "${srcdir}/etc/init/EasyMonitor.conf" -t "${pkgdir}/etc/init"
    
      68    install -Dm644 "${srcdir}/usr/lib/systemd/system/EasyMonitor.service" -t "${pkgdir}/usr/lib/systemd/system"
    
      69    install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      70    install -Dm644 "${srcdir}/usr/share/pixmaps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      71    cp -Pr --no-preserve=ownership "${srcdir}/usr/share/sangfor" "${pkgdir}/usr/share"
    
      72    cp -Pr --no-preserve=ownership "${srcdir}/pango/usr/lib" "${pkgdir}/usr/share/sangfor/${_pkgname}"
    
      73    install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      74}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2