easyconnect

maintainer zxp19821005 · 9 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from the official vendor's domain (sangfor.com.cn), which is plausibly the project's own source; the binary is part of building a wrapper package, not executing remote code, and the host, while not standard, is the vendor's official site.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a prebuilt .deb from the official vendor's domain (sangfor.com.cn), which is plausibly the project's own source; the binary is part of building a wrapper package, not executing remote code, and the host, while not standard, is the vendor's official site.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 "${pkgname}-${pkgver}.deb::https://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_767/${_pkgname}_x64_${pkgver//./_}.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: arthur_0 <maxc@stateoftheart.pw>
    
      3# Contributor: attenuation <ouyangjun1999@gmail.com>
    
      4pkgname=easyconnect
    
      5_pkgname=EasyConnect
    
      6pkgver=7.6.7.3
    
      7_electronversion=1
    
      8pkgrel=13
    
      9_pangover=1.42.4
    
      10pkgdesc="Support access to ssl vpn. With easyconect,you can secure and speed up connection to cooperate network at ease!"
    
      11arch=('x86_64')
    
      12url="http://www.sangfor.com.cn"
    
      13license=('LicenseRef-custom')
    
      14conflicts=(
    
      15    "${pkgname}"
    
      16    "${pkgname}-rpc"
    
      17    "${pkgname}-zjjy"
    
      18    "${pkgname}-sdu"
    
      19    "${pkgname}-cas"
    
      20)
    
      21depends=(
    
      22    'gtk2'
    
      23    'alsa-lib'
    
      24    'nss'
    
      25    'sqlite'
    
      26    'nspr'
    
      27    'dbus-glib'
    
      28    'psmisc'
    
      29)
    
      30makedepends=(
    
      31    'gobject-introspection'
    
      32    'glib2-devel'
    
      33)
    
      34install="${pkgname}.install"
    
      35options=(
    
      36    '!strip'
    
      37    '!emptydirs'
    
      38)
    
      39source=(
    
      40    "${pkgname}-${pkgver}.deb::https://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_767/${_pkgname}_x64_${pkgver//./_}.deb"
    
      41    "pango-${_pangover}.tar.xz::https://download.gnome.org/sources/pango/${_pangover%.4}/pango-${_pangover}.tar.xz"
    
      42    "LICENSE"
    
      43    "${pkgname}.sh"
    
      44)
    
      45sha256sums=('ae623c6dc0354ff87afefbb770de5013bfd943051c9a653b93db708253b2f0d3'
    
      46            '1d2b74cd63e8bd41961f2f8d952355aa0f9be6002b52c8aa7699d9f5da597c9d'
    
      47            'b4b0db5e577c1b565a7f065ce8f9a4f9622b673fbcffa27ccbaf68f061a67a68'
    
      48            'a199da9f4f1579865094a2fbc768631e04fabcf84415882859eeba47ae1708d2')
    
      49build() {
    
      50    sed -i -e "
    
      51        s/@appname@/sangfor/g
    
      52        s/@runpath@/${_pkgname}/g
    
      53        s/@runname@/${_pkgname}/g
    
      54    " "${srcdir}/${pkgname}.sh"
    
      55    bsdtar -xf "${srcdir}/data."*
    
      56    cd "${srcdir}/pango-${_pangover}"
    
      57    ./configure --prefix=/usr
    
      58    make -j4 && make DESTDIR="${srcdir}/pango" install
    
      59    sed -i -e "
    
      60        s/\/usr\/share\/sangfor\/${_pkgname}\/${_pkgname}/${pkgname}/g
    
      61        s/Icon=${_pkgname}/Icon=${pkgname}/g
    
      62    " "${srcdir}/usr/share/applications/${_pkgname}.desktop"
    
      63    chmod 755 "${srcdir}/usr/share/sangfor/${_pkgname}/${_pkgname}"
    
      64}
    
      65package() {
    
      66    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      67    install -Dm644 "${srcdir}/etc/init/EasyMonitor.conf" -t "${pkgdir}/etc/init"
    
      68    install -Dm644 "${srcdir}/usr/lib/systemd/system/EasyMonitor.service" -t "${pkgdir}/usr/lib/systemd/system"
    
      69    install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      70    install -Dm644 "${srcdir}/usr/share/pixmaps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      71    cp -Pr --no-preserve=ownership "${srcdir}/usr/share/sangfor" "${pkgdir}/usr/share"
    
      72    cp -Pr --no-preserve=ownership "${srcdir}/pango/usr/lib" "${pkgdir}/usr/share/sangfor/${_pkgname}"
    
      73    install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      74}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2