easyeda-pro-bin

LOW

maintainer Misaka13514 4 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads prebuilt binaries from the official project host (image.easyeda.com), which is plausibly owned by the vendor; despite the static analyzer flagging the host as non-standard, the downloads are verifiable via sha256sums and are not executed remotely, posing minimal supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the official project host (image.easyeda.com), which is plausibly owned by the vendor; despite the static analyzer flagging the host as non-standard, the downloads are verifiable via sha256sums and are not executed remotely, posing minimal supply-chain risk.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:25 curl -sSfL -o "LICENSE-$pkgver.html" "https://easyeda.com/page/legal"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-x64-$pkgver.zip")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Misaka13514 <Misaka13514 at gmail dot com>
    
      2# Contributor: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname=easyeda-pro-bin
    
      5_pkgname=easyeda-pro
    
      6pkgver=3.2.206
    
      7pkgrel=1
    
      8pkgdesc="EasyEDA Professional Edition"
    
      9arch=("x86_64" "aarch64")
    
      10url="https://pro.easyeda.com/"
    
      11license=("LicenseRef-EasyEDA-Proprietary")
    
      12depends=("gtk3" "nss" "alsa-lib")
    
      13makedepends=("curl")
    
      14provides=("$_pkgname")
    
      15conflicts=("$_pkgname" "$_pkgname-git" "$_pkgname-electron")
    
      16install=$pkgname.install
    
      17source=("$pkgname.install")
    
      18source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-x64-$pkgver.zip")
    
      19source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-arm64-$pkgver.zip")
    
      20sha256sums=('ab64abe7821e4ea37a0e4d1f77c94f37d6a51c7df2038ba7b609c640adf8e51d')
    
      21sha256sums_x86_64=('33b8810bae85ba190a8a12d5e7d462f0104bd3e48543f995a2faf607e9c62251')
    
      22sha256sums_aarch64=('85a4e4dc19b40c6dc7f3d104bbea75584e0261804d6a210b7b5b113e6d6bbcbd')
    
      23
    
      24prepare() {
    
      25    curl -sSfL -o "LICENSE-$pkgver.html" "https://easyeda.com/page/legal"
    
      26}
    
      27
    
      28package() {
    
      29    install -Dm644 "$srcdir/LICENSE-$pkgver.html" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.html"
    
      30
    
      31    cd "$srcdir/$_pkgname"
    
      32    if [ -f "EasyEDA-Distribution-License.txt" ]; then
    
      33        install -Dm644 "EasyEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      34    elif [ -f "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" ]; then
    
      35        install -Dm644 "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" "$pkgdir/usr/share/licenses/$pkgname/LCEDA-EULA.pdf"
    
      36    elif [ -f "LCEDA-Distribution-License.txt" ]; then
    
      37        install -Dm644 "LCEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      38    fi
    
      39
    
      40    install -dm755 "$pkgdir/opt/$_pkgname"
    
      41    cp -dpr --no-preserve=ownership * "$pkgdir/opt/$_pkgname"
    
      42    rm -rf "$pkgdir/opt/$_pkgname/icon"
    
      43    rm -rf "$pkgdir/opt/$_pkgname/$_pkgname.dkt"
    
      44    rm -f "$pkgdir/opt/$_pkgname/"*License.txt
    
      45    rm -f "$pkgdir/opt/$_pkgname/"*.pdf
    
      46
    
      47    # icon
    
      48    local _icon
    
      49    for _icon in 16 32 64 128 256 512; do
    
      50        if [ -f "icon/icon_${_icon}x${_icon}.png" ]; then
    
      51            install -Dm644 "icon/icon_${_icon}x${_icon}.png"                            "$pkgdir/usr/share/icons/hicolor/${_icon}x${_icon}/apps/$_pkgname.png"
    
      52        fi
    
      53    done
    
      54    if [ -f "icon/icon_512x512@2x.png" ]; then
    
      55        install -Dm644 "icon/icon_512x512@2x.png"                        "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/$_pkgname.png"
    
      56    fi
    
      57
    
      58    # desktop entry
    
      59    if [ -f "$_pkgname.dkt" ]; then
    
      60        install -Dm644 "$_pkgname.dkt" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      61        sed -E -i "s|^Exec=.*|Exec=$_pkgname %f|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      62        sed -E -i "s|^Icon=.*|Icon=$_pkgname|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      63    else
    
      64        install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" << "DESKTOP_EOF"
    
      65[Desktop Entry]
    
      66Categories=Development;Electronics;
    
      67Comment=EasyEDA Professional Edition
    
      68Exec=$_pkgname %f
    
      69Keywords=PCB;EDA;
    
      70GenericName=EasyEDA Pro
    
      71Icon=$_pkgname
    
      72Name=EasyEDA Pro
    
      73Type=Application
    
      74MimeType=application/eprj;application/eprj2;application/eprj3;
    
      75DESKTOP_EOF
    
      76    fi
    
      77
    
      78    # fix permissions
    
      79    find "$pkgdir/opt/$_pkgname/" -type d -exec chmod 755 {} +
    
      80    find "$pkgdir/opt/$_pkgname/" -type f -exec chmod 644 {} +
    
      81    chmod 755 "$pkgdir/opt/$_pkgname/$_pkgname"
    
      82    if [ -f "$pkgdir/opt/$_pkgname/chrome_crashpad_handler" ]; then
    
      83        chmod 755 "$pkgdir/opt/$_pkgname/chrome_crashpad_handler"
    
      84    fi
    
      85
    
      86    # soft link
    
      87    install -dm755 "$pkgdir/usr/bin"
    
      88    ln -s "/opt/$_pkgname/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      89}
    
      90

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-17 00:21
@@ -3,7 +3,7 @@
 
 pkgname=easyeda-pro-bin
 _pkgname=easyeda-pro
-pkgver=3.2.149
+pkgver=3.2.206
 pkgrel=1
 pkgdesc="EasyEDA Professional Edition"
 arch=("x86_64" "aarch64")
@@ -18,8 +18,8 @@
 source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-x64-$pkgver.zip")
 source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-arm64-$pkgver.zip")
 sha256sums=('ab64abe7821e4ea37a0e4d1f77c94f37d6a51c7df2038ba7b609c640adf8e51d')
-sha256sums_x86_64=('42ffea3a335581e381e9d0c949707a1d589fda25bcde08227759db3b543b9875')
-sha256sums_aarch64=('46b9d57cd5c2b73162889b21111cc0840e9ca34192edc0228f02dbe9ad39d97e')
+sha256sums_x86_64=('33b8810bae85ba190a8a12d5e7d462f0104bd3e48543f995a2faf607e9c62251')
+sha256sums_aarch64=('85a4e4dc19b40c6dc7f3d104bbea75584e0261804d6a210b7b5b113e6d6bbcbd')
 
 prepare() {
     curl -sSfL -o "LICENSE-$pkgver.html" "https://easyeda.com/page/legal"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3
2026-10-12 17:14:20	Medium	2
2026-06-19 19:07:35	Clean	3
2026-06-18 18:55:24	Clean	3
2026-06-18 16:11:54	Medium	2