easyeda-pro-electron

LOW

maintainer Misaka13514 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads prebuilt binaries from the official EasyEDA domain, which is plausibly the project's own infrastructure; the untrusted host warning is due to the domain not being whitelisted, but the binaries are verified via sha256sums and the worst case of a swapped source is limited to supply-chain risk from a trusted vendor's host.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the official EasyEDA domain, which is plausibly the project's own infrastructure; the untrusted host warning is due to the domain not being whitelisted, but the binaries are verified via sha256sums and the worst case of a swapped source is limited to supply-chain risk from a trusted vendor's host.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -sSfL -o "LICENSE-$pkgver.html" "https://easyeda.com/page/legal"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-x64-$pkgver.zip")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Misaka13514 <Misaka13514 at gmail dot com>
    
      2# Contributor: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname=easyeda-pro-electron
    
      5_pkgname=easyeda-pro
    
      6pkgver=3.2.206
    
      7pkgrel=1
    
      8pkgdesc="EasyEDA Professional Edition. Run with system electron."
    
      9arch=("x86_64" "aarch64")
    
      10url="https://pro.easyeda.com/"
    
      11license=("LicenseRef-EasyEDA-Proprietary")
    
      12depends=("electron" "libnotify" "libappindicator-gtk3")
    
      13makedepends=("curl")
    
      14provides=("$_pkgname")
    
      15conflicts=("$_pkgname" "$_pkgname-git" "$_pkgname-bin")
    
      16install=$pkgname.install
    
      17source=("$pkgname.install"
    
      18        "$_pkgname.sh")
    
      19source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-x64-$pkgver.zip")
    
      20source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-arm64-$pkgver.zip")
    
      21sha256sums=('ab64abe7821e4ea37a0e4d1f77c94f37d6a51c7df2038ba7b609c640adf8e51d'
    
      22            '89289056ed4b5d051280e3a69dfb550b6914f470f201be1ca3b165ddd4f3e435')
    
      23sha256sums_x86_64=('33b8810bae85ba190a8a12d5e7d462f0104bd3e48543f995a2faf607e9c62251')
    
      24sha256sums_aarch64=('85a4e4dc19b40c6dc7f3d104bbea75584e0261804d6a210b7b5b113e6d6bbcbd')
    
      25
    
      26prepare() {
    
      27    curl -sSfL -o "LICENSE-$pkgver.html" "https://easyeda.com/page/legal"
    
      28}
    
      29
    
      30package() {
    
      31    install -Dm755 "$srcdir/$_pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
    
      32    install -Dm644 "$srcdir/LICENSE-$pkgver.html" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.html"
    
      33
    
      34    cd "$srcdir/$_pkgname"
    
      35    if [ -f "EasyEDA-Distribution-License.txt" ]; then
    
      36        install -Dm644 "EasyEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      37    elif [ -f "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" ]; then
    
      38        install -Dm644 "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" "$pkgdir/usr/share/licenses/$pkgname/LCEDA-EULA.pdf"
    
      39    elif [ -f "LCEDA-Distribution-License.txt" ]; then
    
      40        install -Dm644 "LCEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      41    fi
    
      42
    
      43    install -dm755 "$pkgdir/usr/lib/$_pkgname"
    
      44    cp -dpr --no-preserve=ownership resources "$pkgdir/usr/lib/$_pkgname"
    
      45    if [ -d "locales" ]; then
    
      46        cp -dpr --no-preserve=ownership locales "$pkgdir/usr/lib/$_pkgname"
    
      47    fi
    
      48
    
      49    # icon
    
      50    local _icon
    
      51    for _icon in 16 32 64 128 256 512; do
    
      52        if [ -f "icon/icon_${_icon}x${_icon}.png" ]; then
    
      53            install -Dm644 "icon/icon_${_icon}x${_icon}.png"                            "$pkgdir/usr/share/icons/hicolor/${_icon}x${_icon}/apps/$_pkgname.png"
    
      54        fi
    
      55    done
    
      56    if [ -f "icon/icon_512x512@2x.png" ]; then
    
      57        install -Dm644 "icon/icon_512x512@2x.png"                        "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/$_pkgname.png"
    
      58    fi
    
      59
    
      60    # desktop entry
    
      61    if [ -f "$_pkgname.dkt" ]; then
    
      62        install -Dm644 "$_pkgname.dkt" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      63        sed -E -i "s|^Exec=.*|Exec=$_pkgname %f|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      64        sed -E -i "s|^Icon=.*|Icon=$_pkgname|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      65    else
    
      66        install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" << "DESKTOP_EOF"
    
      67[Desktop Entry]
    
      68Categories=Development;Electronics;
    
      69Comment=EasyEDA Professional Edition. Run with system electron.
    
      70Exec=$_pkgname %f
    
      71Keywords=PCB;EDA;
    
      72GenericName=EasyEDA Pro
    
      73Icon=$_pkgname
    
      74Name=EasyEDA Pro
    
      75Type=Application
    
      76MimeType=application/eprj;application/eprj2;application/eprj3;
    
      77DESKTOP_EOF
    
      78    fi
    
      79
    
      80    # fix permissions
    
      81    find "$pkgdir/usr/lib/$_pkgname/" -type d -exec chmod 755 {} +
    
      82    find "$pkgdir/usr/lib/$_pkgname/" -type f -exec chmod 644 {} +
    
      83}
    
      84

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-17 00:21
@@ -3,7 +3,7 @@
 
 pkgname=easyeda-pro-electron
 _pkgname=easyeda-pro
-pkgver=3.2.149
+pkgver=3.2.206
 pkgrel=1
 pkgdesc="EasyEDA Professional Edition. Run with system electron."
 arch=("x86_64" "aarch64")
@@ -20,8 +20,8 @@
 source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.easyeda.com/files/easyeda-pro-linux-arm64-$pkgver.zip")
 sha256sums=('ab64abe7821e4ea37a0e4d1f77c94f37d6a51c7df2038ba7b609c640adf8e51d'
             '89289056ed4b5d051280e3a69dfb550b6914f470f201be1ca3b165ddd4f3e435')
-sha256sums_x86_64=('42ffea3a335581e381e9d0c949707a1d589fda25bcde08227759db3b543b9875')
-sha256sums_aarch64=('46b9d57cd5c2b73162889b21111cc0840e9ca34192edc0228f02dbe9ad39d97e')
+sha256sums_x86_64=('33b8810bae85ba190a8a12d5e7d462f0104bd3e48543f995a2faf607e9c62251')
+sha256sums_aarch64=('85a4e4dc19b40c6dc7f3d104bbea75584e0261804d6a210b7b5b113e6d6bbcbd')
 
 prepare() {
     curl -sSfL -o "LICENSE-$pkgver.html" "https://easyeda.com/page/legal"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3
2026-10-12 17:14:20	Medium	2
2026-06-19 19:07:35	Clean	3
2026-06-18 18:55:24	Clean	3
2026-06-18 16:11:54	Medium	2