edairy

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt Windows executable (Win64 binary ZIP) from a personal/unofficial host (down.haoxg.net) rather than an official project release page. The binary is then installed and executed via Wine. While a sha512sum is provided, the host is not the official upstream source for any well-known project, creating a supply-chain risk if the host is compromised or the binary is tampered with. The PKGBUILD also has some structural issues (duplicate heredoc lines, a symlink to a Deepin-Wine path that may not exist), but the primary concern is the execution of an unverified third-party Windows binary. This is a genuine medium-severity supply-chain concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 url="http://down.haoxg.net/ediary/download/ediary-4.3.1-win64-copy.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Windows executable (Win64 binary ZIP) from a personal/unofficial host (down.haoxg.net) rather than an official project release page. The binary is then installed and executed via Wine. While a sha512sum is provided, the host is not the official upstream source for any well-known project, creating a supply-chain risk if the host is compromised or the binary is tampered with. The PKGBUILD also has some structural issues (duplicate heredoc lines, a symlink to a Deepin-Wine path that may not exist), but the primary concern is the execution of an unverified third-party Windows binary. This is a genuine medium-severity supply-chain concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@qq.com>
    
      2
    
      3pkgname=edairy
    
      4pkgver=4.3.1
    
      5pkgrel=1
    
      6pkgdesc="E-Dairy application running with Wine"
    
      7arch=('x86_64')
    
      8url="http://down.haoxg.net/ediary/download/ediary-4.3.1-win64-copy.zip"
    
      9license=('MIT')
    
      10depends=('wine' 'unzip')
    
      11
    
      12source=("http://down.haoxg.net/ediary/download/ediary-4.3.1-win64-copy.zip")
    
      13sha512sums=('dac9e3b035be4c0d6ccba5b420e3038ad1a3fee5858f980ff4de3d9adaadd6c6e388cf75d0fa53ec2b1c91a5291f55f9b92051e357adf29bdd5001fef74fa53a')
    
      14
    
      15prepare() {
    
      16  mkdir -p "$srcdir/extracted"
    
      17}
    
      18
    
      19build() {
    
      20
    
      21  cd "$srcdir"||exit
    
      22  unzip "$srcdir/ediary-4.3.1-win64-copy.zip" -d "$srcdir/extracted"
    
      23}
    
      24
    
      25package() {
    
      26  install -d "$pkgdir/opt/edairy"
    
      27  cp -r "$srcdir/extracted/." "$pkgdir/opt/edairy/"
    
      28  # Create desktop entry
    
      29  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/edairy.desktop" <<EOF
    
      30  # Create desktop entry
    
      31  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/edairy.desktop" <<EOF
    
      32  [Desktop Entry]
    
      33  Name=E-Dairy
    
      34  Exec=wine %f /opt/edairy/edairy.exe
    
      35  Type=Application
    
      36  StartupNotify=true
    
      37  Icon=edairy
    
      38  Categories=Office;
    
      39EOF
    
      40
    
      41  # Create symlink for wine.exe if needed
    
      42  ln -sf /opt/deepinwine/apps/Deepin-Wine/drive_c/windows/system32/wine.exe "$pkgdir/opt/edairy/wine.exe"
    
      43}
    
      44
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2