edairy

MEDIUM

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

This PKGBUILD downloads a prebuilt Windows executable (Win64 binary ZIP) from a personal/unofficial host (down.haoxg.net) rather than an official project release page. The binary is then installed and executed via Wine. While a sha512sum is provided, the host is not the official upstream source for any well-known project, creating a supply-chain risk if the host is compromised or the binary is tampered with. The PKGBUILD also has some structural issues (duplicate heredoc lines, a symlink to a Deepin-Wine path that may not exist), but the primary concern is the execution of an unverified third-party Windows binary. This is a genuine medium-severity supply-chain concern, not a false positive.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 url="http://down.haoxg.net/ediary/download/ediary-4.3.1-win64-copy.zip"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Windows executable (Win64 binary ZIP) from a personal/unofficial host (down.haoxg.net) rather than an official project release page. The binary is then installed and executed via Wine. While a sha512sum is provided, the host is not the official upstream source for any well-known project, creating a supply-chain risk if the host is compromised or the binary is tampered with. The PKGBUILD also has some structural issues (duplicate heredoc lines, a symlink to a Deepin-Wine path that may not exist), but the primary concern is the execution of an unverified third-party Windows binary. This is a genuine medium-severity supply-chain concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@qq.com>
    
      2
    
      3pkgname=edairy
    
      4pkgver=4.3.1
    
      5pkgrel=1
    
      6pkgdesc="E-Dairy application running with Wine"
    
      7arch=('x86_64')
    
      8url="http://down.haoxg.net/ediary/download/ediary-4.3.1-win64-copy.zip"
    
      9license=('MIT')
    
      10depends=('wine' 'unzip')
    
      11
    
      12source=("http://down.haoxg.net/ediary/download/ediary-4.3.1-win64-copy.zip")
    
      13sha512sums=('dac9e3b035be4c0d6ccba5b420e3038ad1a3fee5858f980ff4de3d9adaadd6c6e388cf75d0fa53ec2b1c91a5291f55f9b92051e357adf29bdd5001fef74fa53a')
    
      14
    
      15prepare() {
    
      16  mkdir -p "$srcdir/extracted"
    
      17}
    
      18
    
      19build() {
    
      20
    
      21  cd "$srcdir"||exit
    
      22  unzip "$srcdir/ediary-4.3.1-win64-copy.zip" -d "$srcdir/extracted"
    
      23}
    
      24
    
      25package() {
    
      26  install -d "$pkgdir/opt/edairy"
    
      27  cp -r "$srcdir/extracted/." "$pkgdir/opt/edairy/"
    
      28  # Create desktop entry
    
      29  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/edairy.desktop" <<EOF
    
      30  # Create desktop entry
    
      31  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/edairy.desktop" <<EOF
    
      32  [Desktop Entry]
    
      33  Name=E-Dairy
    
      34  Exec=wine %f /opt/edairy/edairy.exe
    
      35  Type=Application
    
      36  StartupNotify=true
    
      37  Icon=edairy
    
      38  Categories=Office;
    
      39EOF
    
      40
    
      41  # Create symlink for wine.exe if needed
    
      42  ln -sf /opt/deepinwine/apps/Deepin-Wine/drive_c/windows/system32/wine.exe "$pkgdir/opt/edairy/wine.exe"
    
      43}
    
      44
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2