fcitx-qt4

maintainer Asin · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (.pkg.tar.xz) from the TUNA Tsinghua archive mirror (arch-archive.tuna.tsinghua.edu.cn) and installs it directly. Several concerns: (1) It uses a prebuilt binary rather than building from source, meaning arbitrary compiled code is executed on the user's system. (2) The source is an archive mirror, not the official Arch Linux package servers or the upstream project — while TUNA is a well-known Chinese university mirror, it is not an official Arch Linux distribution channel and the archived package could differ from what was originally distributed. (3) The checksum is MD5, which is cryptographically weak and insufficient for verifying binary integrity against a determined attacker. (4) The package is from 2019 (archived snapshot), so it is outdated and may contain unpatched vulnerabilities. (5) The noextract + direct binary installation pattern bypasses normal AUR build processes. The combination of an executed prebuilt binary from a non-official host with only MD5 verification constitutes a genuine supply-chain risk, consistent with a MEDIUM rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://arch-archive.tuna.tsinghua.edu.cn/2019/04-29/community/os/x86_64/fcitx-qt4-4.2.9.6-1-x86_64.pkg.tar.xz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (.pkg.tar.xz) from the TUNA Tsinghua archive mirror (arch-archive.tuna.tsinghua.edu.cn) and installs it directly. Several concerns: (1) It uses a prebuilt binary rather than building from source, meaning arbitrary compiled code is executed on the user's system. (2) The source is an archive mirror, not the official Arch Linux package servers or the upstream project — while TUNA is a well-known Chinese university mirror, it is not an official Arch Linux distribution channel and the archived package could differ from what was originally distributed. (3) The checksum is MD5, which is cryptographically weak and insufficient for verifying binary integrity against a determined attacker. (4) The package is from 2019 (archived snapshot), so it is outdated and may contain unpatched vulnerabilities. (5) The noextract + direct binary installation pattern bypasses normal AUR build processes. The combination of an executed prebuilt binary from a non-official host with only MD5 verification constitutes a genuine supply-chain risk, consistent with a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Shane <shanelyx@outlook.com>
    
      2pkgname=fcitx-qt4
    
      3pkgver=4.2.9.6
    
      4pkgrel=1
    
      5pkgdesc="This is a fcitx-qt4 package for software that depends on fcitx-qt4."
    
      6arch=("x86_64")
    
      7url="https://fcitx-im.org"
    
      8license=('custom')
    
      9
    
      10source=("https://arch-archive.tuna.tsinghua.edu.cn/2019/04-29/community/os/x86_64/fcitx-qt4-4.2.9.6-1-x86_64.pkg.tar.xz")
    
      11noextract=("fcitx-qt4-4.2.9.6-1-x86_64.pkg.tar.xz")
    
      12md5sums=("8bf7f5d600a73201c23d19a1eaeea66e")
    
      13
    
      14
    
      15

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2