feidao-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage from oss.fei-dao.com (the vendor's own CDN/OSS bucket), extracts it, and installs the app.asar (JavaScript application bundle) plus native libraries. The concerns are: (1) the source URL uses a mutable 'latest' filename rather than a versioned artifact, meaning the file could be silently replaced without changing the URL or checksum — the sha256sum provides a point-in-time check but only for the version at build time; (2) the host is an unofficial OSS bucket rather than a verifiable code-hosting platform with release attestation; (3) an app.asar and native .so libraries from this source are executed at runtime. These are genuine supply-chain concerns for an executed binary from a non-standard host with a mutable URL. However, the domain matches the official project URL (fei-dao.com), a checksum is present, and the pattern (vendor CDN AppImage) is common for Chinese software distributed outside GitHub. This is a real but moderate supply-chain risk, not a clear attack, so MEDIUM is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "${pkgname%-bin}-${pkgver}.AppImage::https://oss.fei-dao.com/resources/application/linux/${pkgname%-bin}_latest.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage from oss.fei-dao.com (the vendor's own CDN/OSS bucket), extracts it, and installs the app.asar (JavaScript application bundle) plus native libraries. The concerns are: (1) the source URL uses a mutable 'latest' filename rather than a versioned artifact, meaning the file could be silently replaced without changing the URL or checksum — the sha256sum provides a point-in-time check but only for the version at build time; (2) the host is an unofficial OSS bucket rather than a verifiable code-hosting platform with release attestation; (3) an app.asar and native .so libraries from this source are executed at runtime. These are genuine supply-chain concerns for an executed binary from a non-standard host with a mutable URL. However, the domain matches the official project URL (fei-dao.com), a checksum is present, and the pattern (vendor CDN AppImage) is common for Chinese software distributed outside GitHub. This is a real but moderate supply-chain risk, not a clear attack, so MEDIUM is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=feidao-bin
    
      3pkgver=1.0.0
    
      4_electronversion=13
    
      5pkgrel=11
    
      6pkgdesc="Feidao Online Course Design Platform.(Prebuilt version.Use system-wide electron)飞稻在线课程设计平台"
    
      7arch=('x86_64')
    
      8url="https://www.fei-dao.com"
    
      9license=('LicenseRef-custom')
    
      10provides=("${pkgname%-bin}=${pkgver}")
    
      11conflicts=("${pkgname%-bin}")
    
      12depends=(
    
      13    "electron${_electronversion}"
    
      14)
    
      15makedepends=(
    
      16    'fuse2'
    
      17)
    
      18source=(
    
      19    "${pkgname%-bin}-${pkgver}.AppImage::https://oss.fei-dao.com/resources/application/linux/${pkgname%-bin}_latest.AppImage"
    
      20    "${pkgname%-bin}.sh"
    
      21)
    
      22sha256sums=('2a5f5919ebc8c7ef8ebd232758852c87dd0b165208dc46a501ce3cefdd23ded7'
    
      23            '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
    
      24prepare() {
    
      25    sed -i -e "
    
      26        s/@electronversion@/${_electronversion}/g
    
      27        s/@appname@/${pkgname%-bin}/g
    
      28        s/@runname@/app.asar/g
    
      29        s/@cfgdirname@/${pkgname%-bin}/g
    
      30        s/@options@//g
    
      31    " "${srcdir}/${pkgname%-bin}.sh"
    
      32    chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}.AppImage"
    
      33    "${srcdir}/${pkgname%-bin}-${pkgver}.AppImage" --appimage-extract > /dev/null
    
      34    sed -i -e "
    
      35        s/AppRun --no-sandbox/${pkgname%-bin}/g
    
      36        /icon=/d
    
      37    " "${srcdir}/squashfs-root/${pkgname%-bin}.desktop"
    
      38}
    
      39package() {
    
      40    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      41    install -Dm644 "${srcdir}/squashfs-root/resources/app.asar" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      42    install -Dm644 "${srcdir}/squashfs-root/swiftshader/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/swiftshader"
    
      43    install -Dm644 "${srcdir}/squashfs-root/usr/lib/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
    
      44    install -Dm644 "${srcdir}/squashfs-root/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      45    _icon_sizes=(16x16 24x24 32x32 48x48 128x128 256x256 1024x1024)
    
      46    for _icons in "${_icon_sizes[@]}";do
    
      47        install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png" \
    
      48            -t "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps"
    
      49    done
    
      50    install -Dm644 "${srcdir}/squashfs-root/LICENSE"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      51}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2