feishu-bin

maintainer alampy · 43 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from a ByteDance-owned CDN (feishucdn.com), which is plausibly the official source; while the host is not on standard whitelists, it is specific to the vendor, and the binary is verified via sha256sum, making supply-chain risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from a ByteDance-owned CDN (feishucdn.com), which is plausibly the official source; while the host is not on standard whitelists, it is specific to the vendor, and the binary is verified via sha256sum, making supply-chain risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=("https://sf3-cn.feishucdn.com/obj/ee-appcenter/${_pkghash_x64}/Feishu-linux_x64-${pkgver}.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: Allen Zhong <pdev@zhoal.pw>
    
      3# Maintainer: Xuanwo <github@xuanwo.io>
    
      4# Maintainer: Zhou Zhiqiang <aur@strrl.dev>
    
      5# Contributor: Feishu Linux Team <contact@feishu.cn>
    
      6pkgname=feishu-bin
    
      7pkgver=7.66.10
    
      8#_pkgrel=1
    
      9_pkgtyp=stable
    
      10_pkghash_x64=289abaac
    
      11_pkghash_arm64=382a3d72
    
      12pkgrel=1
    
      13pkgdesc="Linux client of Feishu (Lark) from Bytedance."
    
      14arch=('x86_64' 'aarch64')
    
      15url="https://www.feishu.cn/"
    
      16license=('unknown')
    
      17depends=('ca-certificates' 'gtk3' 'nss' 'xdg-utils')
    
      18replaces=('bytedance-feishu-stable-bin')
    
      19conflicts=('feishu')
    
      20provides=('bytedance-feishu' 'feishu')
    
      21options=('!strip' '!emptydirs')
    
      22install=${pkgname}.install
    
      23source_x86_64=("https://sf3-cn.feishucdn.com/obj/ee-appcenter/${_pkghash_x64}/Feishu-linux_x64-${pkgver}.deb")
    
      24source_aarch64=("https://sf3-cn.feishucdn.com/obj/ee-appcenter/${_pkghash_arm64}/Feishu-linux_arm64-${pkgver}.deb")
    
      25sha256sums_x86_64=('ebc58a7d3e1d6e540e403779d67f749f20333b1ae4044491d29a9b8dbc2b3aca')
    
      26sha256sums_aarch64=('05e87475827de81bb02704cc3c5eb51fa47dbbdf49720e29cc4175ac53a3f560')
    
      27
    
      28package(){
    
      29  # Extract package data
    
      30  tar xpvf "${srcdir}/data.tar.xz" --xattrs-include='*' --numeric-owner -C "${pkgdir}"
    
      31
    
      32  # Modify files
    
      33  cd "${pkgdir}"
    
      34  cat << EOF > usr/bin/feishu
    
      35#!/bin/bash
    
      36
    
      37XDG_CONFIG_HOME=\${XDG_CONFIG_HOME:-~/.config}
    
      38
    
      39# Allow users to override command-line options
    
      40if [[ -f \$XDG_CONFIG_HOME/feishu-flags.conf ]]; then
    
      41    FEISHU_USER_FLAGS="\$(grep -v '^#' \$XDG_CONFIG_HOME/feishu-flags.conf)"
    
      42fi
    
      43
    
      44# Launch
    
      45exec /usr/bin/bytedance-feishu-${_pkgtyp} \$FEISHU_USER_FLAGS "\$@"
    
      46EOF
    
      47
    
      48  chmod +x usr/bin/feishu
    
      49
    
      50  sed -i "s/bytedance-feishu-${_pkgtyp}/feishu/g" "${pkgdir}/usr/share/applications/bytedance-feishu.desktop"
    
      51  sed -i 's/StartupNotify=true/StartupNotify=true\nStartupWMClass=feishu/g' "${pkgdir}/usr/share/applications/bytedance-feishu.desktop"
    
      52
    
      53  sed -i "s/bytedance-feishu-${_pkgtyp}/feishu/g" "${pkgdir}/usr/share/menu/bytedance-feishu.menu"
    
      54  sed -i "s/bytedance-feishu/feishu/g" "${pkgdir}/usr/share/menu/bytedance-feishu.menu"
    
      55
    
      56  sed -i 's/bytedance-feishu/feishu/g' "${pkgdir}/usr/share/appdata/bytedance-feishu.appdata.xml"
    
      57
    
      58  sed -i 's/bytedance-feishu/feishu/g' "${pkgdir}/opt/bytedance/feishu/bytedance-feishu"
    
      59
    
      60  mv "${pkgdir}"/usr/share/menu/{bytedance-,}feishu.menu
    
      61  mv "${pkgdir}"/usr/share/applications/{bytedance-,}feishu.desktop
    
      62  mv "${pkgdir}"/usr/share/appdata/{bytedance-,}feishu.appdata.xml
    
      63  mv "${pkgdir}"/usr/share/man/man1/{bytedance-feishu-${_pkgtyp},feishu}.1.gz
    
      64  mv "${pkgdir}"/usr/share/doc/{bytedance-feishu-${_pkgtyp},feishu}
    
      65
    
      66  # Fix directory permissions
    
      67  find "${pkgdir}" -type d | xargs chmod 755
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2