flomo-bin

MEDIUM

maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt Windows executable (.exe) from a personal GitHub repository not affiliated with the official project, which is an unverifiable binary from a swappable host, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "LICENSE.html::https://help.flomoapp.com/legal/"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Windows executable (.exe) from a personal GitHub repository not affiliated with the official project, which is an unverifiable binary from a swappable host, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=flomo-bin
    
      3_pkgname=Flomo
    
      4_zhsname='浮墨笔记'
    
      5pkgver=5.26.82
    
      6_electronversion=36
    
      7pkgrel=1
    
      8pkgdesc="A new generation of cloud knowledge base for personal note-taking and knowledge creation, team collaboration and knowledge accumulation.(Prebuilt version.Use system-wide electron)新一代云端知识库，用于个人笔记与知识创作，团队协同与知识沉淀"
    
      9arch=('x86_64')
    
      10url="https://flomoapp.com/"
    
      11_dlurl="https://github.com/zxp19821005/My_AUR_Files"
    
      12license=('LicenseRef-custom')
    
      13conflicts=("${pkgname%-bin}")
    
      14prodives=("${pkgname%-bin}=${pkgver}")
    
      15depends=(
    
      16    "electron${_electronversion}"
    
      17)
    
      18makedepends=(
    
      19    'gendesk'
    
      20    'asar'
    
      21    'icoutils'
    
      22    '7zip'
    
      23)
    
      24source=(
    
      25    "${pkgname%-bin}-${pkgver}.exe::${_dlurl}/releases/download/${pkgname%-bin}/${pkgname%-bin}-${pkgver}-x64.exe"
    
      26    "LICENSE.html::https://help.flomoapp.com/legal/"
    
      27    "${pkgname%-bin}.sh"
    
      28)
    
      29sha256sums=('ec5f2edf73bbdda93d3b957171609589b5f434f5a41cda3d8fecabf86fcaa259'
    
      30            'f65b8b79b175cf9321fdecc7f0d3ea4d50d879a1d5a4a46dca1ac1a7fbce67b2'
    
      31            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      32_get_app_dir() {
    
      33    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      34}
    
      35_check_electron_version() {
    
      36    _electronversion="$(strings "$(_get_app_dir)/${pkgname%-bin}.exe" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1)"
    
      37    echo -e "The electron version is: \033[1;31m${_electronversion}\033[0m"
    
      38}
    
      39prepare() {
    
      40    sed -i -e "
    
      41        s/@electronversion@/${_electronversion}/g
    
      42        s/@appname@/${pkgname%-bin}/g
    
      43        s/@runname@/app.asar/g
    
      44        s/@cfgdirname@/${pkgname%-bin}卡片笔记/g
    
      45    " "${srcdir}/${pkgname%-bin}.sh"
    
      46    gendesk -q -f -n \
    
      47        --pkgname="${pkgname%-bin}" \
    
      48        --pkgdesc="${pkgdesc}" \
    
      49        --categories="Office" \
    
      50        --name="${pkgname%-bin}" \
    
      51        --exec="${pkgname%-bin} %U" \
    
      52        --custom="Name[zh_CN]=${_zhsname}"
    
      53    7z x -aoa "${srcdir}/${pkgname%-bin}-${pkgver}.exe"
    
      54    install -Dm755 -d "${srcdir}/tmp"
    
      55    7z x -aoa "${srcdir}/\$PLUGINSDIR/app-64.7z" -o"${srcdir}/tmp"
    
      56    _check_electron_version
    
      57    asar e "${srcdir}/tmp/resources/app.asar" "${srcdir}/app.asar.unpacked"
    
      58    rm -rf "${srcdir}/tmp/resources/app.asar"
    
      59    find "${srcdir}/app.asar.unpacked" -type f -name "*.gz" -exec rm -rf {} +
    
      60    sed -i -e "
    
      61        s/icon.ico/icon.png/g
    
      62        s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g
    
      63    " "${srcdir}/app.asar.unpacked/background.js"
    
      64    sed -i 's/"icons\/"+e/"icons\/icon.png"/g' "${srcdir}/app.asar.unpacked/background.js"
    
      65    cp "${srcdir}/app.asar.unpacked/icons/32x32.png" "${srcdir}/app.asar.unpacked/icons/darkTemplate.png"
    
      66    cp "${srcdir}/app.asar.unpacked/icons/32x32.png" "${srcdir}/app.asar.unpacked/icons/icon.png"
    
      67    asar p "${srcdir}/app.asar.unpacked" "${srcdir}/tmp/resources/app.asar"
    
      68}
    
      69package() {
    
      70    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      71    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      72	local _app_dir=$(_get_app_dir)
    
      73	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      74    rm -rf "${pkgdir}/usr/lib/${pkgname%-bin}/elevate.exe"
    
      75    icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
    
      76    for _icons in "${icon_sizes[@]}";do
    
      77        install -Dm644 "${srcdir}/app.asar.unpacked/icons/${_icons}.png" \
    
      78            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png"
    
      79    done
    
      80    install -Dm644 "${srcdir}/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      81    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      82}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2