ftnn-desktop

MEDIUM

maintainer rzhli 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

This PKGBUILD downloads a prebuilt binary .deb from softwaredownload.futunn.com, which is the official Futu (富途) software download host — a legitimate Hong Kong/US-listed brokerage's trading application. The domain is plausible as an official vendor CDN. However, sha256sums='SKIP' means there is no integrity verification of the downloaded binary, so any compromise or substitution of the file on the CDN would go undetected. The package installs a setuid chrome-sandbox (chmod 4755) and executes a prebuilt proprietary binary directly from /opt/FTNN/Launch. This is a classic medium-risk pattern: the source host appears legitimate, but the lack of checksum combined with executing a prebuilt binary means a supply-chain compromise would be undetectable. Not high (no evidence of malice, host is plausible official vendor), but genuinely medium due to SKIP checksum on an executed binary.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://softwaredownload.futunn.com/FTNN_desktop_${pkgver}_amd64.deb")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary .deb from softwaredownload.futunn.com, which is the official Futu (富途) software download host — a legitimate Hong Kong/US-listed brokerage's trading application. The domain is plausible as an official vendor CDN. However, sha256sums='SKIP' means there is no integrity verification of the downloaded binary, so any compromise or substitution of the file on the CDN would go undetected. The package installs a setuid chrome-sandbox (chmod 4755) and executes a prebuilt proprietary binary directly from /opt/FTNN/Launch. This is a classic medium-risk pattern: the source host appears legitimate, but the lack of checksum combined with executing a prebuilt binary means a supply-chain compromise would be undetectable. Not high (no evidence of malice, host is plausible official vendor), but genuinely medium due to SKIP checksum on an executed binary.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: rzhli tayuebuliuhen@gmail.com
    
      2pkgname='ftnn-desktop'
    
      3pkgver='16.16.16108'
    
      4pkgrel=1
    
      5pkgdesc="Futu，富途，股票软件"
    
      6arch=('x86_64')
    
      7url="https://www.futunn.com/"
    
      8license=('custom')
    
      9
    
      10depends=(
    
      11    'glibc'
    
      12    'qt5-base'
    
      13    'qt6-webengine'
    
      14    'qt5-webchannel'
    
      15    'qt5-multimedia'
    
      16    'hicolor-icon-theme'
    
      17    'qt5-x11extras'
    
      18    'nss'
    
      19    'libxss'
    
      20    'libxcrypt-compat'
    
      21    'xdg-utils'
    
      22)
    
      23
    
      24source=("https://softwaredownload.futunn.com/FTNN_desktop_${pkgver}_amd64.deb")
    
      25sha256sums=('SKIP')
    
      26
    
      27package() {
    
      28    # 进入 src 目录解压
    
      29    bsdtar -xf "FTNN_desktop_${pkgver}_amd64.deb"
    
      30    bsdtar -xf data.tar.* -C "${pkgdir}"
    
      31
    
      32    # 删除上游 deb 中误打包的 /out 目录
    
      33    rm -rf "${pkgdir}/out"
    
      34
    
      35    # 修复权限
    
      36    chmod +x "${pkgdir}/opt/FTNN/FTNN"
    
      37    chmod 4755 "${pkgdir}/opt/FTNN/chrome-sandbox"
    
      38
    
      39    # 建立软链接（指向 Launch 脚本以确保 LD_LIBRARY_PATH 正确设置）
    
      40    install -d "${pkgdir}/usr/bin"
    
      41    ln -sf /opt/FTNN/Launch "${pkgdir}/usr/bin/ftnn"
    
      42
    
      43    # 图标安装
    
      44    install -d "${pkgdir}/usr/share/icons/hicolor/128x128/apps"
    
      45    if [ -f "${pkgdir}/opt/FTNN/app.png" ]; then
    
      46        install -m644 "${pkgdir}/opt/FTNN/app.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/ftnn.png"
    
      47    fi
    
      48
    
      49    # 桌面文件
    
      50    install -d "${pkgdir}/usr/share/applications"
    
      51    cat <<EOF > "${pkgdir}/usr/share/applications/ftnn.desktop"
    
      52[Desktop Entry]
    
      53Name=FTNN 富途牛牛
    
      54Comment=Trade stocks
    
      55Exec=/opt/FTNN/Launch %U
    
      56Icon=ftnn
    
      57Terminal=false
    
      58Type=Application
    
      59Categories=Finance;Network;
    
      60StartupWMClass=FTNN
    
      61MimeType=x-scheme-handler/futu;
    
      62EOF
    
      63}
    
      64

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2