hoffice

maintainer 00ein00 · 15 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two supply-chain concerns exist here. First, the main .deb is pulled from Dropbox (a personal/unofficial host rather than Hancom's own servers), though it does have a sha256sum so integrity is verified at download time. Second, and more critically, inside the package() function a curl command fetches 'libkime-qt-5.11.3.so' directly from GitHub releases at runtime (latest/download, not a pinned tag or commit) with no checksum verification whatsoever — this binary shared library is then installed into the Qt platform input context plugin directory where it will be loaded by the office application. Fetching an unversioned 'latest' binary at build time with no integrity check is a genuine supply-chain risk: if the kime project's releases are compromised or the URL redirected, an arbitrary .so gets installed and executed. The Dropbox .deb is a lesser concern given the checksum, but still non-standard. The combination of an unverified runtime-fetched executable library makes this a real medium-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 'https://dl.dropbox.com/scl/fi/ia3ub05nti01h8lzb3vwr/1732118678_hoffice_11.20.0.1520_amd64.deb?rlkey=8bnxl9chpm7rt6sr6nc4eoqp0&st=yaxlb481&dl=0'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): Two supply-chain concerns exist here. First, the main .deb is pulled from Dropbox (a personal/unofficial host rather than Hancom's own servers), though it does have a sha256sum so integrity is verified at download time. Second, and more critically, inside the package() function a curl command fetches 'libkime-qt-5.11.3.so' directly from GitHub releases at runtime (latest/download, not a pinned tag or commit) with no checksum verification whatsoever — this binary shared library is then installed into the Qt platform input context plugin directory where it will be loaded by the office application. Fetching an unversioned 'latest' binary at build time with no integrity check is a genuine supply-chain risk: if the kime project's releases are compromised or the URL redirected, an arbitrary .so gets installed and executed. The Dropbox .deb is a lesser concern given the checksum, but still non-standard. The combination of an unverified runtime-fetched executable library makes this a real medium-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer : 00ein00 <Ein420@proton.me>
    
      2
    
      3HNCDIR=opt/hnc
    
      4HNCCONTEXT=opt/hnc/hoffice11/Bin/qt/plugins/platforminputcontexts
    
      5NIMFLIB=libqt5im-nimf.so
    
      6KIMELIB=libkime-qt-5.11.3.so
    
      7
    
      8DLAGENTS=("https::/usr/bin/wget -N --timestamping %u")
    
      9
    
      10pkgname='hoffice'
    
      11pkgver=11.20.0.1520
    
      12pkgrel=4
    
      13pkgdesc='Office document editor for Linux. Hancom Office Editor is an application to allow you to edit office documents that is developed and distributed by Hancom Inc. 
    
      14         / 본 어플리케이션은 리눅스용 문서 편집 프로그램으로, 한컴에 의해 개발되고 배포된 형식의 문서들을 편집할 수 있도록 해주는 프로그램입니다.'
    
      15arch=('x86_64')
    
      16source=(
    
      17  'https://dl.dropbox.com/scl/fi/ia3ub05nti01h8lzb3vwr/1732118678_hoffice_11.20.0.1520_amd64.deb?rlkey=8bnxl9chpm7rt6sr6nc4eoqp0&st=yaxlb481&dl=0'
    
      18  'LICENSE'
    
      19  'libqt5im-nimf.so'
    
      20)
    
      21
    
      22url='https://www.hancom.com'
    
      23
    
      24license=('custom:hoffice')
    
      25makedepends=('wget')
    
      26depends=('cairo' 'fontconfig' 'freetype2' 'gcc-libs' 'glibc' 'glu' 'harfbuzz' 'harfbuzz-icu' 'libcups' 'libcurl-gnutls' 'libxcb' 'openssl-1.1' 'qt5-base' 'qt5-x11extras' 'zlib')
    
      27provides=('hoffice=${pkgver}')
    
      28conflicts=('hoffice-hwp')
    
      29install=hoffice.install
    
      30
    
      31sha256sums=('1ecb2f82e915b49706d1f5f6d206f8bd4a9384fda2bd56798c94046865fe5730'
    
      32  '09b74399a45cde2b28e672784dbd1eb6397454a025e05a51fb3367eadb834583'
    
      33  'd246c02a20a1e4ea123f9c2275dfc4a2ea091a65032ddbbe8a59bfc71418f60c')
    
      34
    
      35pre_remove() {
    
      36  echo "Removing installed files..."
    
      37  if [[ -f "/${HNCCONTEXT}/${NIMFLIB}" ]]; then
    
      38    rm -vf "/${HNCCONTEXT}/${NIMFLIB}"
    
      39    rm -rf "/${HNCDIR}"
    
      40  fi
    
      41}
    
      42
    
      43post_remove() {
    
      44  xdg-icon-resource forceupdate --theme hicolor &>/dev/null
    
      45  update-desktop-database -q
    
      46}
    
      47
    
      48package() {
    
      49
    
      50  curl -# -o "${srcdir}/${KIMELIB}" -fL 'https://github.com/Riey/kime/releases/latest/download/libkime-qt-5.11.3.so'
    
      51
    
      52  bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}/"
    
      53
    
      54  install -Dm644 -t "${pkgdir}/usr/share/licenses/hoffice" "${srcdir}/LICENSE"
    
      55
    
      56  if [ -f "${srcdir}/${KIMELIB}" ] && [ -f "${srcdir}/${NIMFLIB}" ]; then
    
      57    install -Dm755 -t "${pkgdir}/${HNCCONTEXT}" "${srcdir}/${KIMELIB}"
    
      58    install -Dm755 -t "${pkgdir}/${HNCCONTEXT}" "${srcdir}/${NIMFLIB}"
    
      59  fi
    
      60
    
      61  mkdir -p "$pkgdir"/usr/bin/
    
      62  echo "Creating symbolic link: /opt/hnc/hoffice11/Bin/hwp -> /usr/bin/hwp"
    
      63  echo '"/opt/hnc/hoffice11/Bin/hwp" $@' >"$pkgdir"/usr/bin/hwp
    
      64  chmod +x "$pkgdir"/usr/bin/hwp
    
      65  echo "Creating symbolic link: /opt/hnc/hoffice11/Bin/hsl -> /usr/bin/hsl"
    
      66  echo '"/opt/hnc/hoffice11/Bin/hsl" $@' >"$pkgdir"/usr/bin/hsl
    
      67  chmod +x "$pkgdir"/usr/bin/hsl
    
      68  echo "Creating symbolic link: /opt/hnc/hoffice11/Bin/hword -> /usr/bin/hword"
    
      69  echo '"/opt/hnc/hoffice11/Bin/hword" $@' >"$pkgdir"/usr/bin/hword
    
      70  chmod +x "$pkgdir"/usr/bin/hword
    
      71  echo "Creating symbolic link: /opt/hnc/hoffice11/Bin/hcl -> /usr/bin/hcl"
    
      72  echo '"/opt/hnc/hoffice11/Bin/hcl" $@' >"$pkgdir"/usr/bin/hcl
    
      73  chmod +x "$pkgdir"/usr/bin/hcl
    
      74
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2