hoffice-hwp

maintainer 00ein00 · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two distinct supply-chain concerns exist here: (1) The main payload is a prebuilt x86_64 binary .deb pulled from a personal Dropbox share link (dl.dropbox.com with an opaque rlkey/st token), not from Hancom's official release infrastructure. While a sha256sum is provided, Dropbox allows the file owner to silently replace the content at the same URL without changing the link, so the checksum only protects the current build — future users who rebuild could get a different binary if the file is swapped. (2) Inside package(), a second binary (libkime-qt-5.11.3.so) is fetched at build time via curl from github.com/Riey/kime/releases/latest/download — the 'latest' redirect means the actual file downloaded is not pinned to any specific version or hash, so it is entirely unverified and could change at any time. This unverified curl-fetched shared library is then installed into the Qt platform input context plugin directory and loaded by the application. The combination of an unofficial binary host for the main package and an unpinned, unverified shared library fetched at build time constitutes a genuine medium-severity supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 'https://dl.dropbox.com/scl/fi/288hastrkhbhtnv9qblhd/1732214553_hoffice-hwp_11.20.0.989_amd64.deb?rlkey=ytc0p85vam1q01wa17xaasw0x&st=669rlhj0&dl=0'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): Two distinct supply-chain concerns exist here: (1) The main payload is a prebuilt x86_64 binary .deb pulled from a personal Dropbox share link (dl.dropbox.com with an opaque rlkey/st token), not from Hancom's official release infrastructure. While a sha256sum is provided, Dropbox allows the file owner to silently replace the content at the same URL without changing the link, so the checksum only protects the current build — future users who rebuild could get a different binary if the file is swapped. (2) Inside package(), a second binary (libkime-qt-5.11.3.so) is fetched at build time via curl from github.com/Riey/kime/releases/latest/download — the 'latest' redirect means the actual file downloaded is not pinned to any specific version or hash, so it is entirely unverified and could change at any time. This unverified curl-fetched shared library is then installed into the Qt platform input context plugin directory and loaded by the application. The combination of an unofficial binary host for the main package and an unpinned, unverified shared library fetched at build time constitutes a genuine medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer : 00ein00 <Ein420@proton.me>
    
      2
    
      3HNCDIR=opt/hnc
    
      4HNCCONTEXT=opt/hnc/hoffice11/Bin/qt/plugins/platforminputcontexts
    
      5NIMFLIB=libqt5im-nimf.so
    
      6KIMELIB=libkime-qt-5.11.3.so
    
      7
    
      8DLAGENTS=("https::/usr/bin/wget -N --timestamping %u")
    
      9
    
      10pkgname='hoffice-hwp'
    
      11pkgver=11.20.0.1520
    
      12pkgrel=4
    
      13pkgdesc='.HWP/HWPX Office document editor for Linux, excluding the Hancom Office suite and only installs hoffice-hwp editor.'
    
      14arch=('x86_64')
    
      15source=(
    
      16  'https://dl.dropbox.com/scl/fi/288hastrkhbhtnv9qblhd/1732214553_hoffice-hwp_11.20.0.989_amd64.deb?rlkey=ytc0p85vam1q01wa17xaasw0x&st=669rlhj0&dl=0'
    
      17  'LICENSE'
    
      18  'libqt5im-nimf.so'
    
      19)
    
      20
    
      21url='https://www.hancom.com'
    
      22
    
      23license=('custom:hoffice')
    
      24makedepends=('wget')
    
      25depends=('cairo' 'fontconfig' 'freetype2' 'gcc-libs' 'glibc' 'glu' 'harfbuzz' 'harfbuzz-icu' 'libcups' 'libcurl-gnutls' 'libxcb' 'openssl-1.1' 'qt5-base' 'qt5-x11extras' 'zlib')
    
      26provides=('hoffice-hwp=${pkgver}')
    
      27conflicts=('hoffice-2022-beta' 'hoffice')
    
      28install=hoffice-hwp.install
    
      29sha256sums=('04299dfe60458d42c0f77b3aeece0eeda3cfcedbcd077d55a3b795662bc6b3ae'
    
      30  '09b74399a45cde2b28e672784dbd1eb6397454a025e05a51fb3367eadb834583'
    
      31  'd246c02a20a1e4ea123f9c2275dfc4a2ea091a65032ddbbe8a59bfc71418f60c')
    
      32
    
      33pre_remove() {
    
      34  if [[ -f "/${HNCCONTEXT}/${NIMFLIB}" ]]; then
    
      35    rm -vf "/${HNCCONTEXT}/${NIMFLIB}"
    
      36    rm -rf "/${HNCDIR}"
    
      37  fi
    
      38}
    
      39
    
      40post_remove() {
    
      41  xdg-icon-resource forceupdate --theme hicolor &>/dev/null
    
      42  update-desktop-database -q
    
      43}
    
      44
    
      45package() {
    
      46
    
      47  curl -# -o "${srcdir}/${KIMELIB}" -fL 'https://github.com/Riey/kime/releases/latest/download/libkime-qt-5.11.3.so'
    
      48
    
      49  bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}/"
    
      50
    
      51  install -Dm644 -t "${pkgdir}/usr/share/licenses/hoffice" "${srcdir}/LICENSE"
    
      52
    
      53  if [ -f "${srcdir}/${KIMELIB}" ] && [ -f "${srcdir}/${NIMFLIB}" ]; then
    
      54    install -Dm755 -t "${pkgdir}/${HNCCONTEXT}" "${srcdir}/${KIMELIB}"
    
      55    install -Dm755 -t "${pkgdir}/${HNCCONTEXT}" "${srcdir}/${NIMFLIB}"
    
      56  fi
    
      57
    
      58  mkdir -p "$pkgdir"/usr/bin/
    
      59  echo "Creating symbolic link: /opt/hnc/hoffice11/Bin/hwp -> /usr/bin/hwp"
    
      60  echo '"/opt/hnc/hoffice11/Bin/hwp" $@' >"$pkgdir"/usr/bin/hwp
    
      61  chmod +x "$pkgdir"/usr/bin/hwp
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2