iautodraw-bin

MEDIUM

maintainer greenhandzdl 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

This PKGBUILD downloads and installs a prebuilt proprietary binary (.deb) from iautodraw.com, which is the vendor's own official website (matching the url= field). The binary is an Electron-based application (gtk3, nss, alsa-lib, libxss, libxtst dependencies are classic Electron stack) installed directly into /opt and /usr. The main concerns are: (1) it is a closed-source prebuilt binary from a Chinese software vendor with 'unknown' license, meaning the contents cannot be audited; (2) the aarch64 build pulls a different version (3.7.3 vs 3.7.4) than the x86_64 build, which is unusual but not inherently malicious; (3) the host iautodraw.com does match the official project URL so it is not a personal/unofficial host. The supply-chain risk is real but typical for binary AUR packages from proprietary vendors — the sha256sums are provided for both architectures, providing integrity verification. This is a standard medium-risk binary repackaging scenario: not clearly malicious, but an opaque prebuilt binary from a proprietary vendor with unknown license terms.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source_x86_64=("${pkgname}-${pkgver}-x86_64.deb"::"https://www.iautodraw.com/static/version/IAuto_${_ver_x86_64}_${_arch_x86_64}.deb")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs a prebuilt proprietary binary (.deb) from iautodraw.com, which is the vendor's own official website (matching the url= field). The binary is an Electron-based application (gtk3, nss, alsa-lib, libxss, libxtst dependencies are classic Electron stack) installed directly into /opt and /usr. The main concerns are: (1) it is a closed-source prebuilt binary from a Chinese software vendor with 'unknown' license, meaning the contents cannot be audited; (2) the aarch64 build pulls a different version (3.7.3 vs 3.7.4) than the x86_64 build, which is unusual but not inherently malicious; (3) the host iautodraw.com does match the official project URL so it is not a personal/unofficial host. The supply-chain risk is real but typical for binary AUR packages from proprietary vendors — the sha256sums are provided for both architectures, providing integrity verification. This is a standard medium-risk binary repackaging scenario: not clearly malicious, but an opaque prebuilt binary from a proprietary vendor with unknown license terms.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: greenhandzdl <greenhandzdl@gmail.com>
    
      2pkgname=iautodraw-bin
    
      3pkgver=3.7.4
    
      4pkgrel=1
    
      5pkgdesc="IAutoDraw - 工业级智能图形绘制与设计软件 (官方二进制版)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://www.iautodraw.com/"
    
      8license=('unknown')
    
      9
    
      10depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'libxtst' 'hicolor-icon-theme')
    
      11optdepends=('libglvnd: 启用硬件加速图形渲染')
    
      12makedepends=('binutils')
    
      13provides=('iautodraw')
    
      14conflicts=('iautodraw')
    
      15
    
      16options=('!strip' '!debug')
    
      17
    
      18_ver_x86_64="3.7.4"
    
      19_arch_x86_64="amd64"
    
      20
    
      21_ver_aarch64="3.7.3"
    
      22_arch_aarch64="arm64"
    
      23
    
      24source_x86_64=("${pkgname}-${pkgver}-x86_64.deb"::"https://www.iautodraw.com/static/version/IAuto_${_ver_x86_64}_${_arch_x86_64}.deb")
    
      25sha256sums_x86_64=('f6f21efda827469fd52f58fc18d5d7b2f51a474462991e36741e24b768c1d6fc')
    
      26sha256sums_aarch64=('0e7eda096ea1ae2cf5b5353c61f72bbadbc2d9c6df54206376ddeed540271245')
    
      27
    
      28source_aarch64=("${pkgname}-${pkgver}-aarch64.deb"::"https://www.iautodraw.com/static/version/IAuto_${_ver_aarch64}_${_arch_aarch64}.deb")
    
      29
    
      30noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")
    
      31
    
      32prepare() {
    
      33    cd "${srcdir}"
    
      34    ar x "${pkgname}-${pkgver}-${CARCH}.deb"
    
      35    tar -xf data.tar.*
    
      36}
    
      37
    
      38package() {
    
      39    cd "${srcdir}"
    
      40    cp -a usr "${pkgdir}/"
    
      41    if [ -d opt ]; then
    
      42        cp -a opt "${pkgdir}/"
    
      43    fi
    
      44
    
      45    local _desktop_file="${pkgdir}/usr/share/applications/iauto.desktop"
    
      46    if [ -f "${_desktop_file}" ]; then
    
      47        sed -i 's|^Exec=.*|Exec=/opt/IAuto/iauto --in-process-gpu %U|' "${_desktop_file}"
    
      48    fi
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2