iautodraw-bin

maintainer greenhandzdl · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt proprietary binary (.deb) from iautodraw.com, which is the vendor's own official website (matching the url= field). The binary is an Electron-based application (gtk3, nss, alsa-lib, libxss, libxtst dependencies are classic Electron stack) installed directly into /opt and /usr. The main concerns are: (1) it is a closed-source prebuilt binary from a Chinese software vendor with 'unknown' license, meaning the contents cannot be audited; (2) the aarch64 build pulls a different version (3.7.3 vs 3.7.4) than the x86_64 build, which is unusual but not inherently malicious; (3) the host iautodraw.com does match the official project URL so it is not a personal/unofficial host. The supply-chain risk is real but typical for binary AUR packages from proprietary vendors — the sha256sums are provided for both architectures, providing integrity verification. This is a standard medium-risk binary repackaging scenario: not clearly malicious, but an opaque prebuilt binary from a proprietary vendor with unknown license terms.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source_x86_64=("${pkgname}-${pkgver}-x86_64.deb"::"https://www.iautodraw.com/static/version/IAuto_${_ver_x86_64}_${_arch_x86_64}.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs a prebuilt proprietary binary (.deb) from iautodraw.com, which is the vendor's own official website (matching the url= field). The binary is an Electron-based application (gtk3, nss, alsa-lib, libxss, libxtst dependencies are classic Electron stack) installed directly into /opt and /usr. The main concerns are: (1) it is a closed-source prebuilt binary from a Chinese software vendor with 'unknown' license, meaning the contents cannot be audited; (2) the aarch64 build pulls a different version (3.7.3 vs 3.7.4) than the x86_64 build, which is unusual but not inherently malicious; (3) the host iautodraw.com does match the official project URL so it is not a personal/unofficial host. The supply-chain risk is real but typical for binary AUR packages from proprietary vendors — the sha256sums are provided for both architectures, providing integrity verification. This is a standard medium-risk binary repackaging scenario: not clearly malicious, but an opaque prebuilt binary from a proprietary vendor with unknown license terms.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: greenhandzdl <greenhandzdl@gmail.com>
    
      2pkgname=iautodraw-bin
    
      3pkgver=3.7.4
    
      4pkgrel=1
    
      5pkgdesc="IAutoDraw - 工业级智能图形绘制与设计软件 (官方二进制版)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://www.iautodraw.com/"
    
      8license=('unknown')
    
      9
    
      10depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'libxtst' 'hicolor-icon-theme')
    
      11optdepends=('libglvnd: 启用硬件加速图形渲染')
    
      12makedepends=('binutils')
    
      13provides=('iautodraw')
    
      14conflicts=('iautodraw')
    
      15
    
      16options=('!strip' '!debug')
    
      17
    
      18_ver_x86_64="3.7.4"
    
      19_arch_x86_64="amd64"
    
      20
    
      21_ver_aarch64="3.7.3"
    
      22_arch_aarch64="arm64"
    
      23
    
      24source_x86_64=("${pkgname}-${pkgver}-x86_64.deb"::"https://www.iautodraw.com/static/version/IAuto_${_ver_x86_64}_${_arch_x86_64}.deb")
    
      25sha256sums_x86_64=('f6f21efda827469fd52f58fc18d5d7b2f51a474462991e36741e24b768c1d6fc')
    
      26sha256sums_aarch64=('0e7eda096ea1ae2cf5b5353c61f72bbadbc2d9c6df54206376ddeed540271245')
    
      27
    
      28source_aarch64=("${pkgname}-${pkgver}-aarch64.deb"::"https://www.iautodraw.com/static/version/IAuto_${_ver_aarch64}_${_arch_aarch64}.deb")
    
      29
    
      30noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")
    
      31
    
      32prepare() {
    
      33    cd "${srcdir}"
    
      34    ar x "${pkgname}-${pkgver}-${CARCH}.deb"
    
      35    tar -xf data.tar.*
    
      36}
    
      37
    
      38package() {
    
      39    cd "${srcdir}"
    
      40    cp -a usr "${pkgdir}/"
    
      41    if [ -d opt ]; then
    
      42        cp -a opt "${pkgdir}/"
    
      43    fi
    
      44
    
      45    local _desktop_file="${pkgdir}/usr/share/applications/iauto.desktop"
    
      46    if [ -f "${_desktop_file}" ]; then
    
      47        sed -i 's|^Exec=.*|Exec=/opt/IAuto/iauto --in-process-gpu %U|' "${_desktop_file}"
    
      48    fi
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2