iflyime

maintainer taotieren · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from srf.xunfei.cn, which is the official iFlyTek (Xunfei) software distribution host for their Linux IME product. iFlyTek is a well-known Chinese AI/speech company, and srf.xunfei.cn appears to be their official software release server. The checksums ARE present (sha256sums_x86_64 is provided), so integrity verification is in place. However, the package installs a closed-source, prebuilt binary IME (input method engine) that runs as a background daemon with network access (curl dependency, grpc), and the binary originates from a Chinese vendor's server with no source code available. The symlink hacks (libgrpc++.so.1, libprotobuf.so.17) pointing to system libraries could cause ABI mismatches. The main concern is the closed-source binary with network capabilities from a non-Western vendor, but this is a known legitimate commercial product packaged for AUR — the risk is inherent to the software itself rather than a packaging attack. This is a genuine medium: a prebuilt binary from a vendor host that executes with network access, but with checksums present and from the apparent official vendor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 "iflyime_${pkgver}_amd64.deb::https://srf.xunfei.cn/sp1/com.iflytek.iflyime_${pkgver}_amd64_kylin_sp1.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from srf.xunfei.cn, which is the official iFlyTek (Xunfei) software distribution host for their Linux IME product. iFlyTek is a well-known Chinese AI/speech company, and srf.xunfei.cn appears to be their official software release server. The checksums ARE present (sha256sums_x86_64 is provided), so integrity verification is in place. However, the package installs a closed-source, prebuilt binary IME (input method engine) that runs as a background daemon with network access (curl dependency, grpc), and the binary originates from a Chinese vendor's server with no source code available. The symlink hacks (libgrpc++.so.1, libprotobuf.so.17) pointing to system libraries could cause ABI mismatches. The main concern is the closed-source binary with network capabilities from a non-Western vendor, but this is a known legitimate commercial product packaged for AUR — the risk is inherent to the software itself rather than a packaging attack. This is a genuine medium: a prebuilt binary from a vendor host that executes with network access, but with checksums present and from the apparent official vendor.

PKGBUILD

1 offending line(s) highlighted

      1#Maintainer: Lunatic <lunaticzy9527 at gmail dot com>
    
      2# Maintainer: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname=iflyime
    
      5pkgver=2.0.51
    
      6pkgrel=3
    
      7pkgdesc="XunFei for Linux (iflyime)"
    
      8arch=('x86_64')
    
      9url="http://srf.xunfei.cn/"
    
      10license=("custom AND LGPL-3.0-or-later")
    
      11depends=(
    
      12        sh
    
      13        curl
    
      14        fcitx
    
      15        gcc-libs
    
      16        glibc
    
      17        grpc
    
      18        hicolor-icon-theme
    
      19        # "dtkwidget"
    
      20        libx11
    
      21        libxtst
    
      22        qt5-base
    
      23        protobuf
    
      24        sqlite
    
      25        opencc
    
      26        xdg-utils
    
      27        zlib
    
      28)
    
      29makedepends=()
    
      30optdepends=()
    
      31# install=
    
      32options=(!strip !debug)
    
      33source_x86_64=(
    
      34        "iflyime_${pkgver}_amd64.deb::https://srf.xunfei.cn/sp1/com.iflytek.iflyime_${pkgver}_amd64_kylin_sp1.deb")
    
      35# soucre_aarch64=(
    
      36#         "iflyime_${pkgver}_arm64.deb::https://srf.xunfei.cn/sp1/com.iflytek.iflyime_${pkgver}_arm64_kylin_sp1.deb")
    
      37source=(
    
      38        #         "iflyime_${pkgver}_amd64.deb::http://packages.deepin.com/deepin/pool/non-free/i/iflyime/iflyime_${pkgver}_amd64.deb"
    
      39        "https://srf.xunfei.cn/linux/help/agreement.html"
    
      40)
    
      41sha256sums=('13256d2fe7ace56e536b550423ecced93ac5882a297bf7c4b09db189dc383a4a')
    
      42sha256sums_x86_64=('12d84d5b50985d42cb50854c7e3d941a559eb650113118940363ecdb9bee6ac0')
    
      43
    
      44package() {
    
      45        cd ${srcdir}
    
      46        tar -xvf data.tar.gz -C "${pkgdir}"
    
      47
    
      48        mkdir ${pkgdir}/opt/${pkgname}
    
      49        chown -R root:root "${pkgdir}"
    
      50        install -Dvm644 agreement.html ${pkgdir}/usr/share/licenses/$pkgname/license.html
    
      51
    
      52        cd ${pkgdir}
    
      53        rm -rf usr/share/applications
    
      54
    
      55        mv opt/apps/com.iflytek.iflyime/entries/{applications,icons} usr/share
    
      56        mv opt/apps/com.iflytek.iflyime/files/{bin,iflyime-qimpanel,res} opt/${pkgname}
    
      57        rm -rf opt/apps
    
      58        sed -i -e 's|apps/com.iflytek.iflyime/files|iflyime|g' \
    
      59                -e 's|/opt/apps/com.iflytek.iflyime/entries|/usr/share|g' usr/share/applications/iflyime-setting-wizard.desktop
    
      60        sed -i -e 's|/usr/bin/iflyime-qimpanel|/opt/iflyime/bin/iflyime-qimpanel|g' opt/${pkgname}/bin/iflyime-daemon.sh
    
      61
    
      62        rm -rf usr/lib/x86_64-linux-gnu
    
      63        install -dm755 ${pkgdir}/usr/lib/fcitx/
    
      64        ln -sf /opt/${pkgname}/bin/libiflyime.so ${pkgdir}/usr/lib/fcitx/fcitx-iflyime.so
    
      65        ln -sf /opt/${pkgname}/bin/fcitx-iflyime.conf ${pkgdir}/usr/share/fcitx/addon/fcitx-iflyime.conf
    
      66        ln -sf /opt/${pkgname}/bin/fcitx-iflyime.conf ${pkgdir}/usr/share/fcitx/inputmethod/iflyime.conf
    
      67        ln -sf /usr/share/icons/hicolor/48x48/apps/iflyime.png ${pkgdir}/usr/share/fcitx/imicon/fcitx-iflyime.png
    
      68        ln -sf /usr/share/icons/hicolor/48x48/apps/iflyime.png ${pkgdir}/usr/share/fcitx/imicon/iflyime.png
    
      69
    
      70        install -Dm0644 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname%-bin}.sh" <<EOF
    
      71#!/bin/sh
    
      72[ -d /opt/${pkgname}/bin/ ] && append_path '/opt/${pkgname}/bin/'
    
      73
    
      74export PATH
    
      75EOF
    
      76
    
      77        ln -sf /usr/lib/libgrpc++.so ${pkgdir}/usr/lib/libgrpc++.so.1
    
      78        ln -sf /usr/lib/libprotobuf.so ${pkgdir}/usr/lib/libprotobuf.so.17
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2