larksuite-bin

MEDIUM

maintainer miaoer 8 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard URL pattern via a custom DLAGENT script, which points to a larksuite.com API endpoint; while the domain is official, the lack of a direct, verifiable link to a published release asset and use of a dynamic API call for fetching introduces supply-chain risk, warranting medium severity.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("Lark-linux_x64-${pkgver}.deb::lark+https://www.larksuite.com/api/package_info?platform=10"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt .deb from a non-standard URL pattern via a custom DLAGENT script, which points to a larksuite.com API endpoint; while the domain is official, the lack of a direct, verifiable link to a published release asset and use of a dynamic API call for fetching introduces supply-chain risk, warranting medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Mostly a copy of feishu-bin's PKGBUILD with s/feishu/lark/
    
      2# Contributor: Sabit Maulana <sbtmul@gmail.com>
    
      3# Maintainer: aliu <double-a, r-o-n to the 0-1-3-0 at ur gmail.com>
    
      4pkgname=larksuite-bin
    
      5pkgver=8.0.18
    
      6_pkgtyp=stable
    
      7pkgrel=1
    
      8pkgdesc="Collaboration suite service for office messaging, calendars, meetings, docs..."
    
      9arch=('x86_64')
    
      10url="https://www.larksuite.com"
    
      11_licensever=20260122
    
      12_licensever_us=20260122
    
      13license=('LicenseRef-Lark-User')
    
      14depends=('gtk3' 'nspr' 'nss' 'libpulse' 'libmfx' 'alsa-lib')
    
      15optdepends=('appmenu-gtk-module: Appmenu support')
    
      16makedepends=('curl' 'jq')
    
      17replaces=('bytedance-lark-dev-bin')
    
      18provides=("bytedance-lark=$pkgver" "lark=$pkgver")
    
      19options=('!emptydirs')
    
      20source=("Lark-linux_x64-${pkgver}.deb::lark+https://www.larksuite.com/api/package_info?platform=10"
    
      21	"LICENSE-${_licensever}.html::https://www.larksuite.com/en_us/user-terms-of-service"
    
      22	"LICENSE-US-${_licensever_us}.html::https://www.larksuite.com/en_us/user-terms-of-service-us"
    
      23	download-lark.sh
    
      24)
    
      25b2sums=('63101353a73cc9da6af300fbb0e7644bdb69551b7f9831f42e89e4d453e2352c7133e6ed2ec906eab3cce81cc24e54530b6fa8bb2ecc243c53a4c330f5fa494b'
    
      26        'SKIP'
    
      27        'SKIP'
    
      28        '22556020116e1c7df34ee12c29e60495489b5199cfb5bfc87f028b540d44ee4f10fd67495062985521bfb4b9b342de58339aeae5ddbd689640881e47ea5ee0c5')
    
      29DLAGENTS+=("lark::${startdir}/download-lark.sh %o %u")
    
      30
    
      31package() {
    
      32	# License
    
      33	install -Dm644 LICENSE-${_licensever}.html "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-${_licensever}.html"
    
      34	install -Dm644 LICENSE-US-${_licensever_us}.html "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-US-${_licensever_us}.html"
    
      35
    
      36	# Extract package data
    
      37	tar xpvf "${srcdir}/data.tar.xz" --xattrs-include='*' --numeric-owner -C "${pkgdir}"
    
      38
    
      39	# Modify files
    
      40	cd "${pkgdir}"
    
      41
    
      42	sed -i 's/StartupNotify=true/StartupNotify=true\nStartupWMClass=lark/g' "${pkgdir}/usr/share/applications/bytedance-lark.desktop"
    
      43
    
      44	sed -i "s/bytedance-lark-${_pkgtyp}/lark/g" "${pkgdir}/usr/share/applications/bytedance-lark.desktop"
    
      45	sed -i "s/bytedance-lark-${_pkgtyp}/lark/g" "${pkgdir}/usr/share/menu/bytedance-lark.menu"
    
      46	sed -i "s/bytedance-lark/lark/g" "${pkgdir}/usr/share/menu/bytedance-lark.menu"
    
      47	sed -i 's/bytedance-lark/lark/g' "${pkgdir}/usr/share/appdata/bytedance-lark.appdata.xml"
    
      48	sed -i 's/bytedance-lark/lark/g' "${pkgdir}/opt/bytedance/lark/bytedance-lark"
    
      49
    
      50	mv usr/share/menu/{bytedance-,}lark.menu
    
      51	mv usr/share/applications/{bytedance-,}lark.desktop
    
      52	mv usr/share/appdata/{bytedance-,}lark.appdata.xml
    
      53	mv usr/share/man/man1/{bytedance-lark-${_pkgtyp},lark}.1.gz
    
      54	mv usr/share/doc/{bytedance-lark-${_pkgtyp},lark}
    
      55
    
      56	## Move non-standard /opt files to /usr/lib
    
      57	install -d "usr/lib/lark/" && mv -T "opt/bytedance/lark" "usr/lib/lark"
    
      58
    
      59	### Update /usr/bin to point there
    
      60	rm "usr/bin/bytedance-lark-${_pkgtyp}"
    
      61	ln -s '/usr/lib/lark/bytedance-lark' "usr/bin/lark"
    
      62
    
      63	# Icons
    
      64	for size in 16 24 32 48 64 128 256; do
    
      65		install -d "usr/share/icons/hicolor/${size}x${size}/apps/"
    
      66		ln -s "/usr/lib/lark/product_logo_${size}.png" "usr/share/icons/hicolor/${size}x${size}/apps/bytedance-lark.png"
    
      67	done
    
      68
    
      69	# Fix directory permissions
    
      70	find "${pkgdir}" -type d -exec chmod 755 {} +
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 09:16:20	Medium	2