lceda-pro

LOW

maintainer taotieren 6 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt binaries from the project's official domain (image.lceda.cn), which is not on standard whitelists but is plausibly owned by the vendor; the binary is not executed at build time, and the worst case of a swapped source is distribution of a malicious binary, which is a supply-chain risk but not active remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official domain (image.lceda.cn), which is not on standard whitelists but is plausibly owned by the vendor; the binary is not executed at build time, and the worst case of a swapped source is distribution of a malicious binary, which is a supply-chain risk but not active remote code execution.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -sSfL -o "LICENSE-$pkgver.html" "https://lceda.cn/page/legal"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-x64-$pkgver.zip")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2# Co-Maintainer: Misaka13514 <Misaka13514 at gmail dot com>
    
      3
    
      4pkgname=lceda-pro
    
      5_pkgname=lceda-pro
    
      6pkgver=4.1.78
    
      7pkgrel=2
    
      8pkgdesc="免费、专业、强大的国产PCB设计工具"
    
      9arch=("x86_64" "aarch64")
    
      10url="https://pro.lceda.cn/"
    
      11license=("LicenseRef-LCEDA-Proprietary")
    
      12depends=("electron44" "libnotify" "libappindicator-gtk3")
    
      13makedepends=("curl")
    
      14provides=("$_pkgname")
    
      15conflicts=("$_pkgname" "$_pkgname-git" "$_pkgname-bin")
    
      16install=$pkgname.install
    
      17source=("$pkgname.install"
    
      18        "$_pkgname.sh")
    
      19source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-x64-$pkgver.zip")
    
      20source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-arm64-$pkgver.zip")
    
      21sha256sums=('afba3c6712227a37c08783b3cc1a97ae71e90dc2f575409213d2773372220697'
    
      22            '92fa6695112d40cdc746cf6e98a5e7696779c0140e6774373aa77941cb4d1e9e')
    
      23sha256sums_x86_64=('d437f7ae3541d16885430dd6480ac2f59dcad8df68307175f3fc17b2176bf60e')
    
      24sha256sums_aarch64=('b030280f72c23c937b2a6c68e91c360ec77fb89f09a8dc83bab1efaf4b70ca68')
    
      25
    
      26prepare() {
    
      27    curl -sSfL -o "LICENSE-$pkgver.html" "https://lceda.cn/page/legal"
    
      28}
    
      29
    
      30package() {
    
      31    install -Dm755 "$srcdir/$_pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
    
      32    install -Dm644 "$srcdir/LICENSE-$pkgver.html" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.html"
    
      33
    
      34    cd "$srcdir/$_pkgname"
    
      35    if [ -f "EasyEDA-Distribution-License.txt" ]; then
    
      36        install -Dm644 "EasyEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      37    elif [ -f "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" ]; then
    
      38        install -Dm644 "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" "$pkgdir/usr/share/licenses/$pkgname/LCEDA-EULA.pdf"
    
      39    elif [ -f "LCEDA-Distribution-License.txt" ]; then
    
      40        install -Dm644 "LCEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      41    fi
    
      42
    
      43    install -dm755 "$pkgdir/usr/lib/$_pkgname"
    
      44    cp -dpr --no-preserve=ownership resources "$pkgdir/usr/lib/$_pkgname"
    
      45    if [ -d "locales" ]; then
    
      46        cp -dpr --no-preserve=ownership locales "$pkgdir/usr/lib/$_pkgname"
    
      47    fi
    
      48
    
      49    # icon
    
      50    local _icon
    
      51    for _icon in 16 32 64 128 256 512; do
    
      52        if [ -f "icon/icon_${_icon}x${_icon}.png" ]; then
    
      53            install -Dm644 "icon/icon_${_icon}x${_icon}.png"                            "$pkgdir/usr/share/icons/hicolor/${_icon}x${_icon}/apps/$_pkgname.png"
    
      54        fi
    
      55    done
    
      56    if [ -f "icon/icon_512x512@2x.png" ]; then
    
      57        install -Dm644 "icon/icon_512x512@2x.png"                        "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/$_pkgname.png"
    
      58    fi
    
      59
    
      60    # desktop entry
    
      61    if [ -f "$_pkgname.dkt" ]; then
    
      62        install -Dm644 "$_pkgname.dkt" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      63        sed -E -i "s|^Exec=.*|Exec=$_pkgname %f|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      64        sed -E -i "s|^Icon=.*|Icon=$_pkgname|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      65    else
    
      66        install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" << "DESKTOP_EOF"
    
      67[Desktop Entry]
    
      68Categories=Development;Electronics;
    
      69Comment=免费、专业、强大的国产PCB设计工具
    
      70Exec=$_pkgname %f
    
      71Keywords=PCB;EDA;
    
      72GenericName=嘉立创EDA(专业版)
    
      73Icon=$_pkgname
    
      74Name=嘉立创EDA(专业版)
    
      75Type=Application
    
      76MimeType=application/eprj;application/eprj2;application/eprj3;
    
      77DESKTOP_EOF
    
      78    fi
    
      79
    
      80    # fix permissions
    
      81    find "$pkgdir/usr/lib/$_pkgname/" -type d -exec chmod 755 {} +
    
      82    find "$pkgdir/usr/lib/$_pkgname/" -type f -exec chmod 644 {} +
    
      83}
    
      84

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -4,12 +4,12 @@
 pkgname=lceda-pro
 _pkgname=lceda-pro
 pkgver=4.1.78
-pkgrel=1
+pkgrel=2
 pkgdesc="免费、专业、强大的国产PCB设计工具"
 arch=("x86_64" "aarch64")
 url="https://pro.lceda.cn/"
 license=("LicenseRef-LCEDA-Proprietary")
-depends=("electron" "libnotify" "libappindicator-gtk3")
+depends=("electron44" "libnotify" "libappindicator-gtk3")
 makedepends=("curl")
 provides=("$_pkgname")
 conflicts=("$_pkgname" "$_pkgname-git" "$_pkgname-bin")
@@ -19,7 +19,7 @@
 source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-x64-$pkgver.zip")
 source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-arm64-$pkgver.zip")
 sha256sums=('afba3c6712227a37c08783b3cc1a97ae71e90dc2f575409213d2773372220697'
-            'f29ad4605c3a1ed682802639fbb43f7cbd2989be52717514c1a8f53e36f6fef4')
+            '92fa6695112d40cdc746cf6e98a5e7696779c0140e6774373aa77941cb4d1e9e')
 sha256sums_x86_64=('d437f7ae3541d16885430dd6480ac2f59dcad8df68307175f3fc17b2176bf60e')
 sha256sums_aarch64=('b030280f72c23c937b2a6c68e91c360ec77fb89f09a8dc83bab1efaf4b70ca68')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 01:55:02	Medium	2
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 00:06:54	Low	3
2026-10-27 00:23:28	Low	3
2026-10-26 00:12:40	Low	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 01:27:05	Medium	2
2026-10-20 00:10:31	Medium	3
2026-10-19 03:23:49	Medium	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3