lceda-pro

maintainer taotieren · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the project's own domain (lceda.cn/image.lceda.cn), which is plausibly official;虽host不在白名单但属项目自有设施，且无代码执行或数据外泄行为，最坏情况为官方二进制被篡改，属低风险供应链依赖。

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's own domain (lceda.cn/image.lceda.cn), which is plausibly official;虽host不在白名单但属项目自有设施，且无代码执行或数据外泄行为，最坏情况为官方二进制被篡改，属低风险供应链依赖。

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -sSfL -o "LICENSE-$pkgver.html" "https://lceda.cn/page/legal"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-x64-$pkgver.zip")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2# Co-Maintainer: Misaka13514 <Misaka13514 at gmail dot com>
    
      3
    
      4pkgname=lceda-pro
    
      5_pkgname=lceda-pro
    
      6pkgver=3.2.174
    
      7pkgrel=1
    
      8pkgdesc="免费、专业、强大的国产PCB设计工具"
    
      9arch=("x86_64" "aarch64")
    
      10url="https://pro.lceda.cn/"
    
      11license=("LicenseRef-LCEDA-Proprietary")
    
      12depends=("electron" "libnotify" "libappindicator-gtk3")
    
      13makedepends=("curl")
    
      14provides=("$_pkgname")
    
      15conflicts=("$_pkgname" "$_pkgname-git" "$_pkgname-bin")
    
      16install=$pkgname.install
    
      17source=("$pkgname.install"
    
      18        "$_pkgname.sh")
    
      19source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-x64-$pkgver.zip")
    
      20source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-arm64-$pkgver.zip")
    
      21sha256sums=('afba3c6712227a37c08783b3cc1a97ae71e90dc2f575409213d2773372220697'
    
      22            'f29ad4605c3a1ed682802639fbb43f7cbd2989be52717514c1a8f53e36f6fef4')
    
      23sha256sums_x86_64=('ea8110abfeb8b72e3ed04121bd38e6dc9f6fc5d71ebfce1181a0bbcbb26e0e85')
    
      24sha256sums_aarch64=('0c8b47b62ee549e7c7c991b77c60a2fdc551124ade67d8cb49fc60189bdfe49a')
    
      25
    
      26prepare() {
    
      27    curl -sSfL -o "LICENSE-$pkgver.html" "https://lceda.cn/page/legal"
    
      28}
    
      29
    
      30package() {
    
      31    install -Dm755 "$srcdir/$_pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
    
      32    install -Dm644 "$srcdir/LICENSE-$pkgver.html" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.html"
    
      33
    
      34    cd "$srcdir/$_pkgname"
    
      35    if [ -f "EasyEDA-Distribution-License.txt" ]; then
    
      36        install -Dm644 "EasyEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      37    elif [ -f "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" ]; then
    
      38        install -Dm644 "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" "$pkgdir/usr/share/licenses/$pkgname/LCEDA-EULA.pdf"
    
      39    elif [ -f "LCEDA-Distribution-License.txt" ]; then
    
      40        install -Dm644 "LCEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      41    fi
    
      42
    
      43    install -dm755 "$pkgdir/usr/lib/$_pkgname"
    
      44    cp -dpr --no-preserve=ownership resources "$pkgdir/usr/lib/$_pkgname"
    
      45    if [ -d "locales" ]; then
    
      46        cp -dpr --no-preserve=ownership locales "$pkgdir/usr/lib/$_pkgname"
    
      47    fi
    
      48
    
      49    # icon
    
      50    local _icon
    
      51    for _icon in 16 32 64 128 256 512; do
    
      52        if [ -f "icon/icon_${_icon}x${_icon}.png" ]; then
    
      53            install -Dm644 "icon/icon_${_icon}x${_icon}.png"                            "$pkgdir/usr/share/icons/hicolor/${_icon}x${_icon}/apps/$_pkgname.png"
    
      54        fi
    
      55    done
    
      56    if [ -f "icon/icon_512x512@2x.png" ]; then
    
      57        install -Dm644 "icon/icon_512x512@2x.png"                        "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/$_pkgname.png"
    
      58    fi
    
      59
    
      60    # desktop entry
    
      61    if [ -f "$_pkgname.dkt" ]; then
    
      62        install -Dm644 "$_pkgname.dkt" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      63        sed -E -i "s|^Exec=.*|Exec=$_pkgname %f|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      64        sed -E -i "s|^Icon=.*|Icon=$_pkgname|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      65    else
    
      66        install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" << "DESKTOP_EOF"
    
      67[Desktop Entry]
    
      68Categories=Development;Electronics;
    
      69Comment=免费、专业、强大的国产PCB设计工具
    
      70Exec=$_pkgname %f
    
      71Keywords=PCB;EDA;
    
      72GenericName=嘉立创EDA(专业版)
    
      73Icon=$_pkgname
    
      74Name=嘉立创EDA(专业版)
    
      75Type=Application
    
      76MimeType=application/eprj;application/eprj2;application/eprj3;
    
      77DESKTOP_EOF
    
      78    fi
    
      79
    
      80    # fix permissions
    
      81    find "$pkgdir/usr/lib/$_pkgname/" -type d -exec chmod 755 {} +
    
      82    find "$pkgdir/usr/lib/$_pkgname/" -type f -exec chmod 644 {} +
    
      83}
    
      84

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 
 pkgname=lceda-pro
 _pkgname=lceda-pro
-pkgver=3.2.166
+pkgver=3.2.174
 pkgrel=1
 pkgdesc="免费、专业、强大的国产PCB设计工具"
 arch=("x86_64" "aarch64")
@@ -20,8 +20,8 @@
 source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-arm64-$pkgver.zip")
 sha256sums=('afba3c6712227a37c08783b3cc1a97ae71e90dc2f575409213d2773372220697'
             'f29ad4605c3a1ed682802639fbb43f7cbd2989be52717514c1a8f53e36f6fef4')
-sha256sums_x86_64=('9993e440f97ac25c5c58073db4d37a6badc7361ebb161017b4ffb6967a12053c')
-sha256sums_aarch64=('82d5233d30f285834e6530ad682fe9ef9e7d49d50eac5b224aa1059f9b6cfc0c')
+sha256sums_x86_64=('ea8110abfeb8b72e3ed04121bd38e6dc9f6fc5d71ebfce1181a0bbcbb26e0e85')
+sha256sums_aarch64=('0c8b47b62ee549e7c7c991b77c60a2fdc551124ade67d8cb49fc60189bdfe49a')
 
 prepare() {
     curl -sSfL -o "LICENSE-$pkgver.html" "https://lceda.cn/page/legal"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 03:37:00	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 23:52:53	MEDIUM	3