lceda-pro-bin

maintainer taotieren · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the project's official domain, which is plausibly controlled by the vendor; while the host is not on a standard whitelist, it is not a personal or third-party file-sharing service, and the binaries are properly checksummed, reducing supply-chain risk to low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official domain, which is plausibly controlled by the vendor; while the host is not on a standard whitelist, it is not a personal or third-party file-sharing service, and the binaries are properly checksummed, reducing supply-chain risk to low.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:25 curl -sSfL -o "LICENSE-$pkgver.html" "https://lceda.cn/page/legal"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-x64-$pkgver.zip")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2# Co-Maintainer: Misaka13514 <Misaka13514 at gmail dot com>
    
      3
    
      4pkgname=lceda-pro-bin
    
      5_pkgname=lceda-pro
    
      6pkgver=3.2.175
    
      7pkgrel=1
    
      8pkgdesc="免费、专业、强大的国产PCB设计工具"
    
      9arch=("x86_64" "aarch64")
    
      10url="https://pro.lceda.cn/"
    
      11license=("LicenseRef-LCEDA-Proprietary")
    
      12depends=("gtk3" "nss" "alsa-lib")
    
      13makedepends=("curl")
    
      14provides=("$_pkgname")
    
      15conflicts=("$_pkgname" "$_pkgname-git" "$_pkgname-electron")
    
      16install=$pkgname.install
    
      17source=("$pkgname.install")
    
      18source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-x64-$pkgver.zip")
    
      19source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-arm64-$pkgver.zip")
    
      20sha256sums=('afba3c6712227a37c08783b3cc1a97ae71e90dc2f575409213d2773372220697')
    
      21sha256sums_x86_64=('08e39efe025ee570dc50881e4c9ae93f7cbb5d0bcf8b05103251c95bce4152e2')
    
      22sha256sums_aarch64=('05d01e510866a9d10964f85c4902caae419fcc7d6934a117f26ac8d3718b5164')
    
      23
    
      24prepare() {
    
      25    curl -sSfL -o "LICENSE-$pkgver.html" "https://lceda.cn/page/legal"
    
      26}
    
      27
    
      28package() {
    
      29    install -Dm644 "$srcdir/LICENSE-$pkgver.html" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.html"
    
      30
    
      31    cd "$srcdir/$_pkgname"
    
      32    if [ -f "EasyEDA-Distribution-License.txt" ]; then
    
      33        install -Dm644 "EasyEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      34    elif [ -f "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" ]; then
    
      35        install -Dm644 "嘉立创EDA软件安装最终用户许可协议（EULA）.pdf" "$pkgdir/usr/share/licenses/$pkgname/LCEDA-EULA.pdf"
    
      36    elif [ -f "LCEDA-Distribution-License.txt" ]; then
    
      37        install -Dm644 "LCEDA-Distribution-License.txt" "$pkgdir/usr/share/licenses/$pkgname/EasyEDA-DLA.txt"
    
      38    fi
    
      39
    
      40    install -dm755 "$pkgdir/opt/$_pkgname"
    
      41    cp -dpr --no-preserve=ownership * "$pkgdir/opt/$_pkgname"
    
      42    rm -rf "$pkgdir/opt/$_pkgname/icon"
    
      43    rm -rf "$pkgdir/opt/$_pkgname/$_pkgname.dkt"
    
      44    rm -f "$pkgdir/opt/$_pkgname/"*License.txt
    
      45    rm -f "$pkgdir/opt/$_pkgname/"*.pdf
    
      46
    
      47    # icon
    
      48    local _icon
    
      49    for _icon in 16 32 64 128 256 512; do
    
      50        if [ -f "icon/icon_${_icon}x${_icon}.png" ]; then
    
      51            install -Dm644 "icon/icon_${_icon}x${_icon}.png"                            "$pkgdir/usr/share/icons/hicolor/${_icon}x${_icon}/apps/$_pkgname.png"
    
      52        fi
    
      53    done
    
      54    if [ -f "icon/icon_512x512@2x.png" ]; then
    
      55        install -Dm644 "icon/icon_512x512@2x.png"                        "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/$_pkgname.png"
    
      56    fi
    
      57
    
      58    # desktop entry
    
      59    if [ -f "$_pkgname.dkt" ]; then
    
      60        install -Dm644 "$_pkgname.dkt" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      61        sed -E -i "s|^Exec=.*|Exec=$_pkgname %f|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      62        sed -E -i "s|^Icon=.*|Icon=$_pkgname|g" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      63    else
    
      64        install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" << "DESKTOP_EOF"
    
      65[Desktop Entry]
    
      66Categories=Development;Electronics;
    
      67Comment=免费、专业、强大的国产PCB设计工具
    
      68Exec=$_pkgname %f
    
      69Keywords=PCB;EDA;
    
      70GenericName=嘉立创EDA(专业版)
    
      71Icon=$_pkgname
    
      72Name=嘉立创EDA(专业版)
    
      73Type=Application
    
      74MimeType=application/eprj;application/eprj2;application/eprj3;
    
      75DESKTOP_EOF
    
      76    fi
    
      77
    
      78    # fix permissions
    
      79    find "$pkgdir/opt/$_pkgname/" -type d -exec chmod 755 {} +
    
      80    find "$pkgdir/opt/$_pkgname/" -type f -exec chmod 644 {} +
    
      81    chmod 755 "$pkgdir/opt/$_pkgname/$_pkgname"
    
      82    if [ -f "$pkgdir/opt/$_pkgname/chrome_crashpad_handler" ]; then
    
      83        chmod 755 "$pkgdir/opt/$_pkgname/chrome_crashpad_handler"
    
      84    fi
    
      85
    
      86    # soft link
    
      87    install -dm755 "$pkgdir/usr/bin"
    
      88    ln -s "/opt/$_pkgname/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      89}
    
      90

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 
 pkgname=lceda-pro-bin
 _pkgname=lceda-pro
-pkgver=3.2.166
+pkgver=3.2.175
 pkgrel=1
 pkgdesc="免费、专业、强大的国产PCB设计工具"
 arch=("x86_64" "aarch64")
@@ -18,8 +18,8 @@
 source_x86_64=("$_pkgname-x86_64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-x64-$pkgver.zip")
 source_aarch64=("$_pkgname-aarch64-$pkgver.zip::https://image.lceda.cn/files/lceda-pro-linux-arm64-$pkgver.zip")
 sha256sums=('afba3c6712227a37c08783b3cc1a97ae71e90dc2f575409213d2773372220697')
-sha256sums_x86_64=('9993e440f97ac25c5c58073db4d37a6badc7361ebb161017b4ffb6967a12053c')
-sha256sums_aarch64=('e79a6c0aee2239360ae7c74f98c8e3cc41a57ed899396e2041c7a529aa848aff')
+sha256sums_x86_64=('08e39efe025ee570dc50881e4c9ae93f7cbb5d0bcf8b05103251c95bce4152e2')
+sha256sums_aarch64=('05d01e510866a9d10964f85c4902caae419fcc7d6934a117f26ac8d3718b5164')
 
 prepare() {
     curl -sSfL -o "LICENSE-$pkgver.html" "https://lceda.cn/page/legal"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 19:12:33	MEDIUM	2
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3