linuxqq

MEDIUM

maintainer Integral 111 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a non-whitelisted host (qqdl.gtimg.cn), which is not a standard code forge or vendor domain; while likely legitimate, the source is an unverifiable executable bundle from a host that could potentially serve swapped content, constituting a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted host (qqdl.gtimg.cn), which is not a standard code forge or vendor domain; while likely legitimate, the source is an unverifiable executable bundle from a host that could potentially serve swapped content, constituting a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Purofle <purofle@gmail.com>
    
      2# Contributor: Integral <integral@member.fsf.org>
    
      3
    
      4pkgname=linuxqq
    
      5pkgver=3.2.33_52892
    
      6pkgrel=1
    
      7epoch=5
    
      8pkgdesc="New Linux QQ based on Electron"
    
      9arch=('x86_64' 'aarch64' 'loong64')
    
      10url="https://im.qq.com/${pkgname}"
    
      11license=('LicenseRef-QQ')
    
      12conflicts=("${pkgname}-nt-bwrap")
    
      13depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
    
      14optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
    
      15_md5_prefix=1763096b
    
      16_src_prefix="${pkgname}_${pkgver/_/-}"
    
      17source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
    
      18source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
    
      19source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
    
      20source=("${pkgname}.sh")
    
      21sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
    
      22sha512sums_x86_64=('8b12141690c38708508627817f40188d23da5e357164a0cdd6395530b9abad88d06da44c36ff85262872eb8bf2995c184c391048f63a004be81284a444ebb53e')
    
      23sha512sums_aarch64=('27636f05d56ef2cc21bd5ae45375648cfe2d6ce1ebb7418a8ae0318ae7d61aab44482d276a29552dce374420dbbd9ee66653406e0ddcac0a5f87211a320ea6fc')
    
      24sha512sums_loong64=('dc7cec63e6ec10acfa0e973157d80f28ff46418f51f20626e35103057e68a1bc82f355c267abc2b1dee0a57893814496d13e32085e56afbcbc6e1419b39cbd17')
    
      25options=('!strip' '!debug')
    
      26
    
      27package() {
    
      28	echo "  -> Extracting the data.tar.xz..."
    
      29	bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      30
    
      31	echo "  -> Installing..."
    
      32	# Launcher
    
      33	install -Dm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      34
    
      35	# Launcher Fix
    
      36	sed -i '3s!/opt/QQ/qq!linuxqq!' "${pkgdir}/usr/share/applications/qq.desktop"
    
      37
    
      38	# Icon Fix
    
      39	sed -i '6s!/usr/share/icons/hicolor/512x512/apps/qq.png!qq!' "${pkgdir}/usr/share/applications/qq.desktop"
    
      40
    
      41	# License
    
      42	install -Dm644 "${pkgdir}/opt/QQ/LICENSE.electron.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      43	install -Dm644 "${pkgdir}/opt/QQ/LICENSES.chromium.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      44
    
      45	# Temporary Solution: Remove libssh2 which comes from package "linuxqq" itself
    
      46	rm -fv ${pkgdir}/opt/QQ/resources/app/{,avsdk/bugly/}libssh2.so.1
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-08-30 00:04
+++ PKGBUILD @ 2026-09-17 00:27
@@ -2,7 +2,7 @@
 # Contributor: Integral <integral@member.fsf.org>
 
 pkgname=linuxqq
-pkgver=3.2.32_52194
+pkgver=3.2.33_52892
 pkgrel=1
 epoch=5
 pkgdesc="New Linux QQ based on Electron"
@@ -12,16 +12,16 @@
 conflicts=("${pkgname}-nt-bwrap")
 depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
 optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
-_md5_prefix=3f89efc5
+_md5_prefix=1763096b
 _src_prefix="${pkgname}_${pkgver/_/-}"
-source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
-source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
-source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
+source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
+source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
+source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.35/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
 source=("${pkgname}.sh")
 sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
-sha512sums_x86_64=('67ed23ebc802d6b2c8f409316eea2e880a71e8ffdaf09bd3d2ac9aeb2dd57efa48ada919e82594948122fa72664512e038665a21ce0b9063e97baeb504deeb9c')
-sha512sums_aarch64=('0a26b68711ae0055e1dbb8414663be72638f07f3a471cef1cfb5e79d1ced2b09bc15337c12235450c8b3453fd7ef43ae4c03078c8f319a835d1f707dfdc96c28')
-sha512sums_loong64=('99b7fd9400910c993dd97dda294add65e58a2e3e3ff8a3860f60cf8b8a24418c6107ecfefca8f0ba76532ce92d0a9e76c9c66396c8c8a867fa3e8450aca9916c')
+sha512sums_x86_64=('8b12141690c38708508627817f40188d23da5e357164a0cdd6395530b9abad88d06da44c36ff85262872eb8bf2995c184c391048f63a004be81284a444ebb53e')
+sha512sums_aarch64=('27636f05d56ef2cc21bd5ae45375648cfe2d6ce1ebb7418a8ae0318ae7d61aab44482d276a29552dce374420dbbd9ee66653406e0ddcac0a5f87211a320ea6fc')
+sha512sums_loong64=('dc7cec63e6ec10acfa0e973157d80f28ff46418f51f20626e35103057e68a1bc82f355c267abc2b1dee0a57893814496d13e32085e56afbcbc6e1419b39cbd17')
 options=('!strip' '!debug')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 07:41:46	Medium	2
2026-08-30 00:04:14	Medium	2