linuxqq

MEDIUM

maintainer Integral 113 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a non-whitelisted host (qqdl.gtimg.cn), which is not a standard code forge; while likely official for QQ, the unverifiable nature of the binary payload from a swappable host presents a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted host (qqdl.gtimg.cn), which is not a standard code forge; while likely official for QQ, the unverifiable nature of the binary payload from a swappable host presents a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Purofle <purofle@gmail.com>
    
      2# Contributor: Integral <integral@member.fsf.org>
    
      3
    
      4pkgname=linuxqq
    
      5pkgver=3.2.35_54395
    
      6pkgrel=1
    
      7epoch=5
    
      8pkgdesc="New Linux QQ based on Electron"
    
      9arch=('x86_64' 'aarch64' 'loong64')
    
      10url="https://im.qq.com/${pkgname}"
    
      11license=('LicenseRef-QQ')
    
      12conflicts=("${pkgname}-nt-bwrap")
    
      13depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
    
      14optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
    
      15_md5_prefix=816b3c79
    
      16_src_prefix="${pkgname}_${pkgver/_/-}"
    
      17source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
    
      18source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
    
      19source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
    
      20source=("${pkgname}.sh")
    
      21sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
    
      22sha512sums_x86_64=('c1dc085f2b50702a7c408aa6b89754ea5588c0646cf259fdf5c34a63f9883e0617008d6503469e6ae25e85bd1fd4063b56d8479dcd86529587c21a7f7316e95c')
    
      23sha512sums_aarch64=('adb5c09354deacc3568607bbea95afcdc8f7c1c076761f08531bc8fcb6bcafdad9c704608635f6680f928c2b7d9bdee26cb4a6cdbcef335cb94566e5c88992c9')
    
      24sha512sums_loong64=('e0883a55407c7636db864f343bbeec8a8c29559c54f4e70851a9e1bb06f9ab90c43ee564d606349be49aebb2dc923ae19f9df0de2ba8203d6a0ed56c2395dbf7')
    
      25options=('!strip' '!debug')
    
      26
    
      27package() {
    
      28	echo "  -> Extracting the data.tar.xz..."
    
      29	bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      30
    
      31	echo "  -> Installing..."
    
      32	# Launcher
    
      33	install -Dm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      34
    
      35	# Launcher Fix
    
      36	sed -i '3s!/opt/QQ/qq!linuxqq!' "${pkgdir}/usr/share/applications/qq.desktop"
    
      37
    
      38	# Icon Fix
    
      39	sed -i '6s!/usr/share/icons/hicolor/512x512/apps/qq.png!qq!' "${pkgdir}/usr/share/applications/qq.desktop"
    
      40
    
      41	# License
    
      42	install -Dm644 "${pkgdir}/opt/QQ/LICENSE.electron.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      43	install -Dm644 "${pkgdir}/opt/QQ/LICENSES.chromium.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      44
    
      45	# Temporary Solution: Remove libssh2 which comes from package "linuxqq" itself
    
      46	rm -fv ${pkgdir}/opt/QQ/resources/app/{,avsdk/bugly/}libssh2.so.1
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 # Contributor: Integral <integral@member.fsf.org>
 
 pkgname=linuxqq
-pkgver=3.2.34_53644
+pkgver=3.2.35_54395
 pkgrel=1
 epoch=5
 pkgdesc="New Linux QQ based on Electron"
@@ -12,16 +12,16 @@
 conflicts=("${pkgname}-nt-bwrap")
 depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
 optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
-_md5_prefix=9ee04bef
+_md5_prefix=816b3c79
 _src_prefix="${pkgname}_${pkgver/_/-}"
-source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
-source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
-source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.36/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
+source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
+source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
+source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.37/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
 source=("${pkgname}.sh")
 sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
-sha512sums_x86_64=('774e45cd7238dc51b31c02ee494f9f86e773c487a90851790a806f776e130af125110045844e90dd68d0b073dc53bdd4d1c6d8fb7225b8f214fc0e35d1a20e32')
-sha512sums_aarch64=('fa1424d41f934798a8f20b6cad8749f1eb99f29957501b3578449ade06fe105387e038e98cafb1bcc57d4d35010d771312ca0de7b14e62da0765cd29b005a5d1')
-sha512sums_loong64=('c3fa5c8cc426a3dfc35e26c1f1e138d018c5541beb84b2deae647be05e66aed8cb80a349a694672ff303884f5947508ded5af0b6b4a9e733a24eec9060d2cbf3')
+sha512sums_x86_64=('c1dc085f2b50702a7c408aa6b89754ea5588c0646cf259fdf5c34a63f9883e0617008d6503469e6ae25e85bd1fd4063b56d8479dcd86529587c21a7f7316e95c')
+sha512sums_aarch64=('adb5c09354deacc3568607bbea95afcdc8f7c1c076761f08531bc8fcb6bcafdad9c704608635f6680f928c2b7d9bdee26cb4a6cdbcef335cb94566e5c88992c9')
+sha512sums_loong64=('e0883a55407c7636db864f343bbeec8a8c29559c54f4e70851a9e1bb06f9ab90c43ee564d606349be49aebb2dc923ae19f9df0de2ba8203d6a0ed56c2395dbf7')
 options=('!strip' '!debug')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 05:55:14	Medium	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2