linuxqq

maintainer Integral · 110 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt .deb files from Tencent's official domain (qqdl.gtimg.cn), which hosts the official QQ releases; despite the non-whitelisted host, this is a legitimate source for the software, and the binaries are verified via sha512sums, making the risk low.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt .deb files from Tencent's official domain (qqdl.gtimg.cn), which hosts the official QQ releases; despite the non-whitelisted host, this is a legitimate source for the software, and the binaries are verified via sha512sums, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Purofle <purofle@gmail.com>
    
      2# Contributor: Integral <integral@member.fsf.org>
    
      3
    
      4pkgname=linuxqq
    
      5pkgver=3.2.32_51802
    
      6pkgrel=1
    
      7epoch=5
    
      8pkgdesc="New Linux QQ based on Electron"
    
      9arch=('x86_64' 'aarch64' 'loong64')
    
      10url="https://im.qq.com/${pkgname}"
    
      11license=('LicenseRef-QQ')
    
      12conflicts=("${pkgname}-nt-bwrap")
    
      13depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
    
      14optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
    
      15_md5_prefix=c97651b2
    
      16_src_prefix="${pkgname}_${pkgver/_/-}"
    
      17source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
    
      18source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
    
      19source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
    
      20source=("${pkgname}.sh")
    
      21sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
    
      22sha512sums_x86_64=('5a397574b333671f65395e4dcbe4fa829a0cb1a3e94569daeac15582c1f17d8e1ecbfea271b66a3c303ed73228eec12dc3f9962f51826b924896c31b05c08e9e')
    
      23sha512sums_aarch64=('7c9b201afeef11846e4a7b10332d6a81c786b8c28957d102ebdd1d20d998c83b72e15348832ca97ec10bd183e0881ab9911ec8122f9bdc4ca98a61316e44d512')
    
      24sha512sums_loong64=('aac5bb9e53554db5c95bbb2541cfda0841633e996798088756d2a16d3c8e480288fb6d8c52eecd154b1d119ddf2f1da59e58e90c9dd40a74e40518ba815f386a')
    
      25options=('!strip' '!debug')
    
      26
    
      27package() {
    
      28	echo "  -> Extracting the data.tar.xz..."
    
      29	bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      30
    
      31	echo "  -> Installing..."
    
      32	# Launcher
    
      33	install -Dm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      34
    
      35	# Launcher Fix
    
      36	sed -i '3s!/opt/QQ/qq!linuxqq!' "${pkgdir}/usr/share/applications/qq.desktop"
    
      37
    
      38	# Icon Fix
    
      39	sed -i '6s!/usr/share/icons/hicolor/512x512/apps/qq.png!qq!' "${pkgdir}/usr/share/applications/qq.desktop"
    
      40
    
      41	# License
    
      42	install -Dm644 "${pkgdir}/opt/QQ/LICENSE.electron.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      43	install -Dm644 "${pkgdir}/opt/QQ/LICENSES.chromium.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      44
    
      45	# Temporary Solution: Remove libssh2 which comes from package "linuxqq" itself
    
      46	rm -fv ${pkgdir}/opt/QQ/resources/app/{,avsdk/bugly/}libssh2.so.1
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,8 +2,8 @@
 # Contributor: Integral <integral@member.fsf.org>
 
 pkgname=linuxqq
-pkgver=3.2.31_51102
-pkgrel=2
+pkgver=3.2.32_51802
+pkgrel=1
 epoch=5
 pkgdesc="New Linux QQ based on Electron"
 arch=('x86_64' 'aarch64' 'loong64')
@@ -12,16 +12,16 @@
 conflicts=("${pkgname}-nt-bwrap")
 depends=('nss' 'alsa-lib' 'gtk3' 'gjs' 'at-spi2-core' 'openjpeg2' 'openslide')
 optdepends=('libappindicator-gtk3: Allow QQ to extend a menu via Ayatana indicators in Unity, KDE or Systray (GTK+ 3 library).')
-_md5_prefix=c390e792
+_md5_prefix=c97651b2
 _src_prefix="${pkgname}_${pkgver/_/-}"
-source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
-source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
-source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
+source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_amd64.deb")
+source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_arm64.deb")
+source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/beta/${_md5_prefix}/${_src_prefix}_loongarch64.deb")
 source=("${pkgname}.sh")
 sha512sums=('bd89ea20f9e540b37073db6a147b74db7ef706fbd77940c8c9d383a637d139077ccd9266612400c465c128ebe84a3c9a1b28b3e6681df52dae6e378c51399fe7')
-sha512sums_x86_64=('ba7114f7e4d919dbb2d5fd54310713b8e9b82938b8d74ed6914c278232cdb641d4bb3082830b8bd315b72214f630eeffc644a2f4272ccb0a763c19ea445c1c45')
-sha512sums_aarch64=('6d3202af9c409ff3c963e6c53871e7d2e11ddcc6ab81a9b10e841034895368e6b508d36d1e85056c670fef716beaa47cef385af45f7b096467c65ee8044080f2')
-sha512sums_loong64=('3b599928e73e1be638c1a8c9983ddc6b861511acdee3e966ae546ae70e8f197ed8f39c8a7c98be6003239ea5bd5fd7ec33f291f553bcb0e8000d304aac932d4c')
+sha512sums_x86_64=('5a397574b333671f65395e4dcbe4fa829a0cb1a3e94569daeac15582c1f17d8e1ecbfea271b66a3c303ed73228eec12dc3f9962f51826b924896c31b05c08e9e')
+sha512sums_aarch64=('7c9b201afeef11846e4a7b10332d6a81c786b8c28957d102ebdd1d20d998c83b72e15348832ca97ec10bd183e0881ab9911ec8122f9bdc4ca98a61316e44d512')
+sha512sums_loong64=('aac5bb9e53554db5c95bbb2541cfda0841633e996798088756d2a16d3c8e480288fb6d8c52eecd154b1d119ddf2f1da59e58e90c9dd40a74e40518ba815f386a')
 options=('!strip' '!debug')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 07:10:52	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 03:28:44	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2