linuxqq-nt

maintainer logan_reed · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt .deb files from Tencent's official qqdl.gtimg.cn domain, which is plausibly the project's own infrastructure; despite the non-whitelisted host, the content is a standard binary distribution verified by b2sums, and the worst case of a swapped source would be a malicious binary, but the source is official and checksummed.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb files from Tencent's official qqdl.gtimg.cn domain, which is plausibly the project's own infrastructure; despite the non-whitelisted host, the content is a standard binary distribution verified by b2sums, and the worst case of a swapped source would be a malicious binary, but the source is official and checksummed.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNTV2/9.9.32/release/c390e792/QQ_3.2.31_260710_amd64_01.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: logan_reed <liulingzhang.work@icloud.com>
    
      2# Maintainer: Purofle <purofle@gmail.com>
    
      3# Contributor: Integral <integral@member.fsf.org>
    
      4# Contributor: SDCOM-0415
    
      5# Contributor: Kevin Li <qingtian805>
    
      6
    
      7_pkgname=linuxqq
    
      8pkgname=linuxqq-nt
    
      9install=linuxqq-nt.install
    
      10pkgver=3.2.31_260710
    
      11pkgrel=2
    
      12epoch=5
    
      13pkgdesc="New Linux QQ based on Electron"
    
      14arch=('x86_64' 'aarch64' 'loong64')
    
      15url="https://im.qq.com/${_pkgname}"
    
      16license=('LicenseRef-QQ')
    
      17conflicts=('linuxqq-nt-bwrap' 'linuxqq')
    
      18provides=("linuxqq=$pkgver")
    
      19depends=('nss' 'alsa-lib' 'gtk3' 'at-spi2-core' 'pulse-native-provider')
    
      20optdepends=('libappindicator-gtk3: System tray support'
    
      21            'gjs: Screen sharing support')
    
      22source=("${_pkgname}.sh" "linuxqq-get-url.sh")
    
      23source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNTV2/9.9.32/release/c390e792/QQ_3.2.31_260710_amd64_01.deb")
    
      24source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNTV2/9.9.32/release/c390e792/QQ_3.2.31_260710_arm64_01.deb")
    
      25source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNTV2/9.9.32/release/c390e792/QQ_3.2.31_260710_loongarch64_01.deb")
    
      26b2sums=('bc9b456b857447a011f0bfb1571e41b4cd6e804ce12019f812f65dbc8a6d4ffea6099a951386129eafd2d1451313c09c49222ffe7fa90d65e02260e3a4e0f6dd'
    
      27         '502ee4db4a97bb6c08a153f1d04d79b609b0b90c2fda5b0bb93b839f84f0c9e57e2354a1dec5898038476f48bcd1d81160176f6dc1f9e5c849742eb4d2f7591a')
    
      28b2sums_x86_64=('234a0f338d47e952995a1d4cf1dc782e5266623f878b92af264753b8c032fd31450169e1e25c8d10d37e26848c28dbb0302732874bbfce1566f8ad2b89e0337b')
    
      29b2sums_aarch64=('e31096831099d3a9285443e62344d7ec451a9b991283f803e568ae61ab578b3de79ffd6d2bfbf69923a62715428a13cfcd33e2682d4d873d38add44e66ddf135')
    
      30b2sums_loong64=('ef51070de26b8f33fedb1f70abe3d348aef90b47405ac74f181dd696ce4288fcf657e4c13014807a1069b56a547ca4be64673cd05f9e7ddf62df2d445af8bb9d')
    
      31options=('!strip' '!debug')
    
      32
    
      33# QQ 的 deb 包下载需先经 im.qq.com 的 GetSign 签名，直接请求 qqdl.gtimg.cn 上的原始 URL 会被拒绝。
    
      34DLAGENTS=('https::/usr/bin/bash linuxqq-get-url.sh --dlagent %u %o')
    
      35
    
      36package() {
    
      37	bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      38
    
      39	# Launcher
    
      40	install -Dm755 "${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      41
    
      42	# Desktop entry fixes
    
      43	sed -i 's|Exec=/opt/QQ/qq|Exec=linuxqq|' "${pkgdir}/usr/share/applications/qq.desktop"
    
      44	sed -i 's|Icon=/usr/share/icons/hicolor/512x512/apps/qq.png|Icon=qq|' "${pkgdir}/usr/share/applications/qq.desktop"
    
      45
    
      46	# License
    
      47	install -Dm644 "${pkgdir}/opt/QQ/LICENSE.electron.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      48	install -Dm644 "${pkgdir}/opt/QQ/LICENSES.chromium.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      49
    
      50	# SUID sandbox
    
      51	chmod 4755 "${pkgdir}/opt/QQ/chrome-sandbox"
    
      52
    
      53	# Remove macOS files
    
      54	rm -fv "${pkgdir}/opt/QQ/resources/app/"*.dylib
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 21:18:45	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2