linuxqq-nt

LOW

maintainer logan_reed 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt .deb files from qqdl.gtimg.cn, a domain plausibly owned by Tencent (the QQ vendor), which is not on the standard whitelist but is the official source for QQ; the files are verified via b2sums, reducing risk, and the package installs only the vendor's official binary, which is normal for AUR packages distributing proprietary software.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb files from qqdl.gtimg.cn, a domain plausibly owned by Tencent (the QQ vendor), which is not on the standard whitelist but is the official source for QQ; the files are verified via b2sums, reducing risk, and the package installs only the vendor's official binary, which is normal for AUR packages distributing proprietary software.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/release/3f89efc5/QQ_3.2.32_260812_amd64_01.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: logan_reed <liulingzhang.work@icloud.com>
    
      2# Maintainer: Purofle <purofle@gmail.com>
    
      3# Contributor: Integral <integral@member.fsf.org>
    
      4# Contributor: SDCOM-0415
    
      5# Contributor: Kevin Li <qingtian805>
    
      6
    
      7_pkgname=linuxqq
    
      8pkgname=linuxqq-nt
    
      9install=linuxqq-nt.install
    
      10pkgver=3.2.32_260812
    
      11pkgrel=1
    
      12epoch=5
    
      13pkgdesc="New Linux QQ based on Electron"
    
      14arch=('x86_64' 'aarch64' 'loong64')
    
      15url="https://im.qq.com/${_pkgname}"
    
      16license=('LicenseRef-QQ')
    
      17conflicts=('linuxqq-nt-bwrap' 'linuxqq')
    
      18provides=("linuxqq=$pkgver")
    
      19depends=('nss' 'alsa-lib' 'gtk3' 'at-spi2-core' 'pulse-native-provider')
    
      20optdepends=('libappindicator-gtk3: System tray support'
    
      21            'gjs: Screen sharing support')
    
      22source=("${_pkgname}.sh" "linuxqq-get-url.sh")
    
      23source_x86_64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/release/3f89efc5/QQ_3.2.32_260812_amd64_01.deb")
    
      24source_aarch64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/release/3f89efc5/QQ_3.2.32_260812_arm64_01.deb")
    
      25source_loong64=("https://qqdl.gtimg.cn/qqfile/QQNT/9.9.33/release/3f89efc5/QQ_3.2.32_260812_loongarch64_01.deb")
    
      26b2sums=('714b68e91bdb5a24b5d92e9dd94490b32e0fb136de840fc87331f91ec5517db491c49dcf3f376083f4be79ed9da8795f60c0de34fb95ea868ae6130004b02991'
    
      27         '4b91ac5dcab7b2f92084bab0c81573efcc00b4c2b006be7abb9d6a35bdfcfe640b3a48e79008a08534571598f17f999533941b1a0529531468d48a3d5fbb70df')
    
      28b2sums_x86_64=('1185004eb2c9539bde5feea59c8902a2f6f997cb0d215918bfd8b16b26000c6425529ea7309c54659e1dc00e022f7afc4feea16237f21ab6995900479eab1054')
    
      29b2sums_aarch64=('b39bfa2d8e25fd4f85e17011a474cccd8b55a4ea2beb4f8582bcf9b2f3b889d5c393979abdfde80e224cfa5d73a5cfe7f5895051177113c4b8d40999f737d92d')
    
      30b2sums_loong64=('636ca3472f33ec170c8aa77de1405f973eb8c29fab1101828318266958ff1f988e11f7cfda89998bb4b7278c12d9d71ee5953d6f6b7a136e890effb53ffe6706')
    
      31options=('!strip' '!debug')
    
      32
    
      33# QQ 的 deb 包下载需先经 im.qq.com 的 GetSign 签名，直接请求 qqdl.gtimg.cn 上的原始 URL 会被拒绝。
    
      34DLAGENTS=('https::/usr/bin/bash linuxqq-get-url.sh --dlagent %u %o')
    
      35
    
      36package() {
    
      37	bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      38
    
      39	# Launcher
    
      40	install -Dm755 "${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      41
    
      42	# Desktop entry fixes
    
      43	sed -i 's|Exec=/opt/QQ/qq|Exec=linuxqq|' "${pkgdir}/usr/share/applications/qq.desktop"
    
      44	sed -i 's|Icon=/usr/share/icons/hicolor/512x512/apps/qq.png|Icon=qq|' "${pkgdir}/usr/share/applications/qq.desktop"
    
      45
    
      46	# License
    
      47	install -Dm644 "${pkgdir}/opt/QQ/LICENSE.electron.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      48	install -Dm644 "${pkgdir}/opt/QQ/LICENSES.chromium.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      49
    
      50	# SUID sandbox
    
      51	chmod 4755 "${pkgdir}/opt/QQ/chrome-sandbox"
    
      52
    
      53	# Remove macOS files
    
      54	rm -fv "${pkgdir}/opt/QQ/resources/app/"*.dylib
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 21:51:32	Medium	1
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2