mailmaster

MEDIUM

maintainer mapleafgo 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a university mirror and Debian FTP, which are unverifiable and could be silently swapped, posing a supply-chain risk despite plausible sources.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "$pkgname-$pkgver.deb::https://mirrors.sdu.edu.cn/spark-store-repository/store/network/mailmaster/mailmaster_${pkgver}_amd64.deb"
PKGBUILD:25 'LICENSE.html::https://mail.163.com/html/agreement/doc.html'

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads prebuilt .deb binaries from a university mirror and Debian FTP, which are unverifiable and could be silently swapped, posing a supply-chain risk despite plausible sources.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: mapleafgo <mapleafgo at 163 dot com>
    
      2# Contributor: MYT1 <MYT1 at QQ com>
    
      3pkgname=mailmaster
    
      4pkgver=5.0.2.1011
    
      5epoch=2
    
      6pkgrel=5
    
      7pkgdesc="网易邮箱大师 - 高效强大的全平台邮箱客户端"
    
      8arch=('x86_64')
    
      9url="https://dashi.163.com"
    
      10license=('LicenseRef-custom')
    
      11depends=('nss' 'libsasl' 'libxcb' 'curl' 'glibc')
    
      12makedepends=('imagemagick')
    
      13provides=("$pkgname")
    
      14conflicts=('mailmaster-bin')
    
      15options=('!strip' '!debug')
    
      16install=$pkgname.install
    
      17
    
      18_nssver=1.1.16-1
    
      19source=(
    
      20  "$pkgname-$pkgver.deb::https://mirrors.sdu.edu.cn/spark-store-repository/store/network/mailmaster/mailmaster_${pkgver}_amd64.deb"
    
      21  "libnss-wrapper_${_nssver}_amd64.deb::http://ftp.us.debian.org/debian/pool/main/n/nss-wrapper/libnss-wrapper_${_nssver}_amd64.deb"
    
      22  'gconf-stub.c'
    
      23  'mailmaster.sh'
    
      24  'mailmaster.desktop'
    
      25  'LICENSE.html::https://mail.163.com/html/agreement/doc.html'
    
      26)
    
      27noextract=(
    
      28  "$pkgname-$pkgver.deb"
    
      29  "libnss-wrapper_${_nssver}_amd64.deb"
    
      30)
    
      31sha256sums=(
    
      32  'd7c272d50798b4f0dc5279efba383e8f12decef19e434b144e07c3c26c25c58a'
    
      33  '7f1c57d82bf64e31cc5bbd2e254a460c1236ce19f847fd0079839f28ae390ad9'
    
      34  'c0fd028980bcee165184b5e20e9d8cc0a70568695006d8803fe931f4afba063b'
    
      35  '6b3f90448bdada12908df03f4fa7184871d92e867d1b63ab9caf51d364685879'
    
      36  '384a1b3d3768d4c0424bfdd9b007aecaa712aede9dd7b9b7ad1b507e8708df9d'
    
      37  'c8ddd672f5be8b2986fadf04475da64d7768480bf3ec1d5e94479b1a675b40ff'
    
      38)
    
      39
    
      40prepare() {
    
      41  mkdir -p mailmaster-data nss-wrapper
    
      42  bsdtar -xOf "$pkgname-$pkgver.deb" data.tar.xz | bsdtar -x -C mailmaster-data
    
      43  bsdtar -xOf "libnss-wrapper_${_nssver}_amd64.deb" data.tar.xz | bsdtar -x -C nss-wrapper
    
      44}
    
      45
    
      46build() {
    
      47  gcc -shared -fPIC -Wl,-soname,libgconf-2.so.4 -o libgconf-2.so.4 gconf-stub.c
    
      48}
    
      49
    
      50package() {
    
      51  local appdir=$pkgdir/opt/mailmaster
    
      52
    
      53  install -dm755 "$appdir"
    
      54  cp -a mailmaster-data/opt/mailmaster/. "$appdir/"
    
      55
    
      56  install -Dm755 mailmaster.sh "$appdir/launch.sh"
    
      57  install -dm755 "$pkgdir/usr/bin"
    
      58  ln -s /opt/mailmaster/launch.sh "$pkgdir/usr/bin/mailmaster"
    
      59  install -Dm644 mailmaster.desktop "$pkgdir/usr/share/applications/mailmaster.desktop"
    
      60
    
      61  local size
    
      62  for size in 16 32 48 64 128 256; do
    
      63    install -dm755 "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps"
    
      64    magick "$appdir/logo.ico" -resize "${size}x${size}" \
    
      65      "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/mailmaster.png"
    
      66  done
    
      67
    
      68  install -Dm755 nss-wrapper/usr/lib/x86_64-linux-gnu/libnss_wrapper.so \
    
      69    "$appdir/lib/libnss_wrapper.so"
    
      70  install -Dm755 libgconf-2.so.4 "$appdir/lib/libgconf-2.so.4"
    
      71  ln -s /usr/lib/libsasl2.so.3 "$appdir/lib/libsasl2.so.2"
    
      72
    
      73  local f
    
      74  for f in "$appdir"/plugins/xcbglintegrations/*.so; do
    
      75    mv "$f" "$f.disabled"
    
      76  done
    
      77  mv "$appdir/plugins/platforminputcontexts/libfcitxplatforminputcontextplugin.so"{,.disabled}
    
      78
    
      79  chmod 4755 "$appdir/chrome-sandbox"
    
      80  install -Dm644 LICENSE.html "$pkgdir/usr/share/licenses/$pkgname/LICENSE.html"
    
      81  install -Dm644 "$appdir/licences/cef.txt" "$pkgdir/usr/share/licenses/$pkgname/cef.txt"
    
      82}
    
      83

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2