mailmaster-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from a university mirror, but it is the official mailmaster client from a known vendor (163.com), and the binary is not executed during build; the source is reproducible and checksummed, limiting supply-chain risks.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from a university mirror, but it is the official mailmaster client from a known vendor (163.com), and the binary is not executed during build; the source is reproducible and checksummed, limiting supply-chain risks.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 "LICENSE.html::https://mail.163.com/html/agreement/doc.html"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=mailmaster-bin
    
      3pkgver=5.0.2.1011
    
      4pkgrel=8
    
      5pkgdesc="Professional full-platform email client. One email, multiple syncs. All platforms give you a great experience.专业的全平台邮箱客户端。一封邮件，多端同步。所有平台都能给你出色的体验。"
    
      6arch=('x86_64')
    
      7url="https://dashi.163.com"
    
      8_sparkurl="https://mirrors.sdu.edu.cn/spark-store-repository"
    
      9_ablrun_url="https://portrait.gitee.com/spark-store-project/additional-base-lib"
    
      10_ubuntu_debdl_url="https://mirrors.sdu.edu.cn/ubuntu"
    
      11license=('LicenseRef-custom')
    
      12conflicts=("${pkgname%-bin}")
    
      13depends=(
    
  'qt5-base'
    
  'alsa-lib'
    
  'libxrandr'
    
  'nss'
    
  'at-spi2-core'
    
  'pango'
    
  'gconf'
    
  'libxcomposite'
    
  'bubblewrap'
    
  'libxdamage'
    
  'libsasl'
    
  'zenity'
    
      26)
    
      27makedepends=(
    
  'imagemagick'
    
      29)
    
      30noextract=()
    
      31options=('!strip')
    
      32source=(
    
  "${pkgname%-bin}-${pkgver}.deb::${_sparkurl}/store//network/mailmaster/${pkgname%-bin}_${pkgver}_amd64.deb"
    
  "libnss-wrapper-1.1.2.deb::${_ubuntu_debdl_url}/pool/main/n/nss-wrapper/libnss-wrapper_1.1.2-1_amd64.deb"
    
  "LICENSE.html::https://mail.163.com/html/agreement/doc.html"
    
  "${pkgname%-bin}.sh"
    
      37)
    
      38sha256sums=('d7c272d50798b4f0dc5279efba383e8f12decef19e434b144e07c3c26c25c58a'
    
          'c1c9649b1bbd095a03c648d89b7bfeedcc7c15ae819e2a1a778427908eebb284'
    
          'c8ddd672f5be8b2986fadf04475da64d7768480bf3ec1d5e94479b1a675b40ff'
    
          '4bd4e8079ba1d7adb55f7b050e3358a48de09c88093a90a6c46397d54a0030a3')
    
      42build() {
    
  # Clean any leftover extraction state from previous builds
    
  cd "${srcdir}"
    
  rm -rf opt usr libnss-wrapper data.tar.*
    
      46
    
  # Extract mailmaster .deb package properly
    
  echo "Extracting main package..."
    
  bsdtar -xf "${pkgname%-bin}-${pkgver}.deb"
    
      50
    
  # Extract data archive
    
  if [ -f "data.tar.zst" ]; then
    
      echo "Found data.tar.zst, extracting..."
    
      bsdtar -xf "data.tar.zst"
    
  elif [ -f "data.tar.xz" ]; then
    
      echo "Found data.tar.xz, extracting..."
    
      bsdtar -xf "data.tar.xz"
    
  else
    
      echo "Error: No data archive found in the package"
    
      return 1
    
  fi
    
      62
    
  # Check if all necessary files are present
    
  echo "Checking for required files..."
    
  if [ -d "opt/${pkgname%-bin}" ]; then
    
      find "opt/${pkgname%-bin}" -type f | head -20
    
  fi
    
      68
    
  # Fix wrapper script
    
  sed -e "
    
      s/@appname@/${pkgname%-bin}/g
    
      s/@runname@/${pkgname%-bin}/g
    
  " -i "${srcdir}/${pkgname%-bin}.sh"
    
      74
    
  # Fix desktop file
    
  if [ -f "usr/share/applications/${pkgname%-bin}.desktop" ]; then
    
      sed -e "
    
          s/\/opt\/${pkgname%-bin}\/launch.sh/${pkgname%-bin}/g
    
          s/\/opt\/${pkgname%-bin}\/logo.ico/${pkgname%-bin}/g
    
          5i\Categories=Network;
    
      " -i "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
  fi
    
      83
    
  # Convert icon
    
  if [ -f "opt/${pkgname%-bin}/logo.ico" ]; then
    
      magick "${srcdir}/opt/${pkgname%-bin}/logo.ico" "${srcdir}/${pkgname%-bin}.png"
    
  fi
    
      88
    
  # Extract nss-wrapper
    
  echo "Extracting nss-wrapper..."
    
  install -Dm755 -d "${srcdir}/libnss-wrapper"
    
  bsdtar -xf "libnss-wrapper-1.1.2.deb" -C "${srcdir}/libnss-wrapper"
    
  if [ -f "${srcdir}/libnss-wrapper/data.tar.xz" ]; then
    
      bsdtar -xf "${srcdir}/libnss-wrapper/data.tar.xz" -C "${srcdir}/libnss-wrapper"
    
  fi
    
  if [ -f "${srcdir}/libnss-wrapper/usr/lib/libnss_wrapper.so" ]; then
    
      install -Dm644 "${srcdir}/libnss-wrapper/usr/lib/libnss_wrapper.so" -t "${srcdir}/opt/${pkgname%-bin}/lib"
    
  fi
    
      99}
    
      100package() {
    
  # Install wrapper script
    
  install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      103
    
  # Copy all files from opt directory recursively
    
  if [ -d "${srcdir}/opt" ]; then
    
      cp -r "${srcdir}/opt" "${pkgdir}/"
    
      echo "Installed files from ${srcdir}/opt"
    
  fi
    
      109
    
  # Install desktop file
    
  if [ -f "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" ]; then
    
      install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
  fi
    
      114
    
  # Install icon
    
  if [ -f "${srcdir}/${pkgname%-bin}.png" ]; then
    
      install -Dm644 "${srcdir}/${pkgname%-bin}.png" -t "${pkgdir}/usr/share/pixmaps"
    
  fi
    
      119
    
  # Install license
    
  install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      122
    
  # Create compatibility symlink for libsasl2
    
  if [ ! -f "${pkgdir}/opt/${pkgname%-bin}/lib/libsasl2.so.2" ]; then
    
      ln -s /usr/lib/libsasl2.so.3 "${pkgdir}/opt/${pkgname%-bin}/lib/libsasl2.so.2"
    
  fi
    
      127
    
  # Verify installation
    
  echo "Verifying installation..."
    
  if [ -d "${pkgdir}/opt/${pkgname%-bin}" ]; then
    
      find "${pkgdir}/opt/${pkgname%-bin}" -type f | wc -l
    
  fi
    
      133}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2