mcloud-electron

LOW

maintainer Yueyuri 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a plausibly official host (yun.mcloud.139.com) associated with the service, extracts and repackages it with minor cleanup; while the host is not a standard forge, it is specific to the vendor, and the actions are transparent with no obfuscation or remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from a plausibly official host (yun.mcloud.139.com) associated with the service, extracts and repackages it with minor cleanup; while the host is not a standard forge, it is specific to the vendor, and the actions are transparent with no obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://yun.mcloud.139.com/mCloudPc/kylinV${kylinv}/com.cmic.mcloud_${pkgver}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yueyuri <lxf74663@gmail.com>
    
      2pkgname=mcloud-electron
    
      3pkgver=1.1.2
    
      4kylinv=112
    
      5pkgrel=1
    
      6pkgdesc="中国移动云盘 (麒麟桌面版)"
    
      7arch=('x86_64')
    
      8url="https://yun.139.com/"
    
      9license=('custom')
    
      10depends=('gtk3' 'nss' 'alsa-lib' 'qt5-base' 'qt5-multimedia' 'hicolor-icon-theme')
    
      11provides=('mcloud-bin')
    
      12conflicts=('mcloud-bin')
    
      13source=("https://yun.mcloud.139.com/mCloudPc/kylinV${kylinv}/com.cmic.mcloud_${pkgver}_amd64.deb"
    
      14        "com.cmic.mcloud.desktop")
    
      15sha256sums=('11c74e59cd2b43985d0bdf013ee553b1442c0f733748fe8673eba7bc54899485'
    
      16            '07b9790021968e4372018ac925e13c38780dab20c472adf24fccbe9238a13299')
    
      17
    
      18prepare() {
    
      19    bsdtar -xf data.tar.xz -C "${srcdir}" --exclude="*icons_mac*"
    
      20}
    
      21
    
      22package() {
    
      23    local _app_dir="${pkgdir}/opt/mcloud"
    
      24    install -d "$_app_dir"
    
      25    cp -a "${srcdir}/opt/apps/com.cmic.mcloud/"* "$_app_dir/"
    
      26
    
      27    local _process_dir="$_app_dir/processes"
    
      28    local _unpacked_dir="$_app_dir/resources/app.asar.unpacked"
    
      29
    
      30    rm -f "$_process_dir"/libQt5*.so*
    
      31    rm -f "$_process_dir"/libicu*.so*
    
      32    rm -rf "$_unpacked_dir/node_modules/phantomjs-prebuilt"
    
      33    rm -rf "$_unpacked_dir/node_modules/zip-7z/bin/MacOS"
    
      34    rm -rf "$_unpacked_dir/node_modules/zip-7z/src"
    
      35    rm -rf "$_unpacked_dir/resources/icons_mac"
    
      36    rm -rf "$_unpacked_dir/resources/uos"*
    
      37    rm -f "$_app_dir"/plugins/*.dll "$_app_dir"/plugins/*.exp "$_app_dir"/plugins/*.lib
    
      38
    
      39    chmod -R 755 "$_process_dir"
    
      40
    
      41    install -Dm644 "${srcdir}/usr/share/icons/hicolor/512x512/apps/com.cmic.mcloud.png" \
    
      42        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/com.cmic.mcloud.png"
    
      43
    
      44    install -Dm644 "${srcdir}/com.cmic.mcloud.desktop" \
    
      45        "${pkgdir}/usr/share/applications/com.cmic.mcloud.desktop"
    
      46
    
      47    install -Dm644 "${srcdir}/opt/apps/com.cmic.mcloud/LICENSE.electron.txt" \
    
      48        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      49
    
      50    install -d "${pkgdir}/usr/bin"
    
      51    cat << 'EOF' > "${pkgdir}/usr/bin/mcloud"
    
      52#!/bin/bash
    
      53
    
      54# 禁用 core dump
    
      55ulimit -c 0
    
      56
    
      57REAL_HOME="${HOME}"
    
      58DATA_DIR="${XDG_DATA_HOME:-$REAL_HOME/.local/share}"
    
      59MCLOUD_SANDBOX="$DATA_DIR/mcloud_env"
    
      60RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp}"
    
      61TMP_LOG_DIR="$RUNTIME_DIR/mcloud-logs"
    
      62
    
      63mkdir -p "$MCLOUD_SANDBOX/mCloud"
    
      64mkdir -p "$TMP_LOG_DIR"
    
      65
    
      66LOG_DIR="$MCLOUD_SANDBOX/mCloud/log"
    
      67if [ -d "$LOG_DIR" ] && [ ! -L "$LOG_DIR" ]; then
    
      68    rm -rf "$LOG_DIR"
    
      69fi
    
      70ln -sfn "$TMP_LOG_DIR" "$LOG_DIR"
    
      71
    
      72export HOME="$MCLOUD_SANDBOX"
    
      73export XDG_CONFIG_HOME="$MCLOUD_SANDBOX/.config"
    
      74export XDG_DATA_HOME="$MCLOUD_SANDBOX/.local/share"
    
      75export XDG_CACHE_HOME="$MCLOUD_SANDBOX/.cache"
    
      76
    
      77exec /opt/mcloud/mcloud "$@"
    
      78EOF
    
      79    chmod 755 "${pkgdir}/usr/bin/mcloud"
    
      80}
    
      81

Changes since previous scan

--- PKGBUILD @ 2026-10-24 00:14
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,9 +1,9 @@
 # Maintainer: Yueyuri <lxf74663@gmail.com>
 pkgname=mcloud-electron
-pkgver=1.1.1
-kylinv=111
-pkgrel=4
-pkgdesc="中国移动云盘"
+pkgver=1.1.2
+kylinv=112
+pkgrel=1
+pkgdesc="中国移动云盘 (麒麟桌面版)"
 arch=('x86_64')
 url="https://yun.139.com/"
 license=('custom')
@@ -11,29 +11,30 @@
 provides=('mcloud-bin')
 conflicts=('mcloud-bin')
 source=("https://yun.mcloud.139.com/mCloudPc/kylinV${kylinv}/com.cmic.mcloud_${pkgver}_amd64.deb"
-        "com.cmic.mcloud.desktop"
-        "mcloud-wrapper"
-        "mcloud.install")
-sha256sums=('0e28a7fe6125e32c06e27c3b7645acb3bf1e90decadc36327bbb79916aa6f4b0'
-            '21533e55013e63467e4c5be4332600b7c8a98bf9df3181e9ddc57c2bee7deb08'
-            'd26f5d10556bad47b1a0380399a486ff1cb58361fd8aa85d22bd19457f8c53b1'
-            'be4ae686e2e809ba03bd5976a0561e88a7b7b6cddee8011f486b3335c713075c')
-
-install="mcloud.install"
+        "com.cmic.mcloud.desktop")
+sha256sums=('11c74e59cd2b43985d0bdf013ee553b1442c0f733748fe8673eba7bc54899485'
+            '07b9790021968e4372018ac925e13c38780dab20c472adf24fccbe9238a13299')
 
 prepare() {
-    tar -xf data.tar.xz -C "${srcdir}" --exclude="*icons_mac*"
+    bsdtar -xf data.tar.xz -C "${srcdir}" --exclude="*icons_mac*"
 }
 
 package() {
-    install -d "${pkgdir}/opt/apps/com.cmic.mcloud"
-    cp -a "${srcdir}/opt/apps/com.cmic.mcloud/"* "${pkgdir}/opt/apps/com.cmic.mcloud/"
+    local _app_dir="${pkgdir}/opt/mcloud"
+    install -d "$_app_dir"
+    cp -a "${srcdir}/opt/apps/com.cmic.mcloud/"* "$_app_dir/"
 
-    local _process_dir="${pkgdir}/opt/apps/com.cmic.mcloud/processes"
-    local _plugin_dir="${pkgdir}/opt/apps/com.cmic.mcloud/plugins"
+    local _process_dir="$_app_dir/processes"
+    local _unpacked_dir="$_app_dir/resources/app.asar.unpacked"
 
     rm -f "$_process_dir"/libQt5*.so*
     rm -f "$_process_dir"/libicu*.so*
+    rm -rf "$_unpacked_dir/node_modules/phantomjs-prebuilt"
+    rm -rf "$_unpacked_dir/node_modules/zip-7z/bin/MacOS"
+    rm -rf "$_unpacked_dir/node_modules/zip-7z/src"
+    rm -rf "$_unpacked_dir/resources/icons_mac"
+    rm -rf "$_unpacked_dir/resources/uos"*
+    rm -f "$_app_dir"/plugins/*.dll "$_app_dir"/plugins/*.exp "$_app_dir"/plugins/*.lib
 
     chmod -R 755 "$_process_dir"
 
@@ -46,6 +47,35 @@
     install -Dm644 "${srcdir}/opt/apps/com.cmic.mcloud/LICENSE.electron.txt" \
         "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 
-    install -Dm755 "${srcdir}/mcloud-wrapper" "${pkgdir}/usr/bin/mcloud"
+    install -d "${pkgdir}/usr/bin"
+    cat << 'EOF' > "${pkgdir}/usr/bin/mcloud"
+#!/bin/bash
+
+# 禁用 core dump
+ulimit -c 0
+
+REAL_HOME="${HOME}"
+DATA_DIR="${XDG_DATA_HOME:-$REAL_HOME/.local/share}"
+MCLOUD_SANDBOX="$DATA_DIR/mcloud_env"
+RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp}"
+TMP_LOG_DIR="$RUNTIME_DIR/mcloud-logs"
+
+mkdir -p "$MCLOUD_SANDBOX/mCloud"
+mkdir -p "$TMP_LOG_DIR"
+
+LOG_DIR="$MCLOUD_SANDBOX/mCloud/log"
+if [ -d "$LOG_DIR" ] && [ ! -L "$LOG_DIR" ]; then
+    rm -rf "$LOG_DIR"
+fi
+ln -sfn "$TMP_LOG_DIR" "$LOG_DIR"
+
+export HOME="$MCLOUD_SANDBOX"
+export XDG_CONFIG_HOME="$MCLOUD_SANDBOX/.config"
+export XDG_DATA_HOME="$MCLOUD_SANDBOX/.local/share"
+export XDG_CACHE_HOME="$MCLOUD_SANDBOX/.cache"
+
+exec /opt/mcloud/mcloud "$@"
+EOF
+    chmod 755 "${pkgdir}/usr/bin/mcloud"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 03:39:05	Medium	1
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2