mianling-apply-bin

MEDIUM

maintainer wearzdk 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt .deb binary from a non-standard, non-whitelisted host (storage2.maoertech.cn), which is under the maintainer's control and could be silently swapped; this constitutes a supply-chain risk as the binary is not built from source and originates from an unverifiable location.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("mianling-apply-${pkgver}-amd64.deb::https://storage2.maoertech.cn/job-apply/mianling-apply-${pkgver}-amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-standard, non-whitelisted host (storage2.maoertech.cn), which is under the maintainer's control and could be silently swapped; this constitutes a supply-chain risk as the binary is not built from source and originates from an unverifiable location.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mianling AI <karentia@maoertech.cn>
    
      2#
    
      3# 面灵网申助手是闭源产品，安装包不放 GitHub Releases，而是由发版 CI 构建后上传到自有
    
      4# storage（storage2.maoertech.cn），下载 URL 由版本号确定性推导。所以本包是
    
      5# 「重打包预编译产物」的 -bin 包：下载官方 .deb，把里面的文件装进系统。
    
      6#
    
      7# pkgver 与 sha256sums 由发版工作流（.github/workflows/apply-release.yml 的
    
      8# publish-aur 任务）在每次 apply-v* tag 发布时自动改写并推送到 AUR，不要手改。
    
      9pkgname=mianling-apply-bin
    
      10pkgver=0.2.6
    
      11pkgrel=1
    
      12pkgdesc="面灵网申助手 — 校招网申自动填表：一处填好档案，打开投递页自动填好重复字段，最后一步由你点"
    
      13arch=('x86_64')
    
      14url="https://www.mianlingai.com/job-apply"
    
      15license=('LicenseRef-proprietary')
    
      16# webkit2gtk-4.1 会带来 gtk3 / libsoup3，但二进制直接链接 gtk3，所以显式列出。
    
      17# 没有托盘图标，因此不需要 libayatana-appindicator。
    
      18depends=('webkit2gtk-4.1' 'gtk3')
    
      19provides=('mianling-apply')
    
      20conflicts=('mianling-apply')
    
      21# 预编译二进制，禁止 strip / 重新打包，避免破坏官方产物。
    
      22# `!debug` 是必须的：makepkg 默认开 debug，会在包里留一个空的
    
      23# /usr/src/debug/mianling-apply-bin/ —— 对一个不带调试符号的 -bin 包毫无意义，
    
      24# 只是往用户系统里塞一个由本包拥有的空目录（0.1.1 装出来实测有）。
    
      25options=('!strip' '!debug')
    
      26install="${pkgname}.install"
    
      27source=("mianling-apply-${pkgver}-amd64.deb::https://storage2.maoertech.cn/job-apply/mianling-apply-${pkgver}-amd64.deb")
    
      28noextract=("mianling-apply-${pkgver}-amd64.deb")
    
      29sha256sums=('9ad2748d06f8eabb1c97b6e7742eb51812db35492e30182d8c72ea1a799c7f82')
    
      30
    
      31package() {
    
      32  cd "$srcdir"
    
      33  # .deb 是 ar 归档，libarchive(bsdtar) 能直接拆；再解内层 data.tar.*。
    
      34  bsdtar -xf "mianling-apply-${pkgver}-amd64.deb"
    
      35  bsdtar -xf data.tar.*
    
      36
    
      37  # 官方 .deb 里所有文件名已经是 mianling-apply（Tauri 的 productName 在
    
      38  # src-tauri/tauri.linux.conf.json 里就是这个），不需要改名，原样搬过来即可。
    
      39  install -Dm755 "usr/bin/mianling-apply" "$pkgdir/usr/bin/mianling-apply"
    
      40  install -Dm644 "usr/share/applications/mianling-apply.desktop" \
    
      41    "$pkgdir/usr/share/applications/mianling-apply.desktop"
    
      42
    
      43  # 图标尺寸以 .deb 里实际有的为准，别写死一份清单——Tauri 换了图标配置就会对不上。
    
      44  for icon in usr/share/icons/hicolor/*/apps/mianling-apply.png; do
    
      45    [[ -e "$icon" ]] || continue
    
      46    install -Dm644 "$icon" "$pkgdir/$icon"
    
      47  done
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-10-15 00:28
+++ PKGBUILD @ 2026-10-17 00:21
@@ -7,7 +7,7 @@
 # pkgver 与 sha256sums 由发版工作流（.github/workflows/apply-release.yml 的
 # publish-aur 任务）在每次 apply-v* tag 发布时自动改写并推送到 AUR，不要手改。
 pkgname=mianling-apply-bin
-pkgver=0.2.5
+pkgver=0.2.6
 pkgrel=1
 pkgdesc="面灵网申助手 — 校招网申自动填表：一处填好档案，打开投递页自动填好重复字段，最后一步由你点"
 arch=('x86_64')
@@ -26,7 +26,7 @@
 install="${pkgname}.install"
 source=("mianling-apply-${pkgver}-amd64.deb::https://storage2.maoertech.cn/job-apply/mianling-apply-${pkgver}-amd64.deb")
 noextract=("mianling-apply-${pkgver}-amd64.deb")
-sha256sums=('8f64f3fca6d4103c072c3254e66b6619d87414a0aa3efaa473ecca979f7e82ac')
+sha256sums=('9ad2748d06f8eabb1c97b6e7742eb51812db35492e30182d8c72ea1a799c7f82')
 
 package() {
   cd "$srcdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 17:12:54	Medium	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2