mianling-apply-bin

MEDIUM

maintainer wearzdk 0 votes scanned 2026-08-29 19:43:53.119755

View on AUR

Why flagged

Downloads and installs a prebuilt proprietary binary from a non-standard personal/company storage host (storage2.maoertech.cn) that is not an established official release infrastructure; while the checksum is provided and the maintainer claims it is the project's own CI, the host is a personal object store that could be silently swapped, making this a typical unverifiable prebuilt binary scenario.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("mianling-apply-${pkgver}-amd64.deb::https://storage2.maoertech.cn/job-apply/mianling-apply-${pkgver}-amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and installs a prebuilt proprietary binary from a non-standard personal/company storage host (storage2.maoertech.cn) that is not an established official release infrastructure; while the checksum is provided and the maintainer claims it is the project's own CI, the host is a personal object store that could be silently swapped, making this a typical unverifiable prebuilt binary scenario.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mianling AI <karentia@maoertech.cn>
    
      2#
    
      3# 面灵网申是闭源产品，安装包不放 GitHub Releases，而是由发版 CI 构建后上传到自有
    
      4# storage（storage2.maoertech.cn），下载 URL 由版本号确定性推导。所以本包是
    
      5# 「重打包预编译产物」的 -bin 包：下载官方 .deb，把里面的文件装进系统。
    
      6#
    
      7# pkgver 与 sha256sums 由发版工作流（.github/workflows/apply-release.yml 的
    
      8# publish-aur 任务）在每次 apply-v* tag 发布时自动改写并推送到 AUR，不要手改。
    
      9pkgname=mianling-apply-bin
    
      10pkgver=0.1.1
    
      11pkgrel=1
    
      12pkgdesc="面灵网申 — 校招网申助手：一处填好档案，打开投递页自动填好重复字段，最后一步由你点"
    
      13arch=('x86_64')
    
      14url="https://www.mianlingai.com/job-apply"
    
      15license=('LicenseRef-proprietary')
    
      16# webkit2gtk-4.1 会带来 gtk3 / libsoup3，但二进制直接链接 gtk3，所以显式列出。
    
      17# 没有托盘图标，因此不需要 libayatana-appindicator。
    
      18depends=('webkit2gtk-4.1' 'gtk3')
    
      19provides=('mianling-apply')
    
      20conflicts=('mianling-apply')
    
      21# 预编译二进制，禁止 strip / 重新打包，避免破坏官方产物。
    
      22options=('!strip')
    
      23install="${pkgname}.install"
    
      24source=("mianling-apply-${pkgver}-amd64.deb::https://storage2.maoertech.cn/job-apply/mianling-apply-${pkgver}-amd64.deb")
    
      25noextract=("mianling-apply-${pkgver}-amd64.deb")
    
      26sha256sums=('d014bedd759f1e28d78de5f6b9ebe35050ccff477a2b402b0741d1d024e7c51e')
    
      27
    
      28package() {
    
      29  cd "$srcdir"
    
      30  # .deb 是 ar 归档，libarchive(bsdtar) 能直接拆；再解内层 data.tar.*。
    
      31  bsdtar -xf "mianling-apply-${pkgver}-amd64.deb"
    
      32  bsdtar -xf data.tar.*
    
      33
    
      34  # 官方 .deb 里所有文件名已经是 mianling-apply（Tauri 的 productName 在
    
      35  # src-tauri/tauri.linux.conf.json 里就是这个），不需要改名，原样搬过来即可。
    
      36  install -Dm755 "usr/bin/mianling-apply" "$pkgdir/usr/bin/mianling-apply"
    
      37  install -Dm644 "usr/share/applications/mianling-apply.desktop" \
    
      38    "$pkgdir/usr/share/applications/mianling-apply.desktop"
    
      39
    
      40  # 图标尺寸以 .deb 里实际有的为准，别写死一份清单——Tauri 换了图标配置就会对不上。
    
      41  for icon in usr/share/icons/hicolor/*/apps/mianling-apply.png; do
    
      42    [[ -e "$icon" ]] || continue
    
      43    install -Dm644 "$icon" "$pkgdir/$icon"
    
      44  done
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-29 19:43:53	Medium	3
2026-08-29 19:40:31	Medium	3