moomoo-opend-bin

MEDIUM

maintainer liveopt 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary tarball (containing both a native OpenD daemon binary and an AppImage GUI) from softwaredownload.futustatic.com. This domain is Futu/Moomoo's official CDN/static asset host — 'futustatic.com' is used by Futu Securities (the company behind Moomoo) for software distribution, making this a legitimate official vendor host rather than a random personal server. However, the package still installs and executes prebuilt proprietary binaries (the OpenD daemon via cp -a and the AppImage) without any source build, which is the inherent nature of a -bin package. The sha256sum is pinned, which mitigates tampering risk. The concern is real but standard for binary AUR packages from proprietary vendors: users must trust the vendor's CDN. This is a medium-severity supply-chain concern (prebuilt binary from a vendor CDN, not open-source), but not clearly malicious or from an unofficial/unrelated host. The cheaper model's assessment of 'non-standard host' is partially incorrect — futustatic.com appears to be Futu's own CDN — but the underlying concern about executing prebuilt binaries remains valid at medium severity.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("${pkgname}-${pkgver}.tar.gz::https://softwaredownload.futustatic.com/moomoo_OpenD_${pkgver}_Ubuntu18.04.tar.gz")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball (containing both a native OpenD daemon binary and an AppImage GUI) from softwaredownload.futustatic.com. This domain is Futu/Moomoo's official CDN/static asset host — 'futustatic.com' is used by Futu Securities (the company behind Moomoo) for software distribution, making this a legitimate official vendor host rather than a random personal server. However, the package still installs and executes prebuilt proprietary binaries (the OpenD daemon via cp -a and the AppImage) without any source build, which is the inherent nature of a -bin package. The sha256sum is pinned, which mitigates tampering risk. The concern is real but standard for binary AUR packages from proprietary vendors: users must trust the vendor's CDN. This is a medium-severity supply-chain concern (prebuilt binary from a vendor CDN, not open-source), but not clearly malicious or from an unofficial/unrelated host. The cheaper model's assessment of 'non-standard host' is partially incorrect — futustatic.com appears to be Futu's own CDN — but the underlying concern about executing prebuilt binaries remains valid at medium severity.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=moomoo-opend-bin
    
      2pkgver=10.6.6608
    
      3pkgrel=1
    
      4pkgdesc="Moomoo OpenD command-line daemon and GUI"
    
      5arch=('x86_64')
    
      6url='https://openapi.moomoo.com/'
    
      7license=('custom:proprietary')
    
      8depends=('fuse2' 'gcc-libs' 'glibc' 'hicolor-icon-theme')
    
      9provides=('moomoo-opend' 'futu-opend')
    
      10conflicts=('moomoo-opend' 'futu-opend')
    
      11options=('!debug' '!strip')
    
      12source=("${pkgname}-${pkgver}.tar.gz::https://softwaredownload.futustatic.com/moomoo_OpenD_${pkgver}_Ubuntu18.04.tar.gz")
    
      13sha256sums=('73116d7ba5adaf4e3d3fb6aaefb66466d2604ad73260cf75accc1d349e169dc8')
    
      14
    
      15prepare() {
    
      16  local base="moomoo_OpenD_${pkgver}_Ubuntu18.04"
    
      17  local gui_src="$srcdir/$base/moomoo_OpenD-GUI_${pkgver}_Ubuntu18.04/moomoo_OpenD-GUI_${pkgver}_Ubuntu18.04.AppImage"
    
      18
    
      19  rm -rf "$srcdir/squashfs-root"
    
      20  (
    
      21    cd "$srcdir"
    
      22    "$gui_src" --appimage-extract moomoo_OpenD.png >/dev/null
    
      23  )
    
      24}
    
      25
    
      26package() {
    
      27  local base="moomoo_OpenD_${pkgver}_Ubuntu18.04"
    
      28  local install_dir="$pkgdir/opt/moomoo-opend"
    
      29  local opend_src="$srcdir/$base/$base"
    
      30  local gui_src="$srcdir/$base/moomoo_OpenD-GUI_${pkgver}_Ubuntu18.04/moomoo_OpenD-GUI_${pkgver}_Ubuntu18.04.AppImage"
    
      31
    
      32  install -dm755 "$install_dir" "$pkgdir/usr/bin" \
    
      33    "$pkgdir/usr/share/applications" "$pkgdir/usr/share/icons/hicolor/256x256/apps" \
    
      34    "$pkgdir/usr/share/doc/$pkgname"
    
      35
    
      36  cp -a "$opend_src" "$install_dir/opend"
    
      37  install -Dm755 "$gui_src" "$install_dir/moomoo-opend-gui.AppImage"
    
      38  install -Dm644 "$srcdir/$base/README.txt" "$pkgdir/usr/share/doc/$pkgname/README.txt"
    
      39  install -Dm644 "$opend_src/OpenD.xml" "$pkgdir/usr/share/doc/$pkgname/OpenD.xml.example"
    
      40
    
      41  cat > "$pkgdir/usr/bin/moomoo-opend" <<'EOF'
    
      42#!/usr/bin/env bash
    
      43set -euo pipefail
    
      44
    
      45install_dir=/opt/moomoo-opend/opend
    
      46config_dir="${XDG_CONFIG_HOME:-$HOME/.config}/moomoo-opend"
    
      47state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/moomoo-opend"
    
      48config_file="$config_dir/OpenD.xml"
    
      49
    
      50mkdir -p "$config_dir" "$state_dir/logs"
    
      51if [[ ! -f "$config_file" ]]; then
    
      52  cp "$install_dir/OpenD.xml" "$config_file"
    
      53  chmod 600 "$config_file"
    
      54fi
    
      55
    
      56cd "$install_dir"
    
      57exec ./OpenD -cfg_file="$config_file" -log_path="$state_dir/logs" "$@"
    
      58EOF
    
      59  chmod 755 "$pkgdir/usr/bin/moomoo-opend"
    
      60
    
      61  cat > "$pkgdir/usr/bin/moomoo-opend-gui" <<'EOF'
    
      62#!/usr/bin/env bash
    
      63exec /opt/moomoo-opend/moomoo-opend-gui.AppImage "$@"
    
      64EOF
    
      65  chmod 755 "$pkgdir/usr/bin/moomoo-opend-gui"
    
      66
    
      67  cat > "$pkgdir/usr/share/applications/moomoo-opend.desktop" <<EOF
    
      68[Desktop Entry]
    
      69Type=Application
    
      70Name=Moomoo OpenD
    
      71Comment=OpenAPI gateway for Moomoo
    
      72Exec=moomoo-opend-gui
    
      73Icon=moomoo-opend
    
      74Terminal=false
    
      75Categories=Office;Finance;
    
      76EOF
    
      77
    
      78  install -Dm644 "$srcdir/squashfs-root/moomoo_OpenD.png" \
    
      79    "$pkgdir/usr/share/icons/hicolor/256x256/apps/moomoo-opend.png"
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 19:40:31	Medium	2