mtxx-bin

maintainer sukanka · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt proprietary binaries (a .deb package containing the mtxx executable and bundled shared libraries) extracted and run directly on the user's system. The x86_64 source comes from home-store-packages.uniontech.com (the Deepin/UOS app store CDN, a plausible official distribution channel for this Chinese software) and the aarch64 source from xiuxiu.dl.meitu.com (Meitu's own download CDN, matching the upstream vendor). Both hosts are plausible official vendor CDNs rather than personal/random hosts, and sha512sums are provided for integrity verification. However, the concern is real: these are opaque prebuilt binaries from Chinese commercial vendors with no source code, no reproducibility, and the binaries are executed directly. The patchelf step modifies RPATH to load bundled libs from $ORIGIN, meaning the full binary blob runs with user trust. This is a genuine medium-risk supply-chain concern (prebuilt closed-source binary from a non-primary-project host), not a false positive, but there is no evidence of active malice or obfuscation beyond the inherent opacity of proprietary binaries.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("${_pkgname}-${pkgver}-amd64.deb::https://home-store-packages.uniontech.com/appstore/pool/appstore/c/com.meitu.mtxx/com.meitu.mtxx_${pkgver}_amd64.deb"
PKGBUILD:17 source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::https://xiuxiu.dl.meitu.com/com.meitu.mtxx_${pkgver}_aarch64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt proprietary binaries (a .deb package containing the mtxx executable and bundled shared libraries) extracted and run directly on the user's system. The x86_64 source comes from home-store-packages.uniontech.com (the Deepin/UOS app store CDN, a plausible official distribution channel for this Chinese software) and the aarch64 source from xiuxiu.dl.meitu.com (Meitu's own download CDN, matching the upstream vendor). Both hosts are plausible official vendor CDNs rather than personal/random hosts, and sha512sums are provided for integrity verification. However, the concern is real: these are opaque prebuilt binaries from Chinese commercial vendors with no source code, no reproducibility, and the binaries are executed directly. The patchelf step modifies RPATH to load bundled libs from $ORIGIN, meaning the full binary blob runs with user trust. This is a genuine medium-risk supply-chain concern (prebuilt closed-source binary from a non-primary-project host), not a false positive, but there is no evidence of active malice or obfuscation beyond the inherent opacity of proprietary binaries.

PKGBUILD

2 offending line(s) highlighted

      1#Maintainer: sukanka<su975853527 [AT] gmail.com>
    
      2
    
      3pkgname=('mtxx-bin')
    
      4_pkgname="mtxx"
    
      5pkgver=2.0.4
    
      6pkgrel=4
    
      7pkgdesc="美图秀秀, An image editing software that is mostly used in Mainland China"
    
      8provides=($_pkgname)
    
      9url="https://xiuxiu.web.meitu.com/"
    
      10arch=('x86_64' 'aarch64')
    
      11license=('unknown')
    
      12provides=("${_pkgname}")
    
      13depends=('hicolor-icon-theme' 'freeimage' 'qt5-webengine' 'openssl-1.1' 'jansson')
    
      14makedepends=('patchelf')
    
      15source_x86_64=("${_pkgname}-${pkgver}-amd64.deb::https://home-store-packages.uniontech.com/appstore/pool/appstore/c/com.meitu.mtxx/com.meitu.mtxx_${pkgver}_amd64.deb"
    
      16)
    
      17source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::https://xiuxiu.dl.meitu.com/com.meitu.mtxx_${pkgver}_aarch64.deb")
    
      18sha512sums_x86_64=('6c9bb0ae54914a5366413c74c3637b6f30917922e1b4d6f5935a5e8a3df81fcb17e111b6b2033bde2481b9162b02e6435384d3d58b831dc3a5883ffaa25b74c8')
    
      19sha512sums_aarch64=('517c5522861c4e96f85ec96b9c6fa4e4b30103804862f76407d93a788915f1d05dc3a797259f4fc58102d2d4a11bd4a67a7e01dbfa9feaf22512e427cb65a416')
    
      20options=(!strip)
    
      21prepare() {
    
      22    cd ${srcdir}
    
      23    tar -xJvf data.tar.xz -C "${srcdir}"
    
      24    cd opt/apps/com.meitu.mtxx/files/mtxx
    
      25    patchelf --add-rpath '$ORIGIN/../../lib/mtxx' mtxx
    
      26
    
      27    cd ${srcdir}/opt/apps/com.meitu.mtxx/entries
    
      28    rm -rf .DS_Store icons/.DS_Store
    
      29}
    
      30package() {
    
      31    cd ${srcdir}/opt/apps/com.meitu.mtxx
    
      32    mkdir ${pkgdir}/opt
    
      33    install -Dm755 files/mtxx/{libMT*,libavro.so.23} -t ${pkgdir}/usr/lib/${_pkgname}
    
      34    cp -rf entries ${pkgdir}/usr/share
    
      35    rm -rf files/mtxx/lib*
    
      36    cp -rf files/mtxx ${pkgdir}/opt/${_pkgname}
    
      37
    
      38    cd ${pkgdir}/usr/share/applications/
    
      39
    
      40    sed -i "s|^Exec=.*|Exec=${_pkgname} %U|g" com.meitu.mtxx.desktop
    
      41    sed -i "s|^Icon=.*|Icon=${_pkgname}|g" com.meitu.mtxx.desktop
    
      42
    
      43    cd ${pkgdir}/opt/${_pkgname}
    
      44    rm *.sh mosaicpen/*.txt .DS_Store env post* *.pem
    
      45
    
      46    mkdir ${pkgdir}/usr/bin
    
      47    ln -s /opt/${_pkgname}/${_pkgname} ${pkgdir}/usr/bin/${_pkgname}
    
      48
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2