mworks-syslab

maintainer insmtr · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a proprietary .run installer from the official vendor's release domain (releases.tongyuan.cc), extracts and installs it locally; this is a standard method for distributing closed-source software and does not involve executing untrusted remote code or obfuscated payloads.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a proprietary .run installer from the official vendor's release domain (releases.tongyuan.cc), extracts and installs it locally; this is a standard method for distributing closed-source software and does not involve executing untrusted remote code or obfuscated payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("https://releases.tongyuan.cc/installer/syslab/${_release}/${_runfile}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: insmtr <insmtr@insmtr.cn>
    
      2
    
      3pkgname=mworks-syslab
    
      4pkgver=26.2.0
    
      5pkgrel=1
    
      6pkgdesc="MWORKS.Syslab 是新一代科学计算环境，旨在为算法开发、数值计算、数据分析和可视化、信息域计算分析等提供通用编程开发环境"
    
      7arch=('x86_64')
    
      8url="https://www.tongyuan.cc/"
    
      9license=('custom:proprietary')
    
      10
    
      11# 软件自带 Qt / Julia / Python，但仍依赖系统的 X11 / GLX / 音频 / 无障碍等库
    
      12depends=(
    
      13    'libx11' 'libxcb' 'libxcomposite' 'libxcursor' 'libxdamage' 'libxext' 'libxfixes' 'libxi' 'libxkbcommon' 'libxrandr' 'libxrender' 'libxtst'
    
      14    'mesa' 'nss' 'nspr' 'at-spi2-core' 'alsa-lib' 'gtk3' 'glib2'
    
      15)
    
      16optdepends=('qt5-tools: 在 KDE 下注册文件类型关联')
    
      17makedepends=('patchelf')
    
      18
    
      19options=('!debug' '!strip' '!emptydirs')
    
      20install="${pkgname}.install"
    
      21
    
      22_release="2026a"
    
      23_build="7202"
    
      24_runfile="MWORKS.Syslab-${_release}-${pkgver}.${_build}-linux-x64.run"
    
      25
    
      26source=("https://releases.tongyuan.cc/installer/syslab/${_release}/${_runfile}"
    
      27        "fix_checksum.py"
    
      28        "mworks-syslab-help.desktop")
    
      29noextract=("${_runfile}")
    
      30sha256sums=('b7a1408ca0a9577a7c359c05d2b8224781d95bc9a8ad5d2d30aea726d84c6338'
    
      31            'c67aa1f73ccacaced6f916698d82e3d13c7e5f03386469bb2bd914e11f823931'
    
      32            '4c275314d8c61945c6596d8bc809992f49b243ec64fe72dd71ffeeb52a166b56')
    
      33
    
      34_instdir="/opt/mworks-syslab"
    
      35
    
      36prepare() {
    
      37    msg2 "从 .run 安装包中提取内嵌归档..."
    
      38    sed -n '1,/^exit 0$/!p' "${srcdir}/${_runfile}" > "${srcdir}/syslab.tar.gz"
    
      39}
    
      40
    
      41package() {
    
      42    install -dm755 "${pkgdir}${_instdir}"
    
      43    msg2 "正在解压归档，请稍候..."
    
      44    tar --blocking-factor=255209 -xf "${srcdir}/syslab.tar.gz" -C "${pkgdir}${_instdir}" --touch 2>/dev/null
    
      45
    
      46    # 清除所有共享库的可执行栈标记（GNU_STACK RWE），Arch 内核默认拒绝该权限
    
      47    msg2 "清除共享库可执行栈标记..."
    
      48    find "${pkgdir}${_instdir}" -name '*.so*' -type f -exec patchelf --clear-execstack {} \; 2>/dev/null
    
      49
    
      50    # 替换脚本中 conda 的安装路径
    
      51    sed -i "s|/usr/local/share/TongYuan|${_instdir}|g" "${pkgdir}${_instdir}/.julia/miniforge3/bin/conda"
    
      52
    
      53    # 删除仅供 CentOS 使用的 libxkbcommon-x11 库，Arch 自带该库
    
      54    local _pyqt_lib="${pkgdir}${_instdir}/.julia/miniforge3/lib/python3.11/site-packages/PyQt5/Qt/lib"
    
      55    rm -f "${_pyqt_lib}/libxkbcommon-x11.so.0"
    
      56    rm -f "${_pyqt_lib}/libxkbcommon-x11.so.0.0.0"
    
      57
    
      58    # Julia 本地包注册（Pkg.develop）
    
      59    msg2 "注册内置 Julia 本地包..."
    
      60    local _julia_bin="${pkgdir}${_instdir}/Tools/julia-1.10.10/bin/julia"
    
      61    JULIA_DEPOT_PATH="${pkgdir}${_instdir}/.julia" \
    
      62    JULIA_CONDAPKG_BACKEND=Null \
    
      63    PYTHON_JULIAPKG_OFFLINE=yes \
    
      64        "${_julia_bin}" "${pkgdir}${_instdir}/Install/config/dev_libraries.jl" \
    
      65        "${pkgdir}${_instdir}"
    
      66    # Pkg.develop 在 Manifest.toml 中写入含 pkgdir 前缀的绝对路径，需替换为安装路径
    
      67    sed -i "s|${pkgdir}||g" "${pkgdir}${_instdir}/.julia/environments/v1.10/Manifest.toml"
    
      68
    
      69    # 删除 Julia 包管理器运行时日志
    
      70    rm -rf "${pkgdir}${_instdir}/.julia/logs"
    
      71
    
      72    # desktop.sh 硬编码了 gnome-terminal，非 GNOME 环境下不可用
    
      73    sed -i 's/^gnome-terminal -- //' "${pkgdir}${_instdir}/Bin/desktop.sh"
    
      74
    
      75    # 修复"关于"对话框无法关闭的问题：
    
      76    # Arch Linux 的 /etc/os-release 没有 VERSION_ID 字段，
    
      77    # lines.find(...'VERSION_ID').replace() 返回 undefined 直接调 .replace() 抛异常，
    
      78    # 导致后续所有 addEventListener 包括关闭按钮都未执行
    
      79    sed -i \
    
      80        "s/lines\.find(line => line\.startsWith('VERSION_ID'))\.replace(/( lines.find(line => line.startsWith('VERSION_ID')) || 'VERSION_ID=').replace(/g" \
    
      81        "${pkgdir}${_instdir}/Bin/resources/app/out/vs/workbench/workbench.desktop.main.js"
    
      82
    
      83    # 修复因上面 patch 导致的完整性校验失败（每次启动时右下角弹出「安装似乎损坏」提示）：
    
      84    # VS Code 在 product.json 存储核心文件的 md5-base64 校验值，patch 后需要更新
    
      85    local _product="${pkgdir}${_instdir}/Bin/resources/app/product.json"
    
      86    local _mainjs="${pkgdir}${_instdir}/Bin/resources/app/out/vs/workbench/workbench.desktop.main.js"
    
      87    python3 "${srcdir}/fix_checksum.py" "$_product" "$_mainjs"
    
      88
    
      89    # 注入 QT_QPA_PLATFORM=xcb，避免每次全新启动 Julia 终端后，调用绘图函数时输出 Wayland 插件缺失警告
    
      90    # Syslab 设置 JULIA_DEPOT_PATH=$HOME/TongYuan/.julia:...(system)，Julia 只从首条目加载 用户级 startup.jl，故需写入随 Julia 二进制分发的系统级 startup.jl
    
      91    echo 'ENV["QT_QPA_PLATFORM"] = "xcb"' >> "${pkgdir}${_instdir}/Tools/julia-1.10.10/etc/julia/startup.jl"
    
      92
    
      93    # 帮助文档快捷方式（Syslab 帮助中心在 Linux 上存在 bug 无法工作，提供独立 .desktop 入口，直接用系统浏览器打开静态文档页面）
    
      94    install -Dm644 "${srcdir}/mworks-syslab-help.desktop" "${pkgdir}/usr/share/applications/${pkgname}-help.desktop"
    
      95
    
      96    # 许可证占位
    
      97    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      98    echo "MWORKS.Syslab 是同元软控（TongYuan Co., Ltd.）的专有软件。" > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      99}
    
      100

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2