onenet-lua-script-debugger-wine

maintainer taotieren · 0 votes · base onenet-debugger-tool-wine · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt Windows PE executables (.exe files inside .rar/.zip archives) from upfiles.heclouds.com, which is the file hosting subdomain of China Mobile's OneNET IoT platform (10086.cn/heclouds.com). This is the official vendor's own file hosting infrastructure, not a random personal host, so the supply-chain risk is lower than the cheaper model implied. However, the binaries are still closed-source, prebuilt Windows executables executed via Wine with no source code available for inspection. The sha256 checksums are present and verified. The main residual concern is that one URL (simulate-device.rar) lacks a content-addressed path (no hash in the URL), meaning the file could be silently replaced server-side without changing the URL, though the sha256 check would catch this at build time. Overall this is a legitimate vendor tool packaged for Wine with standard checksums, but the execution of opaque prebuilt binaries from a CDN path that is not content-addressed represents a genuine medium-level supply-chain concern rather than a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("onenet-edpproto-debugger-wine-${pkgver}.rar::https://upfiles.heclouds.com/123/ueditor/2016/09/26/99dd0b18908b05a2f74588d5c9217957.rar"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads prebuilt Windows PE executables (.exe files inside .rar/.zip archives) from upfiles.heclouds.com, which is the file hosting subdomain of China Mobile's OneNET IoT platform (10086.cn/heclouds.com). This is the official vendor's own file hosting infrastructure, not a random personal host, so the supply-chain risk is lower than the cheaper model implied. However, the binaries are still closed-source, prebuilt Windows executables executed via Wine with no source code available for inspection. The sha256 checksums are present and verified. The main residual concern is that one URL (simulate-device.rar) lacks a content-addressed path (no hash in the URL), meaning the file could be silently replaced server-side without changing the URL, though the sha256 check would catch this at build time. Overall this is a legitimate vendor tool packaged for Wine with standard checksums, but the execution of opaque prebuilt binaries from a CDN path that is not content-addressed represents a genuine medium-level supply-chain concern rather than a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgbase=onenet-debugger-tool-wine
    
      4pkgname=($pkgbase onenet-edpproto-debugger-wine onenet-mqtt-device-debugger-wine onenet-lua-script-debugger-wine)
    
      5pkgver=1.0.0
    
      6pkgrel=1
    
      7arch=('x86_64')
    
      8url='https://open.iot.10086.cn/doc/art433.html#118'
    
      9license=('Custom')
    
      10provides=()
    
      11#conflicts=()
    
      12depends=('bash' 'wine' 'wqy-zenhei')
    
      13makedepends=('libarchive' 'unarchiver')
    
      14optdepends=("wine-mono-gecko-version-fix: Fix the version numbers of wine-mono and wine-gecko files to solve the dialog box that pops up when starting wine.")
    
      15
    
      16source=("onenet-edpproto-debugger-wine-${pkgver}.rar::https://upfiles.heclouds.com/123/ueditor/2016/09/26/99dd0b18908b05a2f74588d5c9217957.rar"
    
      17        "onenet-mqtt-device-debugger-wine-${pkgver}.rar::https://upfiles.heclouds.com/123/tools/simulate-device.rar"
    
      18        "onenet-lua-script-debugger-wine-${pkgver}.zip::https://upfiles.heclouds.com/123/ueditor/2017/04/05/d7ed57e61270a67f640338cb6a00a4b4.zip"
    
      19        "onenet-edpproto-debugger-wine.install"
    
      20        "onenet-mqtt-device-debugger-wine.install"
    
      21        "onenet-lua-script-debugger-wine.install"
    
      22        )
    
      23
    
      24sha256sums=('2337d7a979b47b027cf1082910d17a9ffd2b05ac14ede8407aeab77c94bdf797'
    
      25            'e6b181fb7194cabbebbd2537496fdaa95d440b9b96660774d5bc33091502f0a0'
    
      26            '0d9d39ab285e7679b61ebe4020726ea9f058a63385d10098f1342b9942c0035a'
    
      27            'd64b11e05aa8e4511e418bec1f320f498edf167753a02d5be697be4c8bf4982d'
    
      28            '065acc7e612cf863890945c8c6f1e27770024217979436d1174bbf8c0ca85d01'
    
      29            'be6e6b4c5f331e770511c5d147b03aa79e3602255cf0f3bb23a58a317846e530')
    
      30
    
      31noextract=(onenet-edpproto-debugger-wine-${pkgver}.rar onenet-mqtt-device-debugger-wine-${pkgver}.rar onenet-lua-script-debugger-wine-${pkgver}.zip)
    
      32
    
      33prepare() {
    
      34    _ftname="wqy-zenhei.ttc"
    
      35    install -Dm0644 /dev/stdin "${srcdir}/regpatch.reg" << EOF
    
      36REGEDIT4
    
      37
    
      38[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink]
    
      39"Lucida Sans Unicode"="${_ftname}"
    
      40"Microsoft Sans Serif"="${_ftname}"
    
      41"MS Sans Serif"="${_ftname}"
    
      42"Tahoma"="${_ftname}"
    
      43"Tahoma Bold"="${_ftname}"
    
      44"SimSun"="${_ftname}"
    
      45"Arial"="${_ftname}"
    
      46"Arial Black"="${_ftname}"
    
      47"Lucida Sans Unicode"=str(7):"${_ftname}"
    
      48"Microsoft Sans Serif"=str(7):"${_ftname}"
    
      49"Tahoma"=str(7):"${_ftname}"
    
      50"Lucida Sans Unicode"="${_ftname}"
    
      51"Microsoft Sans Serif"="${_ftname}"
    
      52"Microsoft YaHei"="${_ftname}"
    
      53"微软雅黑"="${_ftname}"
    
      54"宋体"="${_ftname}"
    
      55"新細明體"="${_ftname}"
    
      56"DFKai-SB"="${_ftname}"
    
      57"FangSong"="${_ftname}"
    
      58"KaiTi"="${_ftname}"
    
      59"Microsoft JhengHei"="${_ftname}"
    
      60"Microsoft YaHei"="${_ftname}"
    
      61"MingLiU"="${_ftname}"
    
      62"NSimSun"="${_ftname}"
    
      63"PMingLiU"="${_ftname}"
    
      64"SimHei"="${_ftname}"
    
      65"SimKai"="${_ftname}"
    
      66"SimSun"="${_ftname}"
    
      67
    
      68[HKEY_CURRENT_USER\Software\Wine\X11 Driver]
    
      69"ClientSideAntiAliasWithCore"="N"
    
      70"ClientSideAntiAliasWithRender"="N"
    
      71"ClientSideWithRender"="N"
    
      72
    
      73[HKEY_CURRENT_USER\Control Panel\Desktop]
    
      74"FontSmoothing"="2"
    
      75"FontSmoothingType"=dword:00000002
    
      76"FontSmoothingGamma"=dword:00000578
    
      77"FontSmoothingOrientation"=dword:00000001
    
      78
    
      79[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion]
    
      80"RegisteredOrganization"="OneNET"
    
      81"RegisteredOwner"="OneNET"
    
      82EOF
    
      83
    
      84}
    
      85
    
      86package_onenet-debugger-tool-wine() {
    
      87    pkgdesc="Wine OneNET EdpProto MQTT Lua 调试工具，设备模拟器，运行环境Win7+"
    
      88    depends=(onenet-edpproto-debugger-wine onenet-mqtt-device-debugger-wine onenet-lua-script-debugger-wine)
    
      89}
    
      90
    
      91package_onenet-edpproto-debugger-wine() {
    
      92    pkgdesc="Wine OneNET EdpProto 调试工具，设备模拟器，运行环境Win7+"
    
      93    install=${pkgname}.install
    
      94    install -dm0755 "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      95
    
      96    unar  "${srcdir}/${pkgname}-${pkgver}.rar" -o "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      97    cp -r "${srcdir}/regpatch.reg" "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      98
    
      99    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/${pkgname%-wine}" << EOF
    
      100#!/bin/bash
    
      101export WINEARCH=win32 WINEPREFIX="$HOME/.onenet/${pkgname%-wine}/wine"
    
      102
    
      103if [ ! -d "$HOME"/.onenet/${pkgname%-wine} ] ; then
    
      104    mkdir -p "$HOME"/.onenet/${pkgname%-wine}/wine || exit 1
    
      105
    
      106    cp -r /opt/onenet/${pkgname%-wine}/regpatch.reg "$HOME"/.onenet/${pkgname%-wine}/wine || exit 1
    
      107    cp -r /opt/onenet/${pkgname%-wine}/EdpProtoDebugger-v2.0.exe "$HOME"/.onenet/${pkgname%-wine}/ || exit 1
    
      108
    
      109    regedit "$HOME"/.onenet/${pkgname%-wine}/wine/regpatch.reg
    
      110
    
      111    wineserver -k
    
      112fi
    
      113
    
      114wine "$HOME"/.onenet/${pkgname%-wine}/EdpProtoDebugger-v2.0.exe "\$@"
    
      115EOF
    
      116
    
      117    install -Dm0644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname%-wine}.desktop" << EOF
    
      118[Desktop Entry]
    
      119Name=${pkgname%-wine}
    
      120Name[zh_CN]=${pkgname%-wine}
    
      121Comment=${pkgdesc}
    
      122Exec=${pkgname%-wine} %f
    
      123Type=Application
    
      124Categories=Development;Tool;
    
      125Terminal=false
    
      126Icon=${pkgname%-wine}.png
    
      127Version=${pkgver}
    
      128EOF
    
      129}
    
      130
    
      131package_onenet-mqtt-device-debugger-wine() {
    
      132    pkgdesc="Wine OneNET MQTT 调试工具，设备模拟器，运行环境Win7+"
    
      133    install=${pkgname}.install
    
      134    install -dm0755 "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      135
    
      136    unar "${srcdir}/${pkgname}-${pkgver}.rar" -o "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      137    cp -r "${srcdir}/regpatch.reg" "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      138
    
      139    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/${pkgname%-wine}" << EOF
    
      140#!/bin/bash
    
      141export WINEARCH=win32 WINEPREFIX="$HOME/.onenet/${pkgname%-wine}/wine"
    
      142
    
      143if [ ! -d "$HOME"/.onenet/${pkgname%-wine} ] ; then
    
      144    mkdir -p "$HOME"/.onenet/${pkgname%-wine}/wine || exit 1
    
      145
    
      146    cp -r /opt/onenet/${pkgname%-wine}/regpatch.reg "$HOME"/.onenet/${pkgname%-wine}/wine || exit 1
    
      147    cp -r /opt/onenet/${pkgname%-wine}/simulate-device.exe "$HOME"/.onenet/${pkgname%-wine}/ || exit 1
    
      148
    
      149    regedit "$HOME"/.onenet/${pkgname%-wine}/wine/regpatch.reg
    
      150
    
      151    wineserver -k
    
      152fi
    
      153
    
      154wine "$HOME"/.onenet/${pkgname%-wine}/simulate-device.exe "\$@"
    
      155EOF
    
      156
    
      157    install -Dm0644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname%-wine}.desktop" << EOF
    
      158[Desktop Entry]
    
      159Name=${pkgname%-wine}
    
      160Name[zh_CN]=${pkgname%-wine}
    
      161Comment=${pkgdesc}
    
      162Exec=${pkgname%-wine} %f
    
      163Type=Application
    
      164Categories=Development;Tool;
    
      165Terminal=false
    
      166Icon=${pkgname%-wine}.png
    
      167Version=${pkgver}
    
      168EOF
    
      169}
    
      170
    
      171
    
      172package_onenet-lua-script-debugger-wine() {
    
      173    pkgdesc="Wine OneNET Lua 调试工具，设备模拟器，运行环境Win7+"
    
      174    install=${pkgname}.install
    
      175    install -dm0755 "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      176
    
      177    unar  "${srcdir}/${pkgname}-${pkgver}.zip"
    
      178    cp -r "${srcdir}"/${pkgname}-${pkgver}/. "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      179    cp -r "${srcdir}/regpatch.reg" "${pkgdir}/opt/onenet/${pkgname%-wine}"
    
      180
    
      181    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/${pkgname%-wine}" << EOF
    
      182#!/bin/bash
    
      183export WINEARCH=win32 WINEPREFIX="$HOME/.onenet/${pkgname%-wine}/wine"
    
      184
    
      185if [ ! -d "$HOME"/.onenet/${pkgname%-wine} ] ; then
    
      186    mkdir -p "$HOME"/.onenet/${pkgname%-wine}/wine || exit 1
    
      187
    
      188    cp -r /opt/onenet/${pkgname%-wine}/regpatch.reg "$HOME"/.onenet/${pkgname%-wine}/wine || exit 1
    
      189    cp -r /opt/onenet/${pkgname%-wine}/ScriptDebugger.exe "$HOME"/.onenet/${pkgname%-wine}/ || exit 1
    
      190    cp -r /opt/onenet/${pkgname%-wine}/modbus_03.exe "$HOME"/.onenet/${pkgname%-wine} || exit 1
    
      191    cp -r /opt/onenet/${pkgname%-wine}/*.lua "$HOME"/.onenet/${pkgname%-wine} || exit 1
    
      192    cp -r /opt/onenet/${pkgname%-wine}/*.dll "$HOME"/.onenet/${pkgname%-wine} || exit 1
    
      193
    
      194    regedit "$HOME"/.onenet/${pkgname%-wine}/wine/regpatch.reg
    
      195
    
      196    wineserver -k
    
      197fi
    
      198
    
      199wine "$HOME"/.onenet/${pkgname%-wine}/ScriptDebugger.exe "\$@"
    
      200EOF
    
      201
    
      202    install -Dm0644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname%-wine}.desktop" << EOF
    
      203[Desktop Entry]
    
      204Name=${pkgname%-wine}
    
      205Name[zh_CN]=${pkgname%-wine}
    
      206Comment=${pkgdesc}
    
      207Exec=${pkgname%-wine} %f
    
      208Type=Application
    
      209Categories=Development;Tool;
    
      210Terminal=false
    
      211Icon=${pkgname%-wine}.png
    
      212Version=${pkgver}
    
      213EOF
    
      214}
    
      215
    
      216

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2