onlyoffice
maintainer kxxt
· 15 votes
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The package builds from the project's own GitHub repositories and uses a CEF binary from spotifycdn.com, which is a legitimate but non-whitelisted host; no unverifiable or executable payloads are introduced, and all sources are pinned to specific commits or tags.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own GitHub repositories and uses a CEF binary from spotifycdn.com, which is a legitimate but non-whitelisted host; no unverifiable or executable payloads are introduced, and all sources are pinned to specific commits or tags.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:68
"cef_5414.tar.bz2::https://cef-builds.spotifycdn.com/cef_binary_109.1.18%2Bgf1c41e4%2Bchromium-109.0.5414.120_linux64_minimal.tar.bz2" -
PKGBUILD:70
"git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=8dde9800ee2b8326ab11a87abd67d3bd9f8c8773"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Levi Zim (kxxt) <rsworktech@outlook.com>
2
# Contributor: Daniel Bermond <dbermond@archlinux.org>
3
# Contributor: Mikalai Ramanovich < narod.ru: nikolay.romanovich >
4
pkgname=onlyoffice
5
pkgver=9.4.0
6
pkgrel=2
7
pkgdesc="An office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents"
8
arch=(x86_64)
9
url="https://www.onlyoffice.com/desktop.aspx"
10
license=('AGPL-3.0-only')
11
depends=(
12
'curl' 'gtk3' 'alsa-lib' 'libpulse' 'gstreamer' 'gst-plugins-base-libs'
13
'gst-plugins-ugly' 'libxss' 'nss' 'nspr' 'ttf-dejavu' 'ttf-liberation'
14
'ttf-carlito' 'desktop-file-utils' 'hicolor-icon-theme'
15
'qt5-base' 'qt5-multimedia' 'qt5-x11extras' 'qt5-svg' 'libnotify'
16
# System libraries introduced via patch
17
'libheif'
18
)
19
makedepends=(
20
git python
21
dos2unix
22
nasm
23
# build_tools/tools/linux/deps.py
24
nodejs-lts-iron
25
npm
26
yarn
27
grunt-cli
28
cmake
29
p7zip
30
patchelf
31
# v8
32
ninja
33
# grunt
34
jdk11-openjdk
35
libxml2-legacy # V8 toolchain
36
)
37
optdepends=('libreoffice: for OpenSymbol fonts'
38
'otf-takao: for japanese Takao fonts'
39
'ttf-ms-fonts: for Microsoft fonts'
40
'gst-plugins-good: for playing embedded video files'
41
'gst-libav: for playing embedded video files')
42
conflicts=(onlyoffice-bin onlyoffice-git)
43
options=(
44
'!emptydirs'
45
'!lto'
46
)
47
_url=https://github.com/ONLYOFFICE
48
# The tag used for indirect sumodules
49
_tag=v9.4.0.130
50
# ICU: scripts/core_common/modules/icu.py
51
_icu_major=74
52
_icu_minor=2
53
source=(
54
# Source
55
"git+${_url}/DesktopEditors#tag=v$pkgver"
56
"$pkgname-core::git+${_url}/core#tag=$_tag"
57
"$pkgname-desktop-apps::git+${_url}/desktop-apps#tag=$_tag"
58
"$pkgname-desktop-sdk::git+${_url}/desktop-sdk#tag=$_tag"
59
"$pkgname-dictionaries::git+${_url}/dictionaries#tag=$_tag"
60
"$pkgname-sdkjs::git+${_url}/sdkjs#tag=$_tag"
61
"$pkgname-web-apps::git+${_url}/web-apps#tag=$_tag"
62
"$pkgname-sdkjs-forms::git+${_url}/sdkjs-forms#tag=$_tag"
63
"$pkgname-build_tools::git+${_url}/build_tools#tag=$_tag"
64
"$pkgname-core-fonts::git+${_url}/core-fonts#tag=$_tag"
65
"$pkgname-document-templates::git+${_url}/document-templates#tag=$_tag"
66
"onlyoffice.github.io::git+${_url}/onlyoffice.github.io"
67
# CEF
68
"cef_5414.tar.bz2::https://cef-builds.spotifycdn.com/cef_binary_109.1.18%2Bgf1c41e4%2Bchromium-109.0.5414.120_linux64_minimal.tar.bz2"
69
# V8
70
"git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=8dde9800ee2b8326ab11a87abd67d3bd9f8c8773"
71
"git+https://github.com/v8/v8#tag=9.0.257.43" # 9.0-lkgr
72
# ICU -- Keep in Sync with build_tools/scripts/core_common/modules/icu.py
73
"git+https://github.com/unicode-org/icu.git#tag=release-$_icu_major-$_icu_minor"
74
# Patches
75
"v8-89-fix-cstdint.diff"
76
"0001-Add-update-only-to-avoid-download-and-build-at-once.patch"
77
"0002-Add-no-third-party-update-and-update-third-party-onl.patch"
78
"0003-use-QT_VERSION-env-instead-of-guessing.patch"
79
"0004-Only-build-tar.patch"
80
"0001-Fix-boost-module-import.patch"
81
"0001-Disable-static-linking-of-libstdc.patch"
82
"0001-Dynamically-link-libstdc-in-icu.patch"
83
"use-fpermissive.diff"
84
"fix-glib-qt-macro-collision.diff"
85
"no-git-update.diff"
86
fix-limits-include{,-1}.diff
87
"do-not-build-commercial.diff"
88
system-heif{,-0}.diff
89
"fix-QDesktopWidget-include.diff"
90
"Ancient-V8-Use-Sysroot.diff"
91
"no-js-download-at-build-time.diff"
92
)
93
noextract=('cef_binary.7z')
94
sha256sums=('2256c94f02290da096069260d2f4c4bb5482632128873c623cd25f754f77dc5e'
95
'a3f86bf5410c9a8158dcab4490e792895a8abc1c4eec2eb7d94bf18bc7c696c4'
96
'f8abe86c14eb3bbcafd0b29aa9480ea27761343dcf35ab0dfe8e52167e0abee8'
97
'5fc99b98887b45cf00db54a7caf6189d280234813de4147c186499b31b6952bc'
98
'62dc945a78f38ab87e9d0a1a0cfefe0ddee29ba9de4e48468f7047d0aac4e645'
99
'ad165bbe35b192de560a96f9ef96ad83615fce37ce3509484a1d9df236bb5fdc'
100
'c37790310c7e7e3af6f7a8bb98de0b61dae351eaf32843557ede750792e793eb'
101
'73fd76bab5919773c049ef502ac0f43af1f6424ddbeec7286dba86452709c915'
102
'06f1bb22167fa6a19ee2d348c3529a558f62f566bd06043b3ff319737af22c5b'
103
'55c1d70a8bdd8f818af8e4c784bfc03f0569fcb863cc6797f888b749153ed720'
104
'4d9bf0039261bb531663603171b63a4a5339c4c0644e9859991d78ddbf446573'
105
'SKIP'
106
'ba4b9ca37cb777b256fdf5e18c9bdbc66ebf060367e8542398676b42bbbc0e59'
107
'cd7a982bf79eae86a8b7727193e2a9feccd1388cd0cc474b8d786ac6dc695cfe'
108
'8cd5a305b9ce85066094963a5d28ad221f9598b9e98e569bf47c61f570c2988b'
109
'1370503ff352608f587486324bde040a9038f4cbf2d21085f821121dd49dbede'
110
'9f570942c7467c800acb4b891f7739a1fcd497dbb2d30b04005e0b6a38da6e4d'
111
'a4f2502acfdc48d3daad5ed166c1cd15cb0595a4d5018f22d9390f73f25dd8c6'
112
'e9d56d030039ad72e89dc48877f7fccaeac4cfa5ff584833849be2601fca5fb7'
113
'bdcf095fd46fb47f2992510078c46cef2b0084000ff4a0c4f956efb0db7e4d57'
114
'0f7acc17b78eaeb338f098088ee11356045a53af6698c79ada45fa261c8d18fe'
115
'95e107a7c2a895866e8a1d4c89bb4dbed50027fff9e5b9ab513c556537554eef'
116
'b3e040f0551dc469d91d23487e05bdb7123d2a3e50c5180c44be868a6f42ecbf'
117
'a3561d1f18a61c404c8f9f9ed51484b2e19e3caaee86b71b1cabe3c7ccd0053a'
118
'222dab12468f27b2bc1cc098ad2e4ca5bff8df845939f5cba2efff2165eafbcd'
119
'fbf4c2800bc885063525ee8a50cfb870d7f44166584fd131f4bed8a762538c28'
120
'a062edfcca4fc2103f5d7eeffeb22539de4a633eddd3ba4ed555ac1976be5176'
121
'cb87384ce721ac15a82d254efe8662be0eb9011c122edfcb1caa07194fbae697'
122
'8761a41683733f8c297fda55485126e895b1271aefd0f834078eb417878afbb0'
123
'b7bce5799d2f52026795169e40d6a3b436bb8c481d769cc8ff9df19a7e9e29cd'
124
'c328fbadbb34f6fd59b79b2be188877ae2652a932d1b003548632c261f88a9c6'
125
'e3af225ba3945e1430d4dbc2a4049e3ff3e114f5e73616624e430eed813b744f'
126
'7849b1895a7b99479b2a78a8f009a3e670b0588a5bad150168506a4e41d03e69'
127
'a542aa3d89568b50dd37a3b844dda230da3e04adf655ee8d67f56b066c2bdde5'
128
'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
129
130
131
_set_flags() {
132
# Set CXX standard to gnu++11. It appears that upstream forgot to do so in
133
# some places.
134
if [[ ! "$CXXFLAGS" =~ '-std=' ]]; then
135
CXXFLAGS="$CXXFLAGS -std=gnu++11"
136
fi
137
# Some dependencies are still using legacy cmake versions
138
export CMAKE_POLICY_VERSION_MINIMUM=3.5
139
}
140
141
prepare() {
142
_set_flags
143
for _module in core desktop-{apps,sdk} dictionaries sdkjs{,-forms} \
144
web-apps build_tools document-templates core-fonts
145
do
146
mv "$pkgname-${_module}" "${_module}"
147
done
148
cp -r icu/icu4c core/Common/3dParty/icu/icu
149
cd "$srcdir/build_tools"/tools/linux
150
151
# Pretend that we have all dependencies installed
152
touch packages_complete
153
154
# Use system qt
155
# ref: build_tools/tools/linux/use_system_qt.py
156
mkdir -p system_qt/gcc_64
157
ln -s /usr/bin ./system_qt/gcc_64/bin
158
ln -s /usr/lib ./system_qt/gcc_64/lib
159
ln -s /usr/lib/qt/plugins ./system_qt/gcc_64/plugins
160
161
# Check build_tools/tools/linux/automate.py for options to configure.py
162
cd "$srcdir/build_tools"
163
patch -Np1 -i ../0001-Fix-boost-module-import.patch
164
patch -Np1 -i ../0001-Add-update-only-to-avoid-download-and-build-at-once.patch
165
patch -Np1 -i ../0002-Add-no-third-party-update-and-update-third-party-onl.patch
166
# Don't update our pinned git repos
167
patch -Np1 -i ../no-git-update.diff
168
# Fix the way to get qt version
169
patch -Np1 -i ../0003-use-QT_VERSION-env-instead-of-guessing.patch
170
# Don't build debs/rpm/..
171
patch -Np1 -i ../0004-Only-build-tar.patch
172
# Dyn linking system libs for vendored ICU
173
patch -Np1 -i ../0001-Dynamically-link-libstdc-in-icu.patch
174
# Do not build commerical edition
175
patch -Np0 -i ../do-not-build-commercial.diff
176
# Use V8 sysroot for building the bundled ancient V8
177
# libstdc++ in GCC 16 is no longer compatible with it.
178
patch -Np1 -i ../Ancient-V8-Use-Sysroot.diff
179
# Don't download JS resource at build time
180
patch -Np1 -i ../no-js-download-at-build-time.diff
181
182
# We manually update the sources, so --update 0
183
./configure.py --module desktop --update 0 --qt-dir "$(realpath tools/linux/system_qt)"
184
./make.py --update-only
185
186
# fetch V8 before updating third party to have a chance to patch it
187
cd "$srcdir/"
188
mv depot_tools core/Common/3dParty/v8_89/
189
cd core/Common/3dParty/v8_89/
190
# Onlyofffice build script checks it and when it does not match,
191
# it would delete our v8 and deopt_tools and try to clone them again :(
192
echo -n "v8_version_1" > v8.data
193
cat >.gclient <<EOF
194
solutions = [
195
{
196
"name": "v8",
197
"url": "file://${srcdir}/v8@makepkg",
198
"deps_file": "DEPS",
199
"managed": False,
200
"custom_deps": {},
201
"custom_vars": {},
202
},
203
]
204
EOF
205
export PATH="$(pwd)/depot_tools:$PATH" DEPOT_TOOLS_UPDATE=0
206
ensure_bootstrap
207
# ref: build_tools/scripts/core_common/modules/v8_89.py
208
gclient sync --force
209
# V8 use system libstdc++
210
ln -sf /usr/lib/libstdc++.so.6 \
211
v8/third_party/llvm-build/Release+Asserts/lib/libstdc++.so.6
212
patch -Np1 -d v8 < "$srcdir/v8-89-fix-cstdint.diff"
213
214
# Convert official CEF distribution tarball to the format used by Onlyoffice.
215
cd "$srcdir"
216
mkdir -p cef_binary
217
# Onlyoffice uses Release/ and Resources/
218
tar -C cef_binary -xf cef_5414.tar.bz2 --strip-components=1 --wildcards '*/Release' '*/Resources'
219
# Place expected cef_binary.7z into the expected place
220
mkdir -p "$srcdir"/core/Common/3dParty/cef/linux_64
221
7z a "$srcdir"/core/Common/3dParty/cef/linux_64/cef_binary.7z cef_binary/
222
223
# We need to apply the patches after the update
224
cd "$srcdir"
225
patch -Np0 -i system-heif.diff
226
patch -Np0 -i fix-limits-include-1.diff
227
patch -Np0 -i fix-QDesktopWidget-include.diff
228
patch -Np0 -i system-heif-0.diff
229
patch -Np1 -d core < 0001-Disable-static-linking-of-libstdc.patch
230
# Fix some compile error
231
patch -Np1 -d core < use-fpermissive.diff
232
dos2unix core/Common/OfficeFileFormatChecker2.cpp
233
patch -Np0 -d core < fix-limits-include.diff
234
patch -Np1 -d desktop-apps < fix-glib-qt-macro-collision.diff
235
# patch -Np1 -d desktop-apps < package-add-dir-target.diff
236
# pragma (end)?region breaks if-else-if. Is this a gcc bug?
237
sed -Ei '/pragma (end)?region/d' core/MsBinaryFile/XlsFile/Format/Logic/Biff_structures/StringPtgParser.cpp
238
# Fix missing unistd.h
239
# TODO: use system zlib
240
sed -i '1s/^/#include<unistd.h>\n/' core/OfficeUtils/src/zlib-1.2.11/gzwrite.c
241
sed -i '1s/^/#include<unistd.h>\n/' core/OfficeUtils/src/zlib-1.2.11/gzread.c
242
sed -i '1s/^/#include<unistd.h>\n/' core/OfficeUtils/src/zlib-1.2.11/gzlib.c
243
sed -i '1s/^/#include<cmath>\n/' desktop-sdk/ChromiumBasedEditors/videoplayerlib/src/qtimelabel.cpp
244
sed -i '1s/^/#include<cmath>\n/' desktop-sdk/ChromiumBasedEditors/videoplayerlib/src/qvideoslider.cpp
245
sed -i '1s/^/#include<cmath>\n/' desktop-sdk/ChromiumBasedEditors/videoplayerlib/src/qvideoplaylist.cpp
246
sed -i '1s/^/#include<QPainterPath>\n/' desktop-apps/win-linux/src/windows/platform_linux/cwindowplatform.cpp
247
248
cd "$srcdir/build_tools"
249
./make.py --update-third-party-only
250
}
251
252
build() {
253
_set_flags
254
cd build_tools
255
local qt_ver="$(pacman -Q qt5-base | awk '{print $2}')"
256
export QT_VERSION="${qt_ver//+*}"
257
258
export CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
259
export CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
260
# -O2 causes a linker segfault during LTO
261
export CFLAGS="${CFLAGS/-O2/}"
262
export CXXFLAGS="${CXXFLAGS/-O2/}"
263
# GLIBCXX_ASSERTIONS causes undefined symbols during linking
264
export CXXFLAGS="${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}"
265
266
./make.py --no-third-party-update
267
}
268
269
package() {
270
cd build_tools
271
./make_package.py -P linux_x86_64 -T desktop -V "$pkgver" -B "$pkgrel"
272
cd ../desktop-apps/package/tar
273
tar xf onlyoffice-desktopeditors-"$pkgver"-"$pkgrel"-"$CARCH".tar.xz
274
rm -f *.tar.xz
275
276
install -d "$pkgdir"/opt/onlyoffice
277
cp -r usr "$pkgdir"
278
chmod +x "$pkgdir"/usr/bin/*
279
# Symlink for backward compatibility
280
ln -s onlyoffice-desktopeditors "$pkgdir"/usr/bin/desktopeditors
281
cp -r opt "$pkgdir"
282
283
# Official CEF 109 resolves malloc_usable_size via RTLD_NEXT. Make CEF a
284
# direct, early dependency so libc follows it in the ELF loader link map.
285
local _desktopeditors="$pkgdir/opt/onlyoffice/desktopeditors/DesktopEditors"
286
if patchelf --print-needed "$_desktopeditors" | grep -Fxq libcef.so; then
287
patchelf --remove-needed libcef.so "$_desktopeditors"
288
fi
289
patchelf --add-needed libcef.so "$_desktopeditors"
290
[[ $(patchelf --print-needed "$_desktopeditors" | head -n 1) == libcef.so ]] || {
291
error 'failed to place libcef.so first in DesktopEditors DT_NEEDED entries'
292
return 1
293
}
294
295
# We are using system Qt5 and icu
296
rm "$pkgdir"/opt/onlyoffice/desktopeditors/libQt5*
297
rm "$pkgdir"/opt/onlyoffice/desktopeditors/libicu*
298
}
299
Changes since previous scan
--- PKGBUILD @ 2026-06-20 00:50+++ PKGBUILD @ 2026-08-18 00:03@@ -3,7 +3,7 @@ # Contributor: Mikalai Ramanovich < narod.ru: nikolay.romanovich > pkgname=onlyoffice pkgver=9.4.0-pkgrel=1+pkgrel=2 pkgdesc="An office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents" arch=(x86_64) url="https://www.onlyoffice.com/desktop.aspx"@@ -27,6 +27,7 @@ grunt-cli cmake p7zip+ patchelf # v8 ninja # grunt@@ -64,7 +65,7 @@ "$pkgname-document-templates::git+${_url}/document-templates#tag=$_tag" "onlyoffice.github.io::git+${_url}/onlyoffice.github.io" # CEF- "https://github.com/ONLYOFFICE-data/build_tools_data/raw/refs/heads/master/cef/5414/linux_64/cef_binary.7z"+ "cef_5414.tar.bz2::https://cef-builds.spotifycdn.com/cef_binary_109.1.18%2Bgf1c41e4%2Bchromium-109.0.5414.120_linux64_minimal.tar.bz2" # V8 "git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=8dde9800ee2b8326ab11a87abd67d3bd9f8c8773" "git+https://github.com/v8/v8#tag=9.0.257.43" # 9.0-lkgr@@ -102,7 +103,7 @@ '55c1d70a8bdd8f818af8e4c784bfc03f0569fcb863cc6797f888b749153ed720' '4d9bf0039261bb531663603171b63a4a5339c4c0644e9859991d78ddbf446573' 'SKIP'- 'dff9aa53c147fd0c6a03f57e17aef10b0cee3fe7c4dc18b3b1a8a7a20bf0a145'+ 'ba4b9ca37cb777b256fdf5e18c9bdbc66ebf060367e8542398676b42bbbc0e59' 'cd7a982bf79eae86a8b7727193e2a9feccd1388cd0cc474b8d786ac6dc695cfe' '8cd5a305b9ce85066094963a5d28ad221f9598b9e98e569bf47c61f570c2988b' '1370503ff352608f587486324bde040a9038f4cbf2d21085f821121dd49dbede'@@ -210,9 +211,14 @@ v8/third_party/llvm-build/Release+Asserts/lib/libstdc++.so.6 patch -Np1 -d v8 < "$srcdir/v8-89-fix-cstdint.diff" - # Move CEF into the expected place+ # Convert official CEF distribution tarball to the format used by Onlyoffice.+ cd "$srcdir"+ mkdir -p cef_binary+ # Onlyoffice uses Release/ and Resources/+ tar -C cef_binary -xf cef_5414.tar.bz2 --strip-components=1 --wildcards '*/Release' '*/Resources'+ # Place expected cef_binary.7z into the expected place mkdir -p "$srcdir"/core/Common/3dParty/cef/linux_64- mv "$srcdir"/cef_binary.7z "$srcdir"/core/Common/3dParty/cef/linux_64/+ 7z a "$srcdir"/core/Common/3dParty/cef/linux_64/cef_binary.7z cef_binary/ # We need to apply the patches after the update cd "$srcdir"@@ -274,6 +280,18 @@ ln -s onlyoffice-desktopeditors "$pkgdir"/usr/bin/desktopeditors cp -r opt "$pkgdir" + # Official CEF 109 resolves malloc_usable_size via RTLD_NEXT. Make CEF a+ # direct, early dependency so libc follows it in the ELF loader link map.+ local _desktopeditors="$pkgdir/opt/onlyoffice/desktopeditors/DesktopEditors"+ if patchelf --print-needed "$_desktopeditors" | grep -Fxq libcef.so; then+ patchelf --remove-needed libcef.so "$_desktopeditors"+ fi+ patchelf --add-needed libcef.so "$_desktopeditors"+ [[ $(patchelf --print-needed "$_desktopeditors" | head -n 1) == libcef.so ]] || {+ error 'failed to place libcef.so first in DesktopEditors DT_NEEDED entries'+ return 1+ }+ # We are using system Qt5 and icu rm "$pkgdir"/opt/onlyoffice/desktopeditors/libQt5* rm "$pkgdir"/opt/onlyoffice/desktopeditors/libicu*Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 2 |
| 2026-08-17 00:18:29 | LOW | 2 |
| 2026-08-16 00:03:42 | LOW | 2 |
| 2026-08-15 00:26:13 | LOW | 2 |
| 2026-08-14 00:03:41 | LOW | 2 |
| 2026-08-13 15:26:23 | MEDIUM | 1 |
| 2026-06-20 00:50:07 | CLEAN | 2 |
| 2026-06-20 00:18:46 | MEDIUM | 2 |
| 2026-06-19 23:51:18 | MEDIUM | 2 |
| 2026-06-19 19:07:35 | LOW | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |