onlyoffice

LOW
maintainer kxxt 15 votes scanned 2026-10-02 00:00:32.890515
View on AUR
Why flagged

The package builds from the project's own GitHub repositories and uses a CEF binary from spotifycdn.com, which is a legitimate but non-whitelisted host; no unverifiable or executable payloads are introduced, and all sources are pinned to specific commits or tags.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own GitHub repositories and uses a CEF binary from spotifycdn.com, which is a legitimate but non-whitelisted host; no unverifiable or executable payloads are introduced, and all sources are pinned to specific commits or tags.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:68 "cef_5414.tar.bz2::https://cef-builds.spotifycdn.com/cef_binary_109.1.18%2Bgf1c41e4%2Bchromium-109.0.5414.120_linux64_minimal.tar.bz2"
  • PKGBUILD:70 "git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=8dde9800ee2b8326ab11a87abd67d3bd9f8c8773"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: Levi Zim (kxxt) <rsworktech@outlook.com>
2# Contributor: Daniel Bermond <dbermond@archlinux.org>
3# Contributor: Mikalai Ramanovich < narod.ru: nikolay.romanovich >
4pkgname=onlyoffice
5pkgver=9.4.0
6pkgrel=2
7pkgdesc="An office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents"
8arch=(x86_64)
9url="https://www.onlyoffice.com/desktop.aspx"
10license=('AGPL-3.0-only')
11depends=(
12 'curl' 'gtk3' 'alsa-lib' 'libpulse' 'gstreamer' 'gst-plugins-base-libs'
13 'gst-plugins-ugly' 'libxss' 'nss' 'nspr' 'ttf-dejavu' 'ttf-liberation'
14 'ttf-carlito' 'desktop-file-utils' 'hicolor-icon-theme'
15 'qt5-base' 'qt5-multimedia' 'qt5-x11extras' 'qt5-svg' 'libnotify'
16 # System libraries introduced via patch
17 'libheif'
18)
19makedepends=(
20 git python
21 dos2unix
22 nasm
23 # build_tools/tools/linux/deps.py
24 nodejs-lts-iron
25 npm
26 yarn
27 grunt-cli
28 cmake
29 p7zip
30 patchelf
31 # v8
32 ninja
33 # grunt
34 jdk11-openjdk
35 libxml2-legacy # V8 toolchain
36)
37optdepends=('libreoffice: for OpenSymbol fonts'
38 'otf-takao: for japanese Takao fonts'
39 'ttf-ms-fonts: for Microsoft fonts'
40 'gst-plugins-good: for playing embedded video files'
41 'gst-libav: for playing embedded video files')
42conflicts=(onlyoffice-bin onlyoffice-git)
43options=(
44 '!emptydirs'
45 '!lto'
46)
47_url=https://github.com/ONLYOFFICE
48# The tag used for indirect sumodules
49_tag=v9.4.0.130
50# ICU: scripts/core_common/modules/icu.py
51_icu_major=74
52_icu_minor=2
53source=(
54 # Source
55 "git+${_url}/DesktopEditors#tag=v$pkgver"
56 "$pkgname-core::git+${_url}/core#tag=$_tag"
57 "$pkgname-desktop-apps::git+${_url}/desktop-apps#tag=$_tag"
58 "$pkgname-desktop-sdk::git+${_url}/desktop-sdk#tag=$_tag"
59 "$pkgname-dictionaries::git+${_url}/dictionaries#tag=$_tag"
60 "$pkgname-sdkjs::git+${_url}/sdkjs#tag=$_tag"
61 "$pkgname-web-apps::git+${_url}/web-apps#tag=$_tag"
62 "$pkgname-sdkjs-forms::git+${_url}/sdkjs-forms#tag=$_tag"
63 "$pkgname-build_tools::git+${_url}/build_tools#tag=$_tag"
64 "$pkgname-core-fonts::git+${_url}/core-fonts#tag=$_tag"
65 "$pkgname-document-templates::git+${_url}/document-templates#tag=$_tag"
66 "onlyoffice.github.io::git+${_url}/onlyoffice.github.io"
67 # CEF
68 "cef_5414.tar.bz2::https://cef-builds.spotifycdn.com/cef_binary_109.1.18%2Bgf1c41e4%2Bchromium-109.0.5414.120_linux64_minimal.tar.bz2"
69 # V8
70 "git+https://chromium.googlesource.com/chromium/tools/depot_tools.git#commit=8dde9800ee2b8326ab11a87abd67d3bd9f8c8773"
71 "git+https://github.com/v8/v8#tag=9.0.257.43" # 9.0-lkgr
72 # ICU -- Keep in Sync with build_tools/scripts/core_common/modules/icu.py
73 "git+https://github.com/unicode-org/icu.git#tag=release-$_icu_major-$_icu_minor"
74 # Patches
75 "v8-89-fix-cstdint.diff"
76 "0001-Add-update-only-to-avoid-download-and-build-at-once.patch"
77 "0002-Add-no-third-party-update-and-update-third-party-onl.patch"
78 "0003-use-QT_VERSION-env-instead-of-guessing.patch"
79 "0004-Only-build-tar.patch"
80 "0001-Fix-boost-module-import.patch"
81 "0001-Disable-static-linking-of-libstdc.patch"
82 "0001-Dynamically-link-libstdc-in-icu.patch"
83 "use-fpermissive.diff"
84 "fix-glib-qt-macro-collision.diff"
85 "no-git-update.diff"
86 fix-limits-include{,-1}.diff
87 "do-not-build-commercial.diff"
88 system-heif{,-0}.diff
89 "fix-QDesktopWidget-include.diff"
90 "Ancient-V8-Use-Sysroot.diff"
91 "no-js-download-at-build-time.diff"
92)
93noextract=('cef_binary.7z')
94sha256sums=('2256c94f02290da096069260d2f4c4bb5482632128873c623cd25f754f77dc5e'
95 'a3f86bf5410c9a8158dcab4490e792895a8abc1c4eec2eb7d94bf18bc7c696c4'
96 'f8abe86c14eb3bbcafd0b29aa9480ea27761343dcf35ab0dfe8e52167e0abee8'
97 '5fc99b98887b45cf00db54a7caf6189d280234813de4147c186499b31b6952bc'
98 '62dc945a78f38ab87e9d0a1a0cfefe0ddee29ba9de4e48468f7047d0aac4e645'
99 'ad165bbe35b192de560a96f9ef96ad83615fce37ce3509484a1d9df236bb5fdc'
100 'c37790310c7e7e3af6f7a8bb98de0b61dae351eaf32843557ede750792e793eb'
101 '73fd76bab5919773c049ef502ac0f43af1f6424ddbeec7286dba86452709c915'
102 '06f1bb22167fa6a19ee2d348c3529a558f62f566bd06043b3ff319737af22c5b'
103 '55c1d70a8bdd8f818af8e4c784bfc03f0569fcb863cc6797f888b749153ed720'
104 '4d9bf0039261bb531663603171b63a4a5339c4c0644e9859991d78ddbf446573'
105 'SKIP'
106 'ba4b9ca37cb777b256fdf5e18c9bdbc66ebf060367e8542398676b42bbbc0e59'
107 'cd7a982bf79eae86a8b7727193e2a9feccd1388cd0cc474b8d786ac6dc695cfe'
108 '8cd5a305b9ce85066094963a5d28ad221f9598b9e98e569bf47c61f570c2988b'
109 '1370503ff352608f587486324bde040a9038f4cbf2d21085f821121dd49dbede'
110 '9f570942c7467c800acb4b891f7739a1fcd497dbb2d30b04005e0b6a38da6e4d'
111 'a4f2502acfdc48d3daad5ed166c1cd15cb0595a4d5018f22d9390f73f25dd8c6'
112 'e9d56d030039ad72e89dc48877f7fccaeac4cfa5ff584833849be2601fca5fb7'
113 'bdcf095fd46fb47f2992510078c46cef2b0084000ff4a0c4f956efb0db7e4d57'
114 '0f7acc17b78eaeb338f098088ee11356045a53af6698c79ada45fa261c8d18fe'
115 '95e107a7c2a895866e8a1d4c89bb4dbed50027fff9e5b9ab513c556537554eef'
116 'b3e040f0551dc469d91d23487e05bdb7123d2a3e50c5180c44be868a6f42ecbf'
117 'a3561d1f18a61c404c8f9f9ed51484b2e19e3caaee86b71b1cabe3c7ccd0053a'
118 '222dab12468f27b2bc1cc098ad2e4ca5bff8df845939f5cba2efff2165eafbcd'
119 'fbf4c2800bc885063525ee8a50cfb870d7f44166584fd131f4bed8a762538c28'
120 'a062edfcca4fc2103f5d7eeffeb22539de4a633eddd3ba4ed555ac1976be5176'
121 'cb87384ce721ac15a82d254efe8662be0eb9011c122edfcb1caa07194fbae697'
122 '8761a41683733f8c297fda55485126e895b1271aefd0f834078eb417878afbb0'
123 'b7bce5799d2f52026795169e40d6a3b436bb8c481d769cc8ff9df19a7e9e29cd'
124 'c328fbadbb34f6fd59b79b2be188877ae2652a932d1b003548632c261f88a9c6'
125 'e3af225ba3945e1430d4dbc2a4049e3ff3e114f5e73616624e430eed813b744f'
126 '7849b1895a7b99479b2a78a8f009a3e670b0588a5bad150168506a4e41d03e69'
127 'a542aa3d89568b50dd37a3b844dda230da3e04adf655ee8d67f56b066c2bdde5'
128 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
129
130
131_set_flags() {
132 # Set CXX standard to gnu++11. It appears that upstream forgot to do so in
133 # some places.
134 if [[ ! "$CXXFLAGS" =~ '-std=' ]]; then
135 CXXFLAGS="$CXXFLAGS -std=gnu++11"
136 fi
137 # Some dependencies are still using legacy cmake versions
138 export CMAKE_POLICY_VERSION_MINIMUM=3.5
139}
140
141prepare() {
142 _set_flags
143 for _module in core desktop-{apps,sdk} dictionaries sdkjs{,-forms} \
144 web-apps build_tools document-templates core-fonts
145 do
146 mv "$pkgname-${_module}" "${_module}"
147 done
148 cp -r icu/icu4c core/Common/3dParty/icu/icu
149 cd "$srcdir/build_tools"/tools/linux
150
151 # Pretend that we have all dependencies installed
152 touch packages_complete
153
154 # Use system qt
155 # ref: build_tools/tools/linux/use_system_qt.py
156 mkdir -p system_qt/gcc_64
157 ln -s /usr/bin ./system_qt/gcc_64/bin
158 ln -s /usr/lib ./system_qt/gcc_64/lib
159 ln -s /usr/lib/qt/plugins ./system_qt/gcc_64/plugins
160
161 # Check build_tools/tools/linux/automate.py for options to configure.py
162 cd "$srcdir/build_tools"
163 patch -Np1 -i ../0001-Fix-boost-module-import.patch
164 patch -Np1 -i ../0001-Add-update-only-to-avoid-download-and-build-at-once.patch
165 patch -Np1 -i ../0002-Add-no-third-party-update-and-update-third-party-onl.patch
166 # Don't update our pinned git repos
167 patch -Np1 -i ../no-git-update.diff
168 # Fix the way to get qt version
169 patch -Np1 -i ../0003-use-QT_VERSION-env-instead-of-guessing.patch
170 # Don't build debs/rpm/..
171 patch -Np1 -i ../0004-Only-build-tar.patch
172 # Dyn linking system libs for vendored ICU
173 patch -Np1 -i ../0001-Dynamically-link-libstdc-in-icu.patch
174 # Do not build commerical edition
175 patch -Np0 -i ../do-not-build-commercial.diff
176 # Use V8 sysroot for building the bundled ancient V8
177 # libstdc++ in GCC 16 is no longer compatible with it.
178 patch -Np1 -i ../Ancient-V8-Use-Sysroot.diff
179 # Don't download JS resource at build time
180 patch -Np1 -i ../no-js-download-at-build-time.diff
181
182 # We manually update the sources, so --update 0
183 ./configure.py --module desktop --update 0 --qt-dir "$(realpath tools/linux/system_qt)"
184 ./make.py --update-only
185
186 # fetch V8 before updating third party to have a chance to patch it
187 cd "$srcdir/"
188 mv depot_tools core/Common/3dParty/v8_89/
189 cd core/Common/3dParty/v8_89/
190 # Onlyofffice build script checks it and when it does not match,
191 # it would delete our v8 and deopt_tools and try to clone them again :(
192 echo -n "v8_version_1" > v8.data
193 cat >.gclient <<EOF
194solutions = [
195 {
196 "name": "v8",
197 "url": "file://${srcdir}/v8@makepkg",
198 "deps_file": "DEPS",
199 "managed": False,
200 "custom_deps": {},
201 "custom_vars": {},
202 },
203]
204EOF
205 export PATH="$(pwd)/depot_tools:$PATH" DEPOT_TOOLS_UPDATE=0
206 ensure_bootstrap
207 # ref: build_tools/scripts/core_common/modules/v8_89.py
208 gclient sync --force
209 # V8 use system libstdc++
210 ln -sf /usr/lib/libstdc++.so.6 \
211 v8/third_party/llvm-build/Release+Asserts/lib/libstdc++.so.6
212 patch -Np1 -d v8 < "$srcdir/v8-89-fix-cstdint.diff"
213
214 # Convert official CEF distribution tarball to the format used by Onlyoffice.
215 cd "$srcdir"
216 mkdir -p cef_binary
217 # Onlyoffice uses Release/ and Resources/
218 tar -C cef_binary -xf cef_5414.tar.bz2 --strip-components=1 --wildcards '*/Release' '*/Resources'
219 # Place expected cef_binary.7z into the expected place
220 mkdir -p "$srcdir"/core/Common/3dParty/cef/linux_64
221 7z a "$srcdir"/core/Common/3dParty/cef/linux_64/cef_binary.7z cef_binary/
222
223 # We need to apply the patches after the update
224 cd "$srcdir"
225 patch -Np0 -i system-heif.diff
226 patch -Np0 -i fix-limits-include-1.diff
227 patch -Np0 -i fix-QDesktopWidget-include.diff
228 patch -Np0 -i system-heif-0.diff
229 patch -Np1 -d core < 0001-Disable-static-linking-of-libstdc.patch
230 # Fix some compile error
231 patch -Np1 -d core < use-fpermissive.diff
232 dos2unix core/Common/OfficeFileFormatChecker2.cpp
233 patch -Np0 -d core < fix-limits-include.diff
234 patch -Np1 -d desktop-apps < fix-glib-qt-macro-collision.diff
235 # patch -Np1 -d desktop-apps < package-add-dir-target.diff
236 # pragma (end)?region breaks if-else-if. Is this a gcc bug?
237 sed -Ei '/pragma (end)?region/d' core/MsBinaryFile/XlsFile/Format/Logic/Biff_structures/StringPtgParser.cpp
238 # Fix missing unistd.h
239 # TODO: use system zlib
240 sed -i '1s/^/#include<unistd.h>\n/' core/OfficeUtils/src/zlib-1.2.11/gzwrite.c
241 sed -i '1s/^/#include<unistd.h>\n/' core/OfficeUtils/src/zlib-1.2.11/gzread.c
242 sed -i '1s/^/#include<unistd.h>\n/' core/OfficeUtils/src/zlib-1.2.11/gzlib.c
243 sed -i '1s/^/#include<cmath>\n/' desktop-sdk/ChromiumBasedEditors/videoplayerlib/src/qtimelabel.cpp
244 sed -i '1s/^/#include<cmath>\n/' desktop-sdk/ChromiumBasedEditors/videoplayerlib/src/qvideoslider.cpp
245 sed -i '1s/^/#include<cmath>\n/' desktop-sdk/ChromiumBasedEditors/videoplayerlib/src/qvideoplaylist.cpp
246 sed -i '1s/^/#include<QPainterPath>\n/' desktop-apps/win-linux/src/windows/platform_linux/cwindowplatform.cpp
247
248 cd "$srcdir/build_tools"
249 ./make.py --update-third-party-only
250}
251
252build() {
253 _set_flags
254 cd build_tools
255 local qt_ver="$(pacman -Q qt5-base | awk '{print $2}')"
256 export QT_VERSION="${qt_ver//+*}"
257
258 export CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
259 export CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
260 # -O2 causes a linker segfault during LTO
261 export CFLAGS="${CFLAGS/-O2/}"
262 export CXXFLAGS="${CXXFLAGS/-O2/}"
263 # GLIBCXX_ASSERTIONS causes undefined symbols during linking
264 export CXXFLAGS="${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}"
265
266 ./make.py --no-third-party-update
267}
268
269package() {
270 cd build_tools
271 ./make_package.py -P linux_x86_64 -T desktop -V "$pkgver" -B "$pkgrel"
272 cd ../desktop-apps/package/tar
273 tar xf onlyoffice-desktopeditors-"$pkgver"-"$pkgrel"-"$CARCH".tar.xz
274 rm -f *.tar.xz
275
276 install -d "$pkgdir"/opt/onlyoffice
277 cp -r usr "$pkgdir"
278 chmod +x "$pkgdir"/usr/bin/*
279 # Symlink for backward compatibility
280 ln -s onlyoffice-desktopeditors "$pkgdir"/usr/bin/desktopeditors
281 cp -r opt "$pkgdir"
282
283 # Official CEF 109 resolves malloc_usable_size via RTLD_NEXT. Make CEF a
284 # direct, early dependency so libc follows it in the ELF loader link map.
285 local _desktopeditors="$pkgdir/opt/onlyoffice/desktopeditors/DesktopEditors"
286 if patchelf --print-needed "$_desktopeditors" | grep -Fxq libcef.so; then
287 patchelf --remove-needed libcef.so "$_desktopeditors"
288 fi
289 patchelf --add-needed libcef.so "$_desktopeditors"
290 [[ $(patchelf --print-needed "$_desktopeditors" | head -n 1) == libcef.so ]] || {
291 error 'failed to place libcef.so first in DesktopEditors DT_NEEDED entries'
292 return 1
293 }
294
295 # We are using system Qt5 and icu
296 rm "$pkgdir"/opt/onlyoffice/desktopeditors/libQt5*
297 rm "$pkgdir"/opt/onlyoffice/desktopeditors/libicu*
298}
299

Scan history

Scanned at (UTC)SeverityRules
2026-10-02 00:00:32 Low 2
2026-10-01 00:02:06 Low 2
2026-09-30 00:20:07 Low 2
2026-09-29 00:07:46 Low 2
2026-09-28 00:28:32 Low 2
2026-09-27 00:07:07 Low 2
2026-09-26 00:12:15 Low 2
2026-09-25 00:03:36 Low 2
2026-09-24 00:24:14 Low 2
2026-09-23 00:28:13 Low 2
2026-09-22 00:15:14 Low 2
2026-09-21 00:26:32 Low 2
2026-09-20 00:25:31 Low 2
2026-09-19 00:25:36 Low 2
2026-09-18 00:17:11 Low 2
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion