ovital-map

MEDIUM
maintainer 15deg 0 votes scanned 2026-09-27 15:19:08.759284
View on AUR
Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:67 source_x86_64=("Linux-x86_64-OMap-${pkgver}-build${_build_x86_64}.deb::https://cdn.ovital.com/pub/Linux-x86_64-OMap-${pkgver}-build${_build_x86_64}.deb")
Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: 15deg <204751610 at qq dot com>
2# Contributor: SteamedFish <steamedfish@hotmail.com>
3
4pkgname=ovital-map
5pkgver=10.6.0
6pkgrel=1
7install=ovital-map.install
8
9# 上游为每个架构给出不同的构建号，升级版本时必须同步核对
10_build_x86_64=34222
11_build_aarch64=34217
12_build_loong64=34217
13
14pkgdesc="Ovital Map (奥维互动地图) - cross-platform map browser"
15arch=('x86_64' 'aarch64' 'loong64')
16url="https://www.ovital.com"
17license=('LicenseRef-custom')
18depends=(
19 'alsa-lib'
20 'bzip2'
21 'dbus'
22 'expat'
23 'fontconfig'
24 'freetype2'
25 'gcc-libs'
26 'glib2'
27 'glu'
28 'gst-plugins-bad-libs'
29 'gst-plugins-base-libs'
30 'gstreamer'
31 'gtk-update-icon-cache'
32 'hicolor-icon-theme'
33 'libcups'
34 'libdrm'
35 'libglvnd'
36 'libpulse'
37 'libsm'
38 'libx11'
39 'libxcb'
40 'libxcomposite'
41 'libxcursor'
42 'libxdamage'
43 'libxext'
44 'libxfixes'
45 'libxi'
46 'libxkbcommon'
47 'libxkbcommon-x11'
48 'libxrandr'
49 'libxrender'
50 'libxtst'
51 'mesa'
52 'nspr'
53 'nss'
54 'qt5-base'
55 'xz'
56 'zlib'
57)
58# patchelf 用于清除上游留下的 /usr/local RUNPATH
59makedepends=('patchelf')
60options=('!strip')
61# 非自由软件、无源码分发，按 Nonfree applications package guidelines 不使用 -bin 后缀
62#
63# 上游不随 deb 分发许可文本，只提供网页版用户协议。LICENSE.html 是 2026-09-19
64# 取自 https://www.ovital.com/agreement/ 的副本，随源分发以便 package() 不需要
65# 联网（官方仓库与规范都要求构建过程离线，此前的 curl 取法不符合这一点）。
66
67source_x86_64=("Linux-x86_64-OMap-${pkgver}-build${_build_x86_64}.deb::https://cdn.ovital.com/pub/Linux-x86_64-OMap-${pkgver}-build${_build_x86_64}.deb")
68source_aarch64=("Linux-aarch64-OMap-${pkgver}-build${_build_aarch64}.deb::https://cdn.ovital.com/pub/Linux-aarch64-OMap-${pkgver}-build${_build_aarch64}.deb")
69source_loong64=("Linux-loongarch64-OMap-${pkgver}-build${_build_loong64}.deb::https://cdn.ovital.com/pub/Linux-loongarch64-OMap-${pkgver}-build${_build_loong64}.deb")
70b2sums_x86_64=('9ee49291c777a8d2cd8211cf6d7b139ef93cfa929adfe3086d1f281de0edb3d8bd09b0caaa3f1b108d127424970db755c1ff8ca128f593eeaa3c44981c6be15e')
71b2sums_aarch64=('b363ba1e997a5aadf2fad9cfbec05942dc8d39c0db977cd2e84455873e737df824103661bdb660a9231fc793678ac08ef2df0f58efc1cba62002d39b6579de04')
72b2sums_loong64=('d84411418ec1741c036d116ab62d0f8fc34a1ba4ff1fba748427a4229de37734bc021f364a03be6352ff0adff9da8e3b4a233cb407d73425f8bafa38abd8b5bc')
73
74package() {
75 local _debarch _build
76 case "$CARCH" in
77 x86_64) _debarch='x86_64'; _build="${_build_x86_64}" ;;
78 aarch64) _debarch='aarch64'; _build="${_build_aarch64}" ;;
79 loong64) _debarch='loongarch64'; _build="${_build_loong64}" ;;
80 *) error "不支持的架构: ${CARCH}"; return 1 ;;
81 esac
82
83 local _deb="Linux-${_debarch}-OMap-${pkgver}-build${_build}.deb"
84
85 bsdtar -O -xf "${_deb}" data.tar.gz | bsdtar -xzf - -C "$pkgdir"
86
87 # 上游 deb 里可执行位不完整
88 chmod 755 "$pkgdir/opt/com.ovital.map/OMapQT" \
89 "$pkgdir/opt/com.ovital.map/OMapQTUpgrade" \
90 "$pkgdir/opt/com.ovital.map/launcher"
91
92 # libQt5WebEngineCore 的 RUNPATH 指向构建机的 /usr/local/Qt-5.12.12/lib，
93 # 替换为相对 $ORIGIN，避免加载器去搜索不存在的系统路径
94 while IFS= read -r -d '' _so; do
95 local _rpath
96 _rpath=$(patchelf --print-rpath "${_so}" 2>/dev/null) || continue
97 [[ "${_rpath}" == *"/usr/local"* ]] && patchelf --set-rpath '$ORIGIN' "${_so}"
98 done < <(find "$pkgdir/opt/com.ovital.map" -type f \( -name '*.so' -o -name '*.so.*' \) -print0)
99
100 # launcher 在 Wayland 会话下有问题，桌面项直接调用 OMapQT；
101 # 同时修正非标准的 Categories
102 sed -i \
103 -e 's|^Exec=/opt/com.ovital.map/launcher|Exec=/opt/com.ovital.map/OMapQT|' \
104 -e 's|^Categories=Application$|Categories=Geography;Maps;|' \
105 "$pkgdir/usr/share/applications/ovital-map.desktop"
106
107 # 用户协议副本（随源分发，见文件头说明）
108 install -Dm644 "$startdir/LICENSE.html" \
109 "$pkgdir/usr/share/licenses/${pkgname}/LICENSE.html"
110}
111

Changes since previous scan

--- PKGBUILD @ 2026-09-27 13:18
+++ PKGBUILD @ 2026-09-27 15:19
@@ -1,86 +1,111 @@
-# Maintainer: SteamedFish <steamedfish@hotmail.com>
+# Maintainer: 15deg <204751610 at qq dot com>
+# Contributor: SteamedFish <steamedfish@hotmail.com>
+
pkgname=ovital-map
-pkgver=10.5.2
+pkgver=10.6.0
pkgrel=1
+install=ovital-map.install
+
+# 上游为每个架构给出不同的构建号，升级版本时必须同步核对
+_build_x86_64=34222
+_build_aarch64=34217
+_build_loong64=34217
+
pkgdesc="Ovital Map (奥维互动地图) - cross-platform map browser"
arch=('x86_64' 'aarch64' 'loong64')
url="https://www.ovital.com"
license=('LicenseRef-custom')
depends=(
- 'alsa-lib'
- 'dbus'
- 'fontconfig'
- 'freetype2'
- 'gcc-libs'
- 'glib2'
- 'glu'
- 'gstreamer'
- 'gst-plugins-base-libs'
- 'gst-plugins-bad-libs'
- 'gtk-update-icon-cache'
- 'hicolor-icon-theme'
- 'libcups'
- 'libpulse'
- 'libsm'
- 'libx11'
- 'libxcb'
- 'libxcomposite'
- 'libxcursor'
- 'libxdamage'
- 'libxext'
- 'libxfixes'
- 'libxi'
- 'libxkbcommon'
- 'libxkbcommon-x11'
- 'libxrandr'
- 'libxrender'
- 'libxtst'
- 'mesa'
- 'nspr'
- 'nss'
- 'qt5-base'
- 'zlib'
+ 'alsa-lib'
+ 'bzip2'
+ 'dbus'
+ 'expat'
+ 'fontconfig'
+ 'freetype2'
+ 'gcc-libs'
+ 'glib2'
+ 'glu'
+ 'gst-plugins-bad-libs'
+ 'gst-plugins-base-libs'
+ 'gstreamer'
+ 'gtk-update-icon-cache'
+ 'hicolor-icon-theme'
+ 'libcups'
+ 'libdrm'
+ 'libglvnd'
+ 'libpulse'
+ 'libsm'
+ 'libx11'
+ 'libxcb'
+ 'libxcomposite'
+ 'libxcursor'
+ 'libxdamage'
+ 'libxext'
+ 'libxfixes'
+ 'libxi'
+ 'libxkbcommon'
+ 'libxkbcommon-x11'
+ 'libxrandr'
+ 'libxrender'
+ 'libxtst'
+ 'mesa'
+ 'nspr'
+ 'nss'
+ 'qt5-base'
+ 'xz'
+ 'zlib'
)
+# patchelf 用于清除上游留下的 /usr/local RUNPATH
makedepends=('patchelf')
options=('!strip')
-source_x86_64=("Linux-x86_64-OMap-${pkgver}-build32687.deb::https://cdn.ovital.com/pub/Linux-x86_64-OMap-${pkgver}-build32687.deb")
-source_aarch64=("Linux-aarch64-OMap-${pkgver}-build32687.deb::https://cdn.ovital.com/pub/Linux-aarch64-OMap-${pkgver}-build32687.deb")
-source_loong64=("Linux-loongarch64-OMap-${pkgver}-build32687.deb::https://cdn.ovital.com/pub/Linux-loongarch64-OMap-${pkgver}-build32687.deb")
-b2sums_x86_64=('04e242c5c1c4b1eb2a2a5e71e478b82d6e40934734a0cd267c2fc5b03e1b6a490f698978726b39e9e427dbbf4ab50938d6e4b6e607e87c352307de4fd55f113d')
-b2sums_aarch64=('17f68109decda029f1d18731f69d276a2ab913995c5e7e634797ddc4b64e816d371066c764ad259b4882eab697a7c5f977378041f77c43faafcf85437405f044')
-b2sums_loong64=('5ed17f714efcfdb5b25d386f81a75ea7eb6d2630b43695f6946bab09340bf81db71c207c35fc346dc13f89f6ad48046d11ec8f8f90c856ea242d5e7378effbee')
+# 非自由软件、无源码分发，按 Nonfree applications package guidelines 不使用 -bin 后缀
+#
+# 上游不随 deb 分发许可文本，只提供网页版用户协议。LICENSE.html 是 2026-09-19
+# 取自 https://www.ovital.com/agreement/ 的副本，随源分发以便 package() 不需要
+# 联网（官方仓库与规范都要求构建过程离线，此前的 curl 取法不符合这一点）。
+
+source_x86_64=("Linux-x86_64-OMap-${pkgver}-build${_build_x86_64}.deb::https://cdn.ovital.com/pub/Linux-x86_64-OMap-${pkgver}-build${_build_x86_64}.deb")
+source_aarch64=("Linux-aarch64-OMap-${pkgver}-build${_build_aarch64}.deb::https://cdn.ovital.com/pub/Linux-aarch64-OMap-${pkgver}-build${_build_aarch64}.deb")
+source_loong64=("Linux-loongarch64-OMap-${pkgver}-build${_build_loong64}.deb::https://cdn.ovital.com/pub/Linux-loongarch64-OMap-${pkgver}-build${_build_loong64}.deb")
+b2sums_x86_64=('9ee49291c777a8d2cd8211cf6d7b139ef93cfa929adfe3086d1f281de0edb3d8bd09b0caaa3f1b108d127424970db755c1ff8ca128f593eeaa3c44981c6be15e')
+b2sums_aarch64=('b363ba1e997a5aadf2fad9cfbec05942dc8d39c0db977cd2e84455873e737df824103661bdb660a9231fc793678ac08ef2df0f58efc1cba62002d39b6579de04')
+b2sums_loong64=('d84411418ec1741c036d116ab62d0f8fc34a1ba4ff1fba748427a4229de37734bc021f364a03be6352ff0adff9da8e3b4a233cb407d73425f8bafa38abd8b5bc')
package() {
- local _debarch="${CARCH}"
- if [[ "${_debarch}" == 'loong64' ]]; then
- _debarch='loongarch64'
- fi
+ local _debarch _build
+ case "$CARCH" in
+ x86_64) _debarch='x86_64'; _build="${_build_x86_64}" ;;
+ aarch64) _debarch='aarch64'; _build="${_build_aarch64}" ;;
+ loong64) _debarch='loongarch64'; _build="${_build_loong64}" ;;
+ *) error "不支持的架构: ${CARCH}"; return 1 ;;
+ esac
- bsdtar -O -xf "Linux-${_debarch}-OMap-${pkgver}-build32687.deb" data.tar.gz | bsdtar -xzf - -C "$pkgdir"
+ local _deb="Linux-${_debarch}-OMap-${pkgver}-build${_build}.deb"
- # Fix permissions on executables
- chmod 755 "$pkgdir/opt/com.ovital.map/OMapQT"
- chmod 755 "$pkgdir/opt/com.ovital.map/OMapQTUpgrade"
- chmod 755 "$pkgdir/opt/com.ovital.map/launcher"
+ bsdtar -O -xf "${_deb}" data.tar.gz | bsdtar -xzf - -C "$pkgdir"
- # Replace insecure RUNPATHs containing /usr/local with relative $ORIGIN
- while IFS= read -r -d '' _so; do
- local _rpath
- _rpath=$(patchelf --print-rpath "$_so" 2>/dev/null) || continue
- [[ "$_rpath" == *"/usr/local"* ]] && patchelf --set-rpath '$ORIGIN' "$_so"
- done < <(find "$pkgdir/opt/com.ovital.map" -type f \( -name '*.so' -o -name '*.so.*' \) -print0)
+ # 上游 deb 里可执行位不完整
+ chmod 755 "$pkgdir/opt/com.ovital.map/OMapQT" \
+ "$pkgdir/opt/com.ovital.map/OMapQTUpgrade" \
+ "$pkgdir/opt/com.ovital.map/launcher"
- # Fix desktop entry to use OMapQT directly (launcher has Wayland issues)
- sed -i 's|^Exec=/opt/com.ovital.map/launcher|Exec=/opt/com.ovital.map/OMapQT|' \
- "$pkgdir/usr/share/applications/ovital-map.desktop"
+ # libQt5WebEngineCore 的 RUNPATH 指向构建机的 /usr/local/Qt-5.12.12/lib，
+ # 替换为相对 $ORIGIN，避免加载器去搜索不存在的系统路径
+ while IFS= read -r -d '' _so; do
+ local _rpath
+ _rpath=$(patchelf --print-rpath "${_so}" 2>/dev/null) || continue
+ [[ "${_rpath}" == *"/usr/local"* ]] && patchelf --set-rpath '$ORIGIN' "${_so}"
+ done < <(find "$pkgdir/opt/com.ovital.map" -type f \( -name '*.so' -o -name '*.so.*' \) -print0)
- # Fix invalid Categories entry
- sed -i 's|^Categories=Application$|Categories=Geography;Maps;|' \
- "$pkgdir/usr/share/applications/ovital-map.desktop"
+ # launcher 在 Wayland 会话下有问题，桌面项直接调用 OMapQT；
+ # 同时修正非标准的 Categories
+ sed -i \
+ -e 's|^Exec=/opt/com.ovital.map/launcher|Exec=/opt/com.ovital.map/OMapQT|' \
+ -e 's|^Categories=Application$|Categories=Geography;Maps;|' \
+ "$pkgdir/usr/share/applications/ovital-map.desktop"
- # Fetch and install upstream license text
- install -d "$pkgdir/usr/share/licenses/$pkgname"
- curl -sL "https://www.ovital.com/agreement/" \
- -o "$pkgdir/usr/share/licenses/$pkgname/LICENSE.html"
+ # 用户协议副本（随源分发，见文件头说明）
+ install -Dm644 "$startdir/LICENSE.html" \
+ "$pkgdir/usr/share/licenses/${pkgname}/LICENSE.html"
}

Scan history

Scanned at (UTC)SeverityRules
2026-09-27 15:19:08 Medium 2
2026-09-27 13:18:29 Medium 4
2026-06-19 19:07:35 Clean 3
2026-06-18 16:11:54 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion