private_ding_zhejiang

MEDIUM

maintainer sinbud2004 0 votes scanned 2026-09-01 07:47:32.184737

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a GitHub release, which is an unverifiable executable from a potentially swappable host; worst case, an attacker could replace the binary with a malicious one if the maintainer's account is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a GitHub release, which is an unverifiable executable from a potentially swappable host; worst case, an attacker could replace the binary with a malicious one if the maintainer's account is compromised.

PKGBUILD

      1# Maintainer: sinbud2004 <sinbud2004@users.noreply.github.com>
    
      2pkgname=private_ding_zhejiang
    
      3pkgver=2.7.4.1
    
      4pkgrel=1
    
      5pkgdesc="浙政钉 (Zhejiang Government DingTalk) - AppImage build for ArchLinux"
    
      6arch=('x86_64')
    
      7url="https://github.com/Paul-sinbud2004/private_ding_zhejiang"
    
      8license=('unknown')
    
      9depends=('fuse2')
    
      10options=('!strip' '!emptydirs')
    
      11noextract=("${pkgname}-${pkgver}-x86_64.AppImage")
    
      12source=("${pkgname}.desktop" "logo.png")
    
      13source_x86_64=("${pkgname}-${pkgver}-x86_64.AppImage::${url}/releases/download/v${pkgver}/com.zjd.gov-${pkgver}-x86_64.AppImage")
    
      14sha256sums=('7644aa9276eb139a80802a18d02a5305b741088485b04023d38c3ec49e2dc09a'
    
      15            '446c94ccb30cf016f77f8bbf63619a608be4c7bf7faaa9d633a4d622e2e149ab')
    
      16sha256sums_x86_64=('040adb95111e9233a06ed1e9a8ce8104247e12c754c546857c5553703a893f91')
    
      17
    
      18prepare() {
    
      19    chmod +x "${srcdir}/${pkgname}-${pkgver}-x86_64.AppImage"
    
      20}
    
      21
    
      22package() {
    
      23    install -Dm755 "${srcdir}/${pkgname}-${pkgver}-x86_64.AppImage" \
    
      24        "${pkgdir}/opt/${pkgname}/${pkgname}-${pkgver}.AppImage"
    
      25    install -Dm644 "${srcdir}/${pkgname}.desktop" \
    
      26        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      27    install -Dm644 "${srcdir}/logo.png" \
    
      28        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
    
      29    install -d "${pkgdir}/usr/bin"
    
      30    ln -s "/opt/${pkgname}/${pkgname}-${pkgver}.AppImage" "${pkgdir}/usr/bin/${pkgname}"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 07:47:32	Medium	2