qaac-wine
MEDIUM
maintainer swordfeng
4 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt iTunes installer from apple.com, a legitimate but non-standard host for Arch packages, and extracts binaries from it; while the source is plausible, the SKIP'd checksum for this critical binary introduces a supply-chain risk if the download were swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
"iTunes64Setup.exe::https://www.apple.com/itunes/download/win64"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt iTunes installer from apple.com, a legitimate but non-standard host for Arch packages, and extracts binaries from it; while the source is plausible, the SKIP'd checksum for this critical binary introduces a supply-chain risk if the download were swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jianfeng Zhang <swordfeng123@gmail.com>
2
#
3
# Idea from http://www.andrews-corner.org/qaac.html
4
# Use at your own risk. Please read the COPYING and
5
# Apple Software License Agreement for iTunes for Windows
6
# carefully before use. Do NOT use if you disagree with them.
7
8
pkgname=qaac-wine
9
_pkgname=qaac
10
pkgver=3.07
11
pkgrel=1
12
_flacver=1.5.0
13
pkgdesc="QuickTime AAC/ALAC encoder (wine version)"
14
arch=('x86_64')
15
url="https://github.com/nu774/qaac"
16
license=('LicenseRef-qaac' 'LicenseRef-Apple-iTunes-for-Windows' 'BSD-3-Clause')
17
depends=('wine')
18
makedepends=('p7zip' 'wine')
19
checkdepends=('ffmpeg')
20
source=("https://github.com/nu774/qaac/releases/download/v${pkgver}/qaac_${pkgver}.zip"
21
"iTunes64Setup.exe::https://www.apple.com/itunes/download/win64"
22
"https://raw.githubusercontent.com/nu774/qaac/master/COPYING"
23
"https://www.apple.com/legal/sla/docs/iTunesWindows.pdf"
24
"https://github.com/xiph/flac/releases/download/${_flacver}/flac-${_flacver}-win.zip"
25
"wrapper.sh")
26
sha256sums=('1fb3ab4aa81725e2607ac1b31afa0e13d2617ee6eb5900f5070c092f5271cbb3'
27
'SKIP'
28
'SKIP'
29
'SKIP'
30
'53f1500f0d6e7c61379d7fee50d4a9f7f504c650009506d9ba015530d76c0dde'
31
'6591c998319680a4474ee93ffc3a50c9be143e53f2e636d8fe66538cde6aa1e3')
32
33
extract_filename() {
34
if [ "$(head -c 2 "$1" | tr -d '\0')" == "MZ" ]; then
35
LC_ALL=C objdump -p "$f" 2>/dev/null | grep 'The Export Tables' -A 10 | awk '$1 == "Name" { print $3 }'
36
fi
37
}
38
39
build() {
40
cd "${srcdir}"
41
7z x -y iTunes64Setup.exe
42
7z x -y iTunes64.msi
43
for f in fil*; do
44
filename=$(extract_filename "$f")
45
if [ ! -z "$filename" ]; then
46
echo "$filename"
47
mv "$f" "$filename"
48
fi
49
done
50
}
51
52
check() (
53
set -e -o pipefail
54
export WINEDEBUG=-all WINEPATH="$srcdir" WINEPREFIX="$srcdir/wineprefix"
55
local bin="$srcdir/qaac_$pkgver/x64" work exe spec bits channels input
56
local codec profile rate count actual_channels
57
local -a ff=(ffmpeg -v error -xerror -nostdin -y)
58
install -m644 "$srcdir/flac-$_flacver-win/Win64/libFLAC.dll" "$bin/"
59
work=$(mktemp -d "$srcdir/flac-check.XXXXXX")
60
trap 'rm -rf -- "$work"' EXIT
61
cd "$work"
62
63
# Compare WAV format and every PCM byte, ignoring container metadata.
64
pcm() {
65
ffprobe -v error -select_streams a:0 -of csv=p=0 \
66
-show_entries stream=sample_rate,channels,bits_per_sample,duration_ts "$1"
67
"${ff[@]}" -i "$1" -c:a "pcm_s${bits}le" -f "s${bits}le" -
68
}
69
70
for exe in qaac64 refalac64; do
71
timeout 120 wine "$bin/$exe.exe" --check > "$exe.log" 2>&1
72
cat "$exe.log"
73
grep -q 'libFLAC ' "$exe.log"
74
done
75
for spec in '16 1' '24 2'; do
76
read -r bits channels <<< "$spec"
77
mkdir "$bits"
78
cd "$bits"
79
"${ff[@]}" -f lavfi -i 'aevalsrc=0.5*sin(2*PI*440*t)|0.5*sin(2*PI*660*t):s=44100:d=1' \
80
-ac "$channels" -c:a "pcm_s${bits}le" input.wav
81
"${ff[@]}" -i input.wav -c:a flac input.flac
82
pcm input.wav > expected.pcm
83
for exe in qaac64 refalac64; do
84
timeout 120 wine "$bin/$exe.exe" -s -A -o "$exe.m4a" input.flac
85
for input in input.flac "$exe.m4a"; do
86
timeout 120 wine "$bin/$exe.exe" -s -D -b "$bits" -o "$exe-${input##*.}.wav" "$input"
87
pcm "$exe-${input##*.}.wav" > actual.pcm
88
cmp expected.pcm actual.pcm
89
done
90
echo "PASS $exe: FLAC decode and ALAC round trip ($bits-bit, $channels channels)"
91
done
92
timeout 120 wine "$bin/qaac64.exe" -s -V 91 --adts -o output.aac input.flac
93
"${ff[@]}" -i output.aac -f null -
94
ffprobe -v error -count_frames -select_streams a:0 -of csv=p=0 \
95
-show_entries stream=codec_name,profile,sample_rate,channels,nb_read_frames output.aac > aac.info
96
IFS=, read -r codec profile rate actual_channels count < aac.info
97
[[ "$codec,$profile,$rate,$actual_channels" == "aac,LC,44100,$channels" && "$count" -ge 43 ]]
98
echo "PASS qaac: FLAC to AAC-LC ($bits-bit, $channels channels)"
99
cd ..
100
done
101
)
102
103
package() {
104
mkdir -p "${pkgdir}/usr/lib/qaac"
105
106
cd "${srcdir}"
107
for f in qaac64.exe refalac64.exe; do
108
install -Dm755 "qaac_${pkgver}/x64/${f}" "${pkgdir}/usr/lib/qaac/${f}"
109
done
110
install -Dm644 "qaac_${pkgver}/x64/libsoxr64.dll" \
111
"${pkgdir}/usr/lib/qaac/libsoxr64.dll"
112
install -Dm644 "flac-${_flacver}-win/Win64/libFLAC.dll" \
113
"${pkgdir}/usr/lib/qaac/libFLAC.dll"
114
local LIBICUDT_NAME=$(find . -name 'icudt*.dll' -printf '%f')
115
for f in ASL.dll CoreAudioToolbox.dll CoreFoundation.dll $LIBICUDT_NAME libdispatch.dll libicuin.dll libicuuc.dll objc.dll; do
116
install -Dm644 "${f}" "${pkgdir}/usr/lib/qaac/${f}"
117
done
118
install -Dm755 wrapper.sh "${pkgdir}/usr/lib/qaac/wrapper.sh"
119
120
mkdir -p "${pkgdir}/usr/bin"
121
ln -s ../lib/qaac/wrapper.sh "${pkgdir}/usr/bin/qaac"
122
ln -s ../lib/qaac/wrapper.sh "${pkgdir}/usr/bin/refalac"
123
124
mkdir -p "${pkgdir}/usr/share/licenses/${pkgname}"
125
install -Dm644 "flac-${_flacver}-win/COPYING.Xiph" \
126
"${pkgdir}/usr/share/licenses/${pkgname}/COPYING.FLAC"
127
install -Dm644 "COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/COPYING"
128
install -Dm644 "iTunesWindows.pdf" "${pkgdir}/usr/share/licenses/${pkgname}/iTunesWindows.pdf"
129
}
130
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |