qaac-wine

LOW

maintainer swordfeng 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads the iTunes installer from apple.com (official Apple domain) to extract Apple DLLs (CoreAudioToolbox, CoreFoundation, etc.) needed by qaac under Wine. This is a well-known, documented technique for running qaac on Linux. The iTunes installer has 'SKIP' for its checksum, which is sloppy but understandable since Apple updates the installer in-place at the same URL. The extracted DLLs are Apple's own libraries, not third-party or personal-host binaries. The qaac binaries themselves come from the official GitHub releases with a proper sha256sum. The COPYING and PDF also have SKIP checksums but are pure data/documentation. The check() function runs the Windows executables under Wine to verify they work. There is no unofficial or personal host involved — all sources are either GitHub official releases or apple.com. The missing checksums are a quality/reproducibility concern but not a meaningful supply-chain attack vector given the sources are official. This does not rise to medium severity.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD downloads the iTunes installer from apple.com (official Apple domain) to extract Apple DLLs (CoreAudioToolbox, CoreFoundation, etc.) needed by qaac under Wine. This is a well-known, documented technique for running qaac on Linux. The iTunes installer has 'SKIP' for its checksum, which is sloppy but understandable since Apple updates the installer in-place at the same URL. The extracted DLLs are Apple's own libraries, not third-party or personal-host binaries. The qaac binaries themselves come from the official GitHub releases with a proper sha256sum. The COPYING and PDF also have SKIP checksums but are pure data/documentation. The check() function runs the Windows executables under Wine to verify they work. There is no unofficial or personal host involved — all sources are either GitHub official releases or apple.com. The missing checksums are a quality/reproducibility concern but not a meaningful supply-chain attack vector given the sources are official. This does not rise to medium severity.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "iTunes64Setup.exe::https://www.apple.com/itunes/download/win64"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jianfeng Zhang <swordfeng123@gmail.com>
    
      2#
    
      3# Idea from http://www.andrews-corner.org/qaac.html
    
      4# Use at your own risk. Please read the COPYING and
    
      5# Apple Software License Agreement for iTunes for Windows
    
      6# carefully before use. Do NOT use if you disagree with them.
    
      7
    
      8pkgname=qaac-wine
    
      9_pkgname=qaac
    
      10pkgver=2.88
    
      11pkgrel=1
    
      12pkgdesc="QuickTime AAC/ALAC encoder (wine version)"
    
      13arch=('x86_64')
    
      14url="https://github.com/nu774/qaac"
    
      15license=('custom')
    
      16depends=('wine')
    
      17makedepends=('p7zip' 'wine' 'winetricks' 'binutils')
    
      18source=("https://github.com/nu774/qaac/releases/download/v${pkgver}/qaac_${pkgver}.zip"
    
      19        "iTunes64Setup.exe::https://www.apple.com/itunes/download/win64"
    
      20        "https://raw.githubusercontent.com/nu774/qaac/master/COPYING"
    
      21        "https://www.apple.com/legal/sla/docs/iTunesWindows.pdf"
    
      22        "wrapper.sh")
    
      23sha256sums=('1260ab096425f2c49042562c7ce1735435e681db60f14497df81e7b6d88fa118'
    
      24            'SKIP'
    
      25            'SKIP'
    
      26            'SKIP'
    
      27            '6591c998319680a4474ee93ffc3a50c9be143e53f2e636d8fe66538cde6aa1e3')
    
      28
    
      29extract_filename() {
    
      30    if [ "$(head -c 2 "$1" | tr -d '\0')" == "MZ" ]; then
    
      31        LC_ALL=C objdump -p "$f" 2>/dev/null | grep 'The Export Tables' -A 10 | awk '$1 == "Name" { print $3 }'
    
      32    fi
    
      33}
    
      34
    
      35build() {
    
      36    cd "${srcdir}"
    
      37    #mkdir -p wineprefix
    
      38    #export WINEPREFIX=$PWD/wineprefix
    
      39    #export WINEARCH=win64
    
      40    #wineserver -k || true
    
      41    #DISPLAY= winetricks win7
    
      42    #WINEDLLOVERRIDES=winemenubuilder.exe=d msiexec /i "${srcdir}/iTunes64.msi" /qn
    
      43    #wineserver -k || true
    
      44    7z x -y iTunes64.msi
    
      45    for f in fil*; do
    
      46        filename=$(extract_filename "$f")
    
      47        if [ ! -z "$filename" ]; then
    
      48            echo "$filename"
    
      49            mv "$f" "$filename"
    
      50        fi
    
      51    done
    
      52}
    
      53
    
      54check() {
    
      55    export WINEDEBUG=-all
    
      56    export WINEPATH="${srcdir}"
    
      57    export WINEPREFIX="${srcdir}/wineprefix"
    
      58
    
      59    wine "${srcdir}/qaac_${pkgver}/x64/qaac64.exe" --check && \
    
      60    wine "${srcdir}/qaac_${pkgver}/x64/refalac64.exe" --check
    
      61}
    
      62
    
      63package() {
    
      64    mkdir -p "${pkgdir}/usr/lib/qaac"
    
      65
    
      66    cd "${srcdir}"
    
      67    for f in qaac64.exe refalac64.exe; do
    
      68        install -Dm755 "qaac_${pkgver}/x64/${f}" "${pkgdir}/usr/lib/qaac/${f}"
    
      69    done
    
      70    for f in libsoxconvolver64.dll libsoxr64.dll; do
    
      71        install -Dm644 "qaac_${pkgver}/x64/${f}" "${pkgdir}/usr/lib/qaac/${f}"
    
      72    done
    
      73    local LIBICUDT_NAME=$(find . -name 'icudt*.dll' -printf '%f')
    
      74    for f in ASL.dll CoreAudioToolbox.dll CoreFoundation.dll $LIBICUDT_NAME libdispatch.dll libicuin.dll libicuuc.dll objc.dll; do
    
      75        install -Dm644 "${f}" "${pkgdir}/usr/lib/qaac/${f}"
    
      76    done
    
      77    install -Dm755 wrapper.sh "${pkgdir}/usr/lib/qaac/wrapper.sh"
    
      78
    
      79    mkdir -p "${pkgdir}/usr/bin"
    
      80    ln -s ../lib/qaac/wrapper.sh "${pkgdir}/usr/bin/qaac"
    
      81    ln -s ../lib/qaac/wrapper.sh "${pkgdir}/usr/bin/refalac"
    
      82
    
      83    mkdir -p "${pkgdir}/usr/share/licenses/qaac"
    
      84    install -Dm644 "COPYING" "${pkgdir}/usr/share/licenses/qaac/COPYING"
    
      85    install -Dm644 "iTunesWindows.pdf" "${pkgdir}/usr/share/licenses/qaac/iTunesWindows.pdf"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2