qaac-wine

maintainer swordfeng · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD downloads the iTunes installer from apple.com (official Apple domain) to extract Apple DLLs (CoreAudioToolbox, CoreFoundation, etc.) needed by qaac under Wine. This is a well-known, documented technique for running qaac on Linux. The iTunes installer has 'SKIP' for its checksum, which is sloppy but understandable since Apple updates the installer in-place at the same URL. The extracted DLLs are Apple's own libraries, not third-party or personal-host binaries. The qaac binaries themselves come from the official GitHub releases with a proper sha256sum. The COPYING and PDF also have SKIP checksums but are pure data/documentation. The check() function runs the Windows executables under Wine to verify they work. There is no unofficial or personal host involved — all sources are either GitHub official releases or apple.com. The missing checksums are a quality/reproducibility concern but not a meaningful supply-chain attack vector given the sources are official. This does not rise to medium severity.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD downloads the iTunes installer from apple.com (official Apple domain) to extract Apple DLLs (CoreAudioToolbox, CoreFoundation, etc.) needed by qaac under Wine. This is a well-known, documented technique for running qaac on Linux. The iTunes installer has 'SKIP' for its checksum, which is sloppy but understandable since Apple updates the installer in-place at the same URL. The extracted DLLs are Apple's own libraries, not third-party or personal-host binaries. The qaac binaries themselves come from the official GitHub releases with a proper sha256sum. The COPYING and PDF also have SKIP checksums but are pure data/documentation. The check() function runs the Windows executables under Wine to verify they work. There is no unofficial or personal host involved — all sources are either GitHub official releases or apple.com. The missing checksums are a quality/reproducibility concern but not a meaningful supply-chain attack vector given the sources are official. This does not rise to medium severity.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "iTunes64Setup.exe::https://www.apple.com/itunes/download/win64"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jianfeng Zhang <swordfeng123@gmail.com>
    
      2#
    
      3# Idea from http://www.andrews-corner.org/qaac.html
    
      4# Use at your own risk. Please read the COPYING and
    
      5# Apple Software License Agreement for iTunes for Windows
    
      6# carefully before use. Do NOT use if you disagree with them.
    
      7
    
      8pkgname=qaac-wine
    
      9_pkgname=qaac
    
      10pkgver=2.88
    
      11pkgrel=1
    
      12pkgdesc="QuickTime AAC/ALAC encoder (wine version)"
    
      13arch=('x86_64')
    
      14url="https://github.com/nu774/qaac"
    
      15license=('custom')
    
      16depends=('wine')
    
      17makedepends=('p7zip' 'wine' 'winetricks' 'binutils')
    
      18source=("https://github.com/nu774/qaac/releases/download/v${pkgver}/qaac_${pkgver}.zip"
    
      19        "iTunes64Setup.exe::https://www.apple.com/itunes/download/win64"
    
      20        "https://raw.githubusercontent.com/nu774/qaac/master/COPYING"
    
      21        "https://www.apple.com/legal/sla/docs/iTunesWindows.pdf"
    
      22        "wrapper.sh")
    
      23sha256sums=('1260ab096425f2c49042562c7ce1735435e681db60f14497df81e7b6d88fa118'
    
      24            'SKIP'
    
      25            'SKIP'
    
      26            'SKIP'
    
      27            '6591c998319680a4474ee93ffc3a50c9be143e53f2e636d8fe66538cde6aa1e3')
    
      28
    
      29extract_filename() {
    
      30    if [ "$(head -c 2 "$1" | tr -d '\0')" == "MZ" ]; then
    
      31        LC_ALL=C objdump -p "$f" 2>/dev/null | grep 'The Export Tables' -A 10 | awk '$1 == "Name" { print $3 }'
    
      32    fi
    
      33}
    
      34
    
      35build() {
    
      36    cd "${srcdir}"
    
      37    #mkdir -p wineprefix
    
      38    #export WINEPREFIX=$PWD/wineprefix
    
      39    #export WINEARCH=win64
    
      40    #wineserver -k || true
    
      41    #DISPLAY= winetricks win7
    
      42    #WINEDLLOVERRIDES=winemenubuilder.exe=d msiexec /i "${srcdir}/iTunes64.msi" /qn
    
      43    #wineserver -k || true
    
      44    7z x -y iTunes64.msi
    
      45    for f in fil*; do
    
      46        filename=$(extract_filename "$f")
    
      47        if [ ! -z "$filename" ]; then
    
      48            echo "$filename"
    
      49            mv "$f" "$filename"
    
      50        fi
    
      51    done
    
      52}
    
      53
    
      54check() {
    
      55    export WINEDEBUG=-all
    
      56    export WINEPATH="${srcdir}"
    
      57    export WINEPREFIX="${srcdir}/wineprefix"
    
      58
    
      59    wine "${srcdir}/qaac_${pkgver}/x64/qaac64.exe" --check && \
    
      60    wine "${srcdir}/qaac_${pkgver}/x64/refalac64.exe" --check
    
      61}
    
      62
    
      63package() {
    
      64    mkdir -p "${pkgdir}/usr/lib/qaac"
    
      65
    
      66    cd "${srcdir}"
    
      67    for f in qaac64.exe refalac64.exe; do
    
      68        install -Dm755 "qaac_${pkgver}/x64/${f}" "${pkgdir}/usr/lib/qaac/${f}"
    
      69    done
    
      70    for f in libsoxconvolver64.dll libsoxr64.dll; do
    
      71        install -Dm644 "qaac_${pkgver}/x64/${f}" "${pkgdir}/usr/lib/qaac/${f}"
    
      72    done
    
      73    local LIBICUDT_NAME=$(find . -name 'icudt*.dll' -printf '%f')
    
      74    for f in ASL.dll CoreAudioToolbox.dll CoreFoundation.dll $LIBICUDT_NAME libdispatch.dll libicuin.dll libicuuc.dll objc.dll; do
    
      75        install -Dm644 "${f}" "${pkgdir}/usr/lib/qaac/${f}"
    
      76    done
    
      77    install -Dm755 wrapper.sh "${pkgdir}/usr/lib/qaac/wrapper.sh"
    
      78
    
      79    mkdir -p "${pkgdir}/usr/bin"
    
      80    ln -s ../lib/qaac/wrapper.sh "${pkgdir}/usr/bin/qaac"
    
      81    ln -s ../lib/qaac/wrapper.sh "${pkgdir}/usr/bin/refalac"
    
      82
    
      83    mkdir -p "${pkgdir}/usr/share/licenses/qaac"
    
      84    install -Dm644 "COPYING" "${pkgdir}/usr/share/licenses/qaac/COPYING"
    
      85    install -Dm644 "iTunesWindows.pdf" "${pkgdir}/usr/share/licenses/qaac/iTunesWindows.pdf"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2