qqmusic-wine

maintainer itjesse · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two distinct concerns exist here: (1) The QQMusic installer is fetched from c.y.qq.com which is an official Tencent CDN endpoint for QQ Music downloads — the URL is a redirect/signing URL but the domain is legitimate. The sha256 is hardcoded and verified, so silent substitution is mitigated. (2) The Microsoft YaHei fonts (msyh.ttc, msyhbd.ttc) are fetched from 'files.exefiles.com', which is a third-party, unofficial font hosting site with no affiliation to Microsoft. These are copyrighted Microsoft fonts being redistributed from an unofficial host, which is both a licensing concern and a supply-chain risk — the fonts are installed into the Wine prefix and thus executed/used by the Wine environment. The sha256 checksums are present and hardcoded for both font files, which partially mitigates the supply-chain risk of silent substitution, but the host itself is unofficial and untrustworthy. Additionally, redistributing Microsoft's proprietary fonts (msyh.ttc/msyhbd.ttc) from a third-party host raises a piracy/license concern. The PKGBUILD also runs wine and winetricks during the build phase which is unusual and may cause issues in clean build environments, but is not a security issue per se. Overall: medium severity due to executed/installed content (fonts used by Wine) sourced from an unofficial third-party host, with a secondary piracy concern for the Microsoft fonts.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("QQMusic_Setup_2181.exe::https://c.y.qq.com/cgi-bin/file_redirect.fcg?bid=dldir&file=ecosfile%2Fmusic_clntupate%2Fpc%2Fother%2FQQMusic_Setup_2181.exe&sign=1-f2f6f38fa14d11365c487b508b8cad01dc0358f81e497fe8cee643f79c1b33d8-68b80801"
PKGBUILD:12 "msyh.ttc::https://files.exefiles.com/initial/m/msyh-ttc/d9adc6d2c21171c0f0b8dfbaec764b83/msyh.ttc"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): Two distinct concerns exist here: (1) The QQMusic installer is fetched from c.y.qq.com which is an official Tencent CDN endpoint for QQ Music downloads — the URL is a redirect/signing URL but the domain is legitimate. The sha256 is hardcoded and verified, so silent substitution is mitigated. (2) The Microsoft YaHei fonts (msyh.ttc, msyhbd.ttc) are fetched from 'files.exefiles.com', which is a third-party, unofficial font hosting site with no affiliation to Microsoft. These are copyrighted Microsoft fonts being redistributed from an unofficial host, which is both a licensing concern and a supply-chain risk — the fonts are installed into the Wine prefix and thus executed/used by the Wine environment. The sha256 checksums are present and hardcoded for both font files, which partially mitigates the supply-chain risk of silent substitution, but the host itself is unofficial and untrustworthy. Additionally, redistributing Microsoft's proprietary fonts (msyh.ttc/msyhbd.ttc) from a third-party host raises a piracy/license concern. The PKGBUILD also runs wine and winetricks during the build phase which is unusual and may cause issues in clean build environments, but is not a security issue per se. Overall: medium severity due to executed/installed content (fonts used by Wine) sourced from an unofficial third-party host, with a secondary piracy concern for the Microsoft fonts.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Jesse Zhu <jesse@itjesse.com>
    
      2pkgname=qqmusic-wine
    
      3pkgver=21.21
    
      4pkgrel=3
    
      5pkgdesc="QQ Music via Wine"
    
      6arch=('x86_64')
    
      7url="https://y.qq.com/"
    
      8license=('custom')
    
      9depends=('wine-staging' 'winetricks' 'wine-gecko')
    
      10makedepends=('wine-staging' 'winetricks')
    
      11source=("QQMusic_Setup_2181.exe::https://c.y.qq.com/cgi-bin/file_redirect.fcg?bid=dldir&file=ecosfile%2Fmusic_clntupate%2Fpc%2Fother%2FQQMusic_Setup_2181.exe&sign=1-f2f6f38fa14d11365c487b508b8cad01dc0358f81e497fe8cee643f79c1b33d8-68b80801"
    
      12        "msyh.ttc::https://files.exefiles.com/initial/m/msyh-ttc/d9adc6d2c21171c0f0b8dfbaec764b83/msyh.ttc"
    
      13        "msyhbd.ttc::https://files.exefiles.com/initial/m/msyhbd-ttc/db132f98d50f02f0ddb4ce4a5d847c97/msyhbd.ttc"
    
      14        "qqmusic-launcher.sh"
    
      15        "qqmusic.desktop"
    
      16)
    
      17sha256sums=('FEBE9BBC2D582ABFA6384E825991F70995C2EB1EF9869FAF09AA84F4FFAC2873'
    
      18            'd6a1a92bfd1249eccdd18a657189ed1f66704db429053b6d6c93b296eb9ef074'
    
      19            '0887451fa52c4685137a6df87720e607098ba81f14e7dd6f3d9c5319a558d59b'
    
      20            'SKIP'
    
      21            'SKIP')
    
      22
    
      23prepare() {
    
      24    # 设置 Wine prefix
    
      25    export WINEPREFIX="$srcdir/wineprefix"
    
      26    export WINEARCH=win64
    
      27    # wine-staging 已安装在系统标准路径
    
      28    
    
      29    echo "正在初始化 Wine 环境..."
    
      30    wineboot --init
    
      31    
    
      32    # 等待 Wine 完全初始化
    
      33    sleep 3
    
      34    
    
      35    echo "正在安装必需组件..."
    
      36    # 按顺序安装您指定的组件
    
      37    winetricks -q vcrun2015
    
      38    winetricks -q gdiplus
    
      39    winetricks -q quartz
    
      40    winetricks -q riched20
    
      41    winetricks -q dxvk
    
      42    
    
      43    echo "正在配置中文字体..."
    
      44    # 复制微软雅黑字体到 Wine 字体目录
    
      45    cp "$srcdir/msyh.ttc" "$WINEPREFIX/drive_c/windows/Fonts/"
    
      46    cp "$srcdir/msyhbd.ttc" "$WINEPREFIX/drive_c/windows/Fonts/"
    
      47    
    
      48    # 创建字体注册表文件
    
      49    cat > "$WINEPREFIX/font.reg" << 'EOF2'
    
      50REGEDIT4
    
      51
    
      52[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes]
    
      53"MS Shell Dlg"="msyh"
    
      54"MS Shell Dlg 2"="msyh"
    
      55
    
      56[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink]
    
      57"Lucida Sans Unicode"="msyh.ttc"
    
      58"Microsoft Sans Serif"="msyh.ttc"
    
      59"MS Sans Serif"="msyh.ttc"
    
      60"Tahoma"="msyh.ttc"
    
      61"Tahoma Bold"="msyhbd.ttc"
    
      62"msyh"="msyh.ttc"
    
      63"Arial"="msyh.ttc"
    
      64"Arial Black"="msyh.ttc"
    
      65EOF2
    
      66
    
      67    # 注册字体到 Wine
    
      68    wine regedit /S "$WINEPREFIX/font.reg"
    
      69    
    
      70    # 设置 Windows 版本为 Windows 7
    
      71    wine reg add "HKEY_CURRENT_USER\Software\Wine" /v Version /t REG_SZ /d win7 /f
    
      72    
    
      73    echo "中文字体配置完成"
    
      74    echo "系统配置完成"
    
      75    echo "Wine 环境配置完成"
    
      76}
    
      77
    
      78build() {
    
      79    export WINEPREFIX="$srcdir/wineprefix"
    
      80    # wine-staging 已安装在系统标准路径
    
      81    
    
      82    echo "正在安装 QQ音乐..."
    
      83    cd "$srcdir"
    
      84    
    
      85    wine "QQMusic_Setup_2181.exe" silence=1 runafterinstall=no
    
      86}
    
      87
    
      88package() {
    
      89    # 清理临时文件
    
      90    rm -rf "$srcdir/wineprefix/drive_c/users/$USER/AppData/Local/Temp"/*
    
      91    rm -rf "$srcdir/wineprefix/drive_c/users/$USER/AppData/Roaming/Microsoft/Windows/Recent"/*
    
      92    rm -rf "$srcdir/wineprefix/drive_c/windows/temp"/*
    
      93    
    
      94    # 安装 Wine prefix
    
      95    install -dm755 "$pkgdir/opt/$pkgname"
    
      96    cp -r "$srcdir/wineprefix" "$pkgdir/opt/$pkgname/"
    
      97    
    
      98    # 安装启动脚本
    
      99    install -Dm755 "$srcdir/qqmusic-launcher.sh" "$pkgdir/usr/bin/qqmusic-wine"
    
      100    
    
      101    # 安装桌面文件
    
      102    install -Dm644 "$srcdir/qqmusic.desktop" \
    
      103        "$pkgdir/usr/share/applications/qqmusic-wine.desktop"
    
      104    
    
      105    
    
      106    # 创建文档
    
      107    install -dm755 "$pkgdir/usr/share/doc/$pkgname"
    
      108    cat > "$pkgdir/usr/share/doc/$pkgname/README.md" << 'EOF2'
    
      109# QQ音乐 Wine 版本
    
      110
    
      111## 已安装组件
    
      112- riched20: 富文本控件
    
      113- quartz: 媒体播放框架
    
      114- dxvk: DirectX 支持
    
      115- vcrun2015: Visual C++ 2015 运行库
    
      116- gdiplus: GDI+ 图形库
    
      117- wine-gecko: HTML 渲染引擎
    
      118- 微软雅黑字体: 解决中文显示问题
    
      119
    
      120## 字体配置
    
      121已自动配置微软雅黑字体解决中文乱码问题。字体文件位置：
    
      122- msyh.ttc: 微软雅黑常规字体
    
      123- msyhbd.ttc: 微软雅黑粗体字体
    
      124
    
      125## 启动方式
    
      126命令行: qqmusic-wine
    
      127桌面: 在应用程序菜单中找到 "QQ音乐"
    
      128
    
      129## 故障排除
    
      130如果遇到问题，可以尝试：
    
      1311. 重新初始化配置目录: rm -rf ~/.config/qqmusic-wine
    
      1322. 查看详细日志: WINEDEBUG=+all qqmusic-wine
    
      1333. 禁用 DXVK: WINEDLLOVERRIDES="d3d11,dxgi=builtin" qqmusic-wine
    
      1344. 如果中文显示异常: 
    
      135   - 检查字体文件: ls ~/.config/qqmusic-wine/wineprefix/drive_c/windows/Fonts/msyh*
    
      136   - 重新配置字体: rm ~/.config/qqmusic-wine/wineprefix/font_configured && qqmusic-wine
    
      137EOF2
    
      138    
    
      139    # 设置权限
    
      140    chmod -R 755 "$pkgdir/opt/$pkgname"
    
      141}
    
      142

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2