qtalk-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (.run file) from qim.qunar.com, which is Qunar's own infrastructure (Qunar is a major Chinese travel company and QTalk is their internal/external IM client). The binary is extracted and installed to /opt/qtalk. While qim.qunar.com appears to be the official vendor host, the source URL is not versioned/pinned (it fetches 'qtalk_setup_linux.run' without a version in the path, meaning the sha256sum provides the only integrity check against substitution). The package installs prebuilt binaries including shared libraries and executables directly to /opt. This is a legitimate medium-risk concern: it's a prebuilt binary from what appears to be the official vendor host, but the non-versioned URL means the checksum could become stale if the file is updated server-side, and there's no GPG signature verification. The risk is real but not indicative of malice — this is standard 'bin' package practice with the usual supply-chain caveats of trusting a vendor's binary distribution.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("qtalk_linux_$pkgver.bin::https://qim.qunar.com/win_2_0/downloads/qtalk_setup_linux.run"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.run file) from qim.qunar.com, which is Qunar's own infrastructure (Qunar is a major Chinese travel company and QTalk is their internal/external IM client). The binary is extracted and installed to /opt/qtalk. While qim.qunar.com appears to be the official vendor host, the source URL is not versioned/pinned (it fetches 'qtalk_setup_linux.run' without a version in the path, meaning the sha256sum provides the only integrity check against substitution). The package installs prebuilt binaries including shared libraries and executables directly to /opt. This is a legitimate medium-risk concern: it's a prebuilt binary from what appears to be the official vendor host, but the non-versioned URL means the checksum could become stale if the file is updated server-side, and there's no GPG signature verification. The risk is real but not indicative of malice — this is standard 'bin' package practice with the usual supply-chain caveats of trusting a vendor's binary distribution.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lightning1141 <lightning1141@gmail.com>
    
      2
    
      3pkgname=qtalk-bin
    
      4pkgver=2.1.010
    
      5pkgrel=1
    
      6pkgdesc="QTalk (Window/Linux) 2.0 by Qunar"
    
      7arch=("x86_64")
    
      8url="https://qim.qunar.com"
    
      9license=('custom')
    
      10conflicts=('qtalk')
    
      11provides=('qtalk')
    
      12makedepends=('tar')
    
      13depends=('qt5-base' 'qt5-webengine' 'qt5-multimedia' 'qt5-x11extras' 'qt5-quickcontrols' 'qt5-svg')
    
      14source=("qtalk_linux_$pkgver.bin::https://qim.qunar.com/win_2_0/downloads/qtalk_setup_linux.run"
    
      15  "com.qunar.QTalk.desktop"
    
      16  "qunarim.png"
    
      17)
    
      18sha256sums=("26f4a5145e7d46e3dfff164655c2aab07f9375a5ecb2985786c9b1c3e4fb810c"
    
      19  "0b827bc0ee931fc3c53d2bcf36cfef656dfbadf3b731d61ef75db628d5b5b1de"
    
      20  "2334ea114a2949301d583051cdb64c5c8186aaa8fc9f402ecd04decbaf775128"
    
      21)
    
      22
    
      23build() {
    
      24  msg "Extracting QTalk archive ..."
    
      25  tail +10 qtalk_linux_$pkgver.bin > QTalk.tar.bz2
    
      26  tar -jxvf QTalk.tar.bz2 -C "${srcdir}/"
    
      27  cp "com.qunar.QTalk.desktop" "${srcdir}/QTalk/com.qunar.QTalk.desktop"
    
      28  cp "qunarim.png" "${srcdir}/QTalk/qunarim.png"
    
      29}
    
      30
    
      31package() {
    
      32  msg "Preparing icons ..."
    
      33  install -d "${pkgdir}/usr/share/applications"
    
      34  install -m644 "${srcdir}/QTalk/com.qunar.QTalk.desktop" "${pkgdir}/usr/share/applications/"
    
      35  msg "Copying QTalk to /opt/qtalk..."
    
      36  install -d "${pkgdir}/opt/qtalk"
    
      37  cp -a ${srcdir}/QTalk/bin "${pkgdir}/opt/qtalk/bin"
    
      38  cp -a ${srcdir}/QTalk/res "${pkgdir}/opt/qtalk/res"
    
      39  cp -a ${srcdir}/QTalk/qunarim.png "${pkgdir}/opt/qtalk/qunarim.png"
    
      40  install -m755 "${srcdir}/QTalk/res/run.sh" "${pkgdir}/opt/qtalk/"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2