qtalk-bin

MEDIUM

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary installer (.run file) from qim.qunar.com, which is Qunar's own infrastructure (Qunar is a major Chinese travel company and QTalk is their internal/external IM client). The binary is extracted and installed to /opt/qtalk. While qim.qunar.com appears to be the official vendor host, the source URL is not versioned/pinned (it fetches 'qtalk_setup_linux.run' without a version in the path, meaning the sha256sum provides the only integrity check against substitution). The package installs prebuilt binaries including shared libraries and executables directly to /opt. This is a legitimate medium-risk concern: it's a prebuilt binary from what appears to be the official vendor host, but the non-versioned URL means the checksum could become stale if the file is updated server-side, and there's no GPG signature verification. The risk is real but not indicative of malice — this is standard 'bin' package practice with the usual supply-chain caveats of trusting a vendor's binary distribution.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("qtalk_linux_$pkgver.bin::https://qim.qunar.com/win_2_0/downloads/qtalk_setup_linux.run"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.run file) from qim.qunar.com, which is Qunar's own infrastructure (Qunar is a major Chinese travel company and QTalk is their internal/external IM client). The binary is extracted and installed to /opt/qtalk. While qim.qunar.com appears to be the official vendor host, the source URL is not versioned/pinned (it fetches 'qtalk_setup_linux.run' without a version in the path, meaning the sha256sum provides the only integrity check against substitution). The package installs prebuilt binaries including shared libraries and executables directly to /opt. This is a legitimate medium-risk concern: it's a prebuilt binary from what appears to be the official vendor host, but the non-versioned URL means the checksum could become stale if the file is updated server-side, and there's no GPG signature verification. The risk is real but not indicative of malice — this is standard 'bin' package practice with the usual supply-chain caveats of trusting a vendor's binary distribution.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lightning1141 <lightning1141@gmail.com>
    
      2
    
      3pkgname=qtalk-bin
    
      4pkgver=2.1.010
    
      5pkgrel=1
    
      6pkgdesc="QTalk (Window/Linux) 2.0 by Qunar"
    
      7arch=("x86_64")
    
      8url="https://qim.qunar.com"
    
      9license=('custom')
    
      10conflicts=('qtalk')
    
      11provides=('qtalk')
    
      12makedepends=('tar')
    
      13depends=('qt5-base' 'qt5-webengine' 'qt5-multimedia' 'qt5-x11extras' 'qt5-quickcontrols' 'qt5-svg')
    
      14source=("qtalk_linux_$pkgver.bin::https://qim.qunar.com/win_2_0/downloads/qtalk_setup_linux.run"
    
      15  "com.qunar.QTalk.desktop"
    
      16  "qunarim.png"
    
      17)
    
      18sha256sums=("26f4a5145e7d46e3dfff164655c2aab07f9375a5ecb2985786c9b1c3e4fb810c"
    
      19  "0b827bc0ee931fc3c53d2bcf36cfef656dfbadf3b731d61ef75db628d5b5b1de"
    
      20  "2334ea114a2949301d583051cdb64c5c8186aaa8fc9f402ecd04decbaf775128"
    
      21)
    
      22
    
      23build() {
    
      24  msg "Extracting QTalk archive ..."
    
      25  tail +10 qtalk_linux_$pkgver.bin > QTalk.tar.bz2
    
      26  tar -jxvf QTalk.tar.bz2 -C "${srcdir}/"
    
      27  cp "com.qunar.QTalk.desktop" "${srcdir}/QTalk/com.qunar.QTalk.desktop"
    
      28  cp "qunarim.png" "${srcdir}/QTalk/qunarim.png"
    
      29}
    
      30
    
      31package() {
    
      32  msg "Preparing icons ..."
    
      33  install -d "${pkgdir}/usr/share/applications"
    
      34  install -m644 "${srcdir}/QTalk/com.qunar.QTalk.desktop" "${pkgdir}/usr/share/applications/"
    
      35  msg "Copying QTalk to /opt/qtalk..."
    
      36  install -d "${pkgdir}/opt/qtalk"
    
      37  cp -a ${srcdir}/QTalk/bin "${pkgdir}/opt/qtalk/bin"
    
      38  cp -a ${srcdir}/QTalk/res "${pkgdir}/opt/qtalk/res"
    
      39  cp -a ${srcdir}/QTalk/qunarim.png "${pkgdir}/opt/qtalk/qunarim.png"
    
      40  install -m755 "${srcdir}/QTalk/res/run.sh" "${pkgdir}/opt/qtalk/"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2