quik
LOW
maintainer CupIvan
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source files from official project domains (arqatech.com, quik.ru) and GitHub, which are plausibly legitimate; the non-standard hosts are part of the project's own infrastructure, and the downloaded content consists of versioned update packages and libraries intended for local installation, with no evidence of remote code execution or malicious payloads.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from official project domains (arqatech.com, quik.ru) and GitHub, which are plausibly legitimate; the non-standard hosts are part of the project's own infrastructure, and the downloaded content consists of versioned update packages and libraries intended for local installation, with no evidence of remote code execution or malicious payloads.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
"https://arqatech.com/upload/iblock/d50/quik_${pkgver}_upd.zip" -
PKGBUILD:17
"ftp://ftp.quik.ru/public/updates/10.2/StratVolat_${stratver}_upd.zip"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: CupIvan <mail@cupivan.ru>
2
pkgname=quik
3
pkgver=13.0.2
4
pkgrel=1
5
stratver=3.0.5
6
#trustver=2.10.0
7
#btradever=1.2.1002
8
pkgdesc="Trading terminal in Wine"
9
url="https://arqatech.com/ru/products/quik/terminals/user-applications/quik-workstation/"
10
arch=('x86_64')
11
12
noextract=('keygen.zip')
13
depends=('wine' 'unixodbc')
14
15
source=(
16
"https://arqatech.com/upload/iblock/d50/quik_${pkgver}_upd.zip"
17
"ftp://ftp.quik.ru/public/updates/10.2/StratVolat_${stratver}_upd.zip"
18
#"ftp://ftp.quik.ru/public/updates/11.2/TrustManager_${trustver}_upd.zip"
19
#"ftp://ftp.quik.ru/public/updates/10.2/BTrading_${btradever}_upd.zip"
20
"keygen.zip::ftp://ftp.quik.ru/public/updates/keygen_1.3.0_upd.zip"
21
"https://github.com/alain-riedinger/luasocket/releases/download/3.0-5.3.5/luasocket-3.0-5.3.5.zip"
22
"https://github.com/alain-riedinger/luasocket/releases/download/3.1-5.4.7/luasocket-3.1-5.4.7.zip"
23
"quik"
24
"quik-keygen"
25
"qrypto.cfg"
26
"ip.cfg"
27
)
28
sha256sums=(
29
'8a05ca65590f2c1bf3a36e6f196f81625b17c0d8fb93b133fa9696e210eaf420' # quik_13.0.2_upd.zip
30
'd32095309cd7359f4078a74179d8ae42e013e3fd3ad75837f0fa3941e7091b75' # StratVolat 3.0.5
31
#'ff4dd52e56fabe8c06730daca770a92312338303bc06b58d417105d44c5a0869' # TrustManager
32
#'0f6724e6666c379cf9a1f53aa627f4b0c56fded2d7e3fbf3704d6526066fa8e3' # BasketTrading
33
'bc66665d2209836abe51ae9258c289c0f682dba4ea5261f9319996a60a6a4ae7' # keygen
34
'b2a3a2e2a895cea35aad5dee97640ef7bcccbb38e61e61b14baff6cecbdd79af' # lua-socket 5.3.5
35
'f45993d0f5d1d84fe0c084433505d3a84babd6f5686fc2c3c7a7119b9727e927' # lua-socket 5.4.7
36
'70f46a29703b822ddff8b502c07697a05e478b7de51b9e55d67c4dc37e1bb80f' # quik
37
'758f427eccd973964ce6fcf8d0dd3064bf694096ee56f6d49e27e165ecab54c4' # quik-keygen
38
'd981ee4cc35d33a3b37c43fb7343bde5c24e15e003dbb67907b602d22f60a469'
39
'49aa53c38ceb5c3029398203a68bbb1b3cc9819d01ecb57a6ce13c31b344fe03' # ip.cfg
40
)
41
42
prepare() {
43
mkdir -p {keygen,socket-5.3,socket-5.4}
44
bsdtar -xzf keygen.zip -C keygen
45
bsdtar -xzf luasocket-3.0-5.3.5.zip -C socket-5.3
46
bsdtar -xzf luasocket-3.1-5.4.7.zip -C socket-5.4
47
48
# bugfix in luasock 5.4 @url https://gist.github.com/ttys3/31dbf88ee7d708294d8ae5b0a4954424
49
# cd ./socket-5.4/x64/socket/
50
# cat http.lua | sed 's/receive()/receive("*l")/' > tmp; mv tmp http.lua
51
# cat tp.lua | sed 's/receive()/receive("*l")/' > tmp; mv tmp tp.lua
52
}
53
54
package() {
55
bindir="${pkgdir}/usr/lib/quik/bin"
56
# quik
57
install -Dm755 quik "${pkgdir}/usr/bin/quik"
58
for fname in ./*.exe; do install -Dm755 $fname "$bindir/$fname"; done
59
for fname in ./*.dll; do install -Dm644 $fname "$bindir/$fname"; done
60
for fname in ./*.chm; do install -Dm644 $fname "$bindir/$fname"; done
61
for fname in ./*.cfg; do install -Dm644 $fname "$bindir/$fname"; done
62
63
# keygen
64
install -Dm755 quik-keygen "${pkgdir}/usr/bin/"
65
for fname in ./keygen/*.exe; do install -Dm755 $fname "$bindir/$fname"; done
66
for fname in ./keygen/*.dll; do install -Dm644 $fname "$bindir/$fname"; done
67
for fname in ./keygen/*.chm; do install -Dm644 $fname "$bindir/$fname"; done
68
69
# libs
70
cd "${srcdir}/socket-5.3/x64/"
71
for fname in {mime/core.dll,socket/core.dll}; do install -Dm644 $fname "$bindir/../lib/lua/5.3/$fname"; done
72
for fname in {*.lua,socket/*.lua}; do install -Dm644 $fname "$bindir/../share/lua/5.3/$fname"; done
73
cd "${srcdir}/socket-5.4/x64/"
74
for fname in {mime/core.dll,socket/core.dll}; do install -Dm644 $fname "$bindir/../lib/lua/5.4/$fname"; done
75
for fname in {*.lua,socket/*.lua}; do install -Dm644 $fname "$bindir/../share/lua/5.4/$fname"; done
76
}
77
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |