qwenwork-bin

MEDIUM

maintainer Adlyq 0 votes scanned 2026-09-22 03:38:16.605897

View on AUR

Why flagged

Downloads a prebuilt proprietary binary .deb from assets.qwenwork.cn (the project's own CDN) with SKIP'd checksums on a rolling 'latest' URL, meaning the binary cannot be verified and could be silently swapped; however the host is plausibly the official vendor domain, making this a medium-risk unverifiable prebuilt rather than clearly malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=("qwenworkcn-linux-amd64.deb::https://assets.qwenwork.cn/release/latest/qwenworkcn-linux-amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads a prebuilt proprietary binary .deb from assets.qwenwork.cn (the project's own CDN) with SKIP'd checksums on a rolling 'latest' URL, meaning the binary cannot be verified and could be silently swapped; however the host is plausibly the official vendor domain, making this a medium-risk unverifiable prebuilt rather than clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adlyq <adxlyq@gmail.com>
    
      2# Proprietary freeware repack. Upstream ships only a rolling "latest" URL,
    
      3# so checksums cannot be pinned (same as google-chrome).
    
      4pkgname=qwenwork-bin
    
      5_pkgname=qwen-work-cn
    
      6pkgver=1.0.5
    
      7pkgrel=1
    
      8pkgdesc="千问办公 (QwenWork) - Alibaba AI office desktop client"
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://qwenwork.cn"
    
      11license=('custom')
    
      12options=('!strip' '!debug')
    
      13depends=('gtk3' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core'
    
      14         'util-linux-libs' 'libsecret' 'libnotify' 'alsa-lib' 'libcups')
    
      15optdepends=('libappindicator-gtk3: system tray icon support')
    
      16provides=("$_pkgname")
    
      17conflicts=("$_pkgname")
    
      18source=("qwen-work-cn.desktop")
    
      19source_x86_64=("qwenworkcn-linux-amd64.deb::https://assets.qwenwork.cn/release/latest/qwenworkcn-linux-amd64.deb")
    
      20source_aarch64=("qwenworkcn-linux-arm64.deb::https://assets.qwenwork.cn/release/latest/qwenworkcn-linux-arm64.deb")
    
      21sha256sums=('2795320fa6a054ee35c45d9a19fa75a778a45baa7af724dfd874061d3c452d47')
    
      22sha256sums_x86_64=('SKIP')
    
      23sha256sums_aarch64=('SKIP')
    
      24
    
      25package() {
    
      26  local _deb
    
      27  if [[ $CARCH == x86_64 ]]; then
    
      28    _deb='qwenworkcn-linux-amd64.deb'
    
      29  else
    
      30    _deb='qwenworkcn-linux-arm64.deb'
    
      31  fi
    
      32
    
      33  bsdtar -xf "$srcdir/$_deb" -C "$srcdir" data.tar.xz
    
      34  bsdtar -xf "$srcdir/data.tar.xz" -C "$pkgdir"
    
      35
    
      36  install -Dm644 "$srcdir/qwen-work-cn.desktop" \
    
      37    "$pkgdir/usr/share/applications/qwen-work-cn.desktop"
    
      38
    
      39  install -d "$pkgdir/usr/bin"
    
      40  ln -s /opt/apps/QwenWorkCN/qwen-work-cn "$pkgdir/usr/bin/qwen-work-cn"
    
      41
    
      42  chmod 4755 "$pkgdir/opt/apps/QwenWorkCN/chrome-sandbox"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 03:38:16	Medium	3
2026-09-22 03:36:46	Medium	3