readcube-wine
maintainer Atherth
· 0 votes
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The package downloads a versioned, checksummed Windows installer directly from the official ReadCube/Digital Science update server (update.readcube.com) and installs it verbatim for Wine execution; no obfuscation, no exfiltration, no piped-to-shell payloads — the only concerns are that it runs a proprietary prebuilt executable and has few votes, but the source is the vendor's own official distribution infrastructure.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The package downloads a versioned, checksummed Windows installer directly from the official ReadCube/Digital Science update server (update.readcube.com) and installs it verbatim for Wine execution; no obfuscation, no exfiltration, no piped-to-shell payloads — the only concerns are that it runs a proprietary prebuilt executable and has few votes, but the source is the vendor's own official distribution infrastructure.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:35
source=("${_appname}-${pkgver}.exe::https://update.readcube.com/desktop5/updates/win32/x64/Papers_v${pkgver}.exe"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Esteban Rodriguez <esarodriguezme@gmail.com>
2
3
# Papers is proprietary software. The ReadCube Terms of Use forbid creating
4
# derivative works ("modify, translate, adapt or create derivative works"), so
5
# this package deliberately does NOT unpack or restructure the application.
6
#
7
# Per the Wine package guidelines, when a licence does not permit repackaging,
8
# "all the installing process must be done in the post_install phase [and] the
9
# build phase will only be for copying the install files". The upstream
10
# installer is therefore shipped verbatim and executed, unmodified, on first
11
# run. Because a Wine prefix is per-user state that root cannot create at
12
# pacman time, "post_install" here means the first launch of /usr/bin/readcube.
13
#
14
# Nothing is redistributed: the AUR carries only this PKGBUILD, and each user
15
# fetches the installer from Digital Science directly.
16
17
pkgname=readcube-wine
18
_appname=readcube
19
pkgver=5.0.32
20
pkgrel=1
21
pkgdesc="Reference and citation manager for academic research, via Wine"
22
arch=('x86_64')
23
url="https://www.papersapp.com/"
24
license=('LicenseRef-ReadCube-Terms')
25
depends=('wine' 'ttf-dejavu' 'ttf-liberation' 'hicolor-icon-theme')
26
makedepends=('icoutils' 'imagemagick')
27
provides=("$_appname")
28
conflicts=("$_appname")
29
install="${_appname}.install"
30
options=('!strip' '!debug')
31
32
# Immutable, versioned upstream artifact. New releases are announced in
33
# https://update.readcube.com/desktop5/updates/win32/x64/latest.yml
34
# which carries both the version and the upstream sha512.
35
source=("${_appname}-${pkgver}.exe::https://update.readcube.com/desktop5/updates/win32/x64/Papers_v${pkgver}.exe"
36
'readcube.sh'
37
'readcube.desktop'
38
'readcube.install'
39
'readcube-fonts.reg')
40
sha256sums=('5f72771a7ef87e1bce8d70c28512905305970fcfbbbe3341333fd92af93ac517'
41
'52a427d7d61c388585ddc031ee69952f72560490296bbc018b0938c482a59b99'
42
'08bce2bc75e7c2b9c7147443ef924b27affcba17b482d1b1a4e1de477801aeb1'
43
'70e307c95917012d3f0bea62fe283f36c2e19ec4df071cfed3191a307564dad5'
44
'da81ebea6f7fa7fb01e0fc3c73191760c8351df7afc57d361ac60b25c965c8c3')
45
noextract=("${_appname}-${pkgver}.exe")
46
47
build() {
48
cd "$srcdir"
49
rm -rf icons
50
install -d icons
51
52
# Desktop-integration artwork only. The icon is read from the installer's own
53
# PE resources; the application itself is never unpacked. icotool is not used
54
# to split it because the largest members are PNG-compressed, which it
55
# rejects ("incorrect total size of bitmap"), silently losing everything
56
# above 64px.
57
wrestool -x -t 14 -o icons "${_appname}-${pkgver}.exe"
58
magick icons/*.ico 'icons/readcube-%d.png'
59
}
60
61
package() {
62
cd "$srcdir"
63
64
# Upstream installer, byte-for-byte as published.
65
install -Dm644 "${_appname}-${pkgver}.exe" \
66
"$pkgdir/usr/share/$_appname/${_appname}-installer.exe"
67
68
install -Dm755 readcube.sh "$pkgdir/usr/bin/$_appname"
69
install -Dm644 readcube-fonts.reg "$pkgdir/usr/share/$_appname/fonts.reg"
70
install -Dm644 readcube.desktop "$pkgdir/usr/share/applications/$_appname.desktop"
71
72
for png in icons/readcube-*.png; do
73
size=$(magick identify -format '%w' "$png")
74
install -Dm644 "$png" \
75
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_appname.png"
76
done
77
78
# Upstream ships no licence file in the installer; point at the terms that
79
# actually govern use, so the package still documents its licence.
80
install -d "$pkgdir/usr/share/licenses/$pkgname"
81
printf '%s\n' \
82
'Papers by ReadCube is proprietary software of Digital Science.' \
83
'Use is governed by the ReadCube Terms of Use:' \
84
'' \
85
' https://about.readcube.com/terms/' \
86
'' \
87
'No part of the application is redistributed by this package: the' \
88
'upstream installer is downloaded from Digital Science at build time' \
89
'and executed unmodified on first run.' \
90
> "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
91
}
92
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 3 |
| 2026-08-17 00:18:29 | LOW | 3 |
| 2026-08-16 00:03:42 | LOW | 3 |
| 2026-08-15 00:26:13 | LOW | 3 |
| 2026-08-14 00:03:41 | LOW | 3 |
| 2026-08-13 00:17:07 | LOW | 3 |
| 2026-08-12 11:28:28 | LOW | 3 |
| 2026-08-12 11:23:23 | MEDIUM | 2 |