shalou

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from a Tencent Cloud Object Storage (COS) bucket (myqcloud.com is the official Tencent Cloud COS domain, not a random personal host), belonging to app-1320188180, which appears to be the vendor's own cloud storage for distribution. The sha256sum is pinned, which mitigates casual tampering. However, this is still a prebuilt closed-source binary from a non-official-repository host (not the project's own domain shalou.net, and not a well-known mirror), and the binary is executed directly on the user's system. The package installs into /opt, /usr/bin, /usr/lib etc. If the COS bucket were compromised or the maintainer changed the URL without updating the checksum, a malicious binary could be delivered. This is a genuine medium supply-chain concern: a prebuilt executable from an unofficial/cloud-storage host with a pinned hash but no additional verification (e.g., GPG signature). The cheaper model's assessment is correct in classification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:49 source=("https://app-1320188180.cos.ap-nanjing.myqcloud.com/pc/install/${pkgver}/shalou${pkgver}.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt binary .deb from a Tencent Cloud Object Storage (COS) bucket (myqcloud.com is the official Tencent Cloud COS domain, not a random personal host), belonging to app-1320188180, which appears to be the vendor's own cloud storage for distribution. The sha256sum is pinned, which mitigates casual tampering. However, this is still a prebuilt closed-source binary from a non-official-repository host (not the project's own domain shalou.net, and not a well-known mirror), and the binary is executed directly on the user's system. The package installs into /opt, /usr/bin, /usr/lib etc. If the COS bucket were compromised or the maintainer changed the URL without updating the checksum, a malicious binary could be delivered. This is a genuine medium supply-chain concern: a prebuilt executable from an unofficial/cloud-storage host with a pinned hash but no additional verification (e.g., GPG signature). The cheaper model's assessment is correct in classification.

PKGBUILD

1 offending line(s) highlighted

      1# contributor: Asuka Minato <i at asukaminato dot eu dot org>
    
      2pkgname=shalou
    
      3pkgver=6.6.3
    
      4pkgrel=1
    
      5pkgdesc="沙漏验机 - 是一款专业的苹果验机助手、苹果刷机助手"
    
      6arch=(x86_64)
    
      7url="www.shalou.net"
    
      8license=('custom')
    
      9depends=(libxtst
    
libxcursor
    
cairo
    
libxrender
    
libxi
    
expat
    
wayland
    
at-spi2-core
    
libx11
    
alsa-lib
    
libxml2
    
libdrm
    
fontconfig
    
libxkbcommon-x11
    
qt5-speech
    
qt5-location
    
qt5-tools
    
qt5-websockets
    
zlib
    
libxkbcommon
    
gdk-pixbuf2
    
qt5-wayland
    
pango
    
qt5-base
    
libxcomposite
    
nspr
    
gtk3
    
qt5-multimedia
    
gstreamer
    
freetype2
    
gst-plugins-base-libs
    
libxdamage
    
nss
    
libcups
    
glib2
    
glibc
    
dbus
    
libxext libxfixes libxcb libglvnd libpulse gcc-libs)
    
      47provides=()
    
      48options=(!strip) # or it will error
    
      49source=("https://app-1320188180.cos.ap-nanjing.myqcloud.com/pc/install/${pkgver}/shalou${pkgver}.deb")
    
      50sha256sums=('5200bf5423b8f5c4186d6cfb737d89963cc4077f0d72733594177b5262f6d5a3')
    
      51
    
      52package() {
    
bsdtar -xvf data.tar.* -C $pkgdir
    
mv $pkgdir/lib/ $pkgdir/usr/lib/
    
mv $pkgdir/bin/ $pkgdir/usr/bin/
    
chown root:root -R $pkgdir
    
chmod 755 $pkgdir/etc/
    
chmod 755 $pkgdir/etc/udev/
    
chmod 755 $pkgdir/etc/udev/rules.d/
    
chmod 755 $pkgdir/opt/
    
chmod 755 $pkgdir/usr/
    
chmod 755 $pkgdir/usr/bin/
    
chmod 755 $pkgdir/usr/lib/
    
chmod 755 $pkgdir/usr/lib/udev/
    
chmod 755 $pkgdir/usr/lib/udev/rules.d/
    
chmod 755 $pkgdir/usr/share/
    
chmod 755 $pkgdir/usr/share/applications/
    
# todo: a lot of qt5 lib remain undeleted, I am not sure, so I keep them there.
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2