sunloginremote

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from down.oray.com (Oray's official distribution server for their Sunlogin remote-control software) and installs executables from it. While down.oray.com is the legitimate vendor distribution host for Oray/Sunlogin products, it is not a well-known package mirror and there is no way to independently verify the binary's integrity — notably, only the .deb itself has a b2sum while the other local source files are SKIP. The binary is extracted and installed directly into /opt and /usr/bin, meaning any compromise or substitution at the vendor's download server would result in arbitrary code execution on the user's machine. This is a genuine supply-chain concern (prebuilt proprietary binary from a vendor-controlled but non-auditable host), which justifies MEDIUM. It is not HIGH because there is no evidence of active malice, obfuscation, or exfiltration — it is the standard pattern for proprietary Linux software distributed as a .deb outside of official distro repos.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("https://down.oray.com/sunlogin/linux/${pkgname}-${pkgver}-amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from down.oray.com (Oray's official distribution server for their Sunlogin remote-control software) and installs executables from it. While down.oray.com is the legitimate vendor distribution host for Oray/Sunlogin products, it is not a well-known package mirror and there is no way to independently verify the binary's integrity — notably, only the .deb itself has a b2sum while the other local source files are SKIP. The binary is extracted and installed directly into /opt and /usr/bin, meaning any compromise or substitution at the vendor's download server would result in arbitrary code execution on the user's machine. This is a genuine supply-chain concern (prebuilt proprietary binary from a vendor-controlled but non-auditable host), which justifies MEDIUM. It is not HIGH because there is no evidence of active malice, obfuscation, or exfiltration — it is the standard pattern for proprietary Linux software distributed as a .deb outside of official distro repos.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Whyme Lyu <callme5long@gmail.com>
    
      2
    
      3# Original PKGBUILD copied from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=sunloginclient
    
      4# Credit goes to:
    
      5# yjun <jerrysteve1101 at gmail dot com>
    
      6# zhullyb <zhullyb at outlook dot com>
    
      7
    
      8pkgname=sunloginremote
    
      9pkgver=5.5.0.45114
    
      10pkgrel=1
    
      11pkgdesc='Proprietary software that remotely controls mobile devices, Windows, Mac, Linux and other systems. Enterprise edition.'
    
      12arch=(x86_64)
    
      13url='https://sunlogin.oray.com/product/support'
    
      14depends=(
    
      15  libappindicator-gtk3
    
      16  sh
    
      17  wqy-zenhei
    
      18)
    
      19license=(custom)
    
      20install=$pkgname.install
    
      21source=("https://down.oray.com/sunlogin/linux/${pkgname}-${pkgver}-amd64.deb"
    
      22        shim.sh
    
      23        tmpfiles.conf
    
      24        license.html)
    
      25b2sums=('ce5e29dcf218048d78033ed8f18bb75da82a5684f8773167a82f6b118572b15a0344913c2de0b1693c61f136c066e39e68541ebfbb65769e7105552336a9fc39'
    
      26        'SKIP'
    
      27        'SKIP'
    
      28        'SKIP')
    
      29
    
      30declare__root() {
    
      31  export _root="$srcdir/$pkgver-data"
    
      32}
    
      33
    
      34prepare() {
    
      35  declare__root
    
      36  mkdir -p "$_root"
    
      37  tar -xf data.tar.xz -C "$_root"
    
      38}
    
      39
    
      40_install() {
    
      41  find "opt/$pkgname/$1" -type f -exec \
    
      42      install -Dm$2 {} -t "${pkgdir}/opt/$pkgname/$1" \;
    
      43}
    
      44
    
      45build() {
    
      46  declare__root
    
      47  pushd "$_root"
    
      48
    
      49  desktop_file="usr/share/applications/$pkgname.desktop"
    
      50  test -r "$desktop_file"
    
      51  # fix path
    
      52  sed -i -e "
    
      53    s#Exec=/opt/$pkgname/bin/#Exec=/usr/bin/#
    
      54  " "$desktop_file"
    
      55
    
      56  popd
    
      57}
    
      58
    
      59package() {
    
      60  declare__root
    
      61  pushd "$_root"
    
      62
    
      63  # bin
    
      64  _install bin 755
    
      65
    
      66  _install res/skin 666
    
      67  _install res/icon 644
    
      68  mkdir -m=755 "$pkgdir/opt/$pkgname/res/font"
    
      69  ln -s ../../../../usr/share/fonts/wenquanyi/wqy-zenhei/wqy-zenhei.ttc \
    
      70    "$pkgdir/opt/$pkgname/res/font/"
    
      71
    
      72  install -Dm644 "opt/$pkgname/res/DRBELL.WAV" \
    
      73    -t "$pkgdir/opt/$pkgname/res"
    
      74
    
      75
    
      76  # desktop entry
    
      77  install -Dm644 usr/share/applications/$pkgname.desktop \
    
      78    -t "$pkgdir/usr/share/applications"
    
      79
    
      80  # icon ## TODO: use symlink instead
    
      81  install -Dm644 opt/$pkgname/res/icon/sunlogin_remote.png \
    
      82    "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      83
    
      84  # # license
    
      85  # install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
    
      86
    
      87  popd
    
      88
    
      89  install -Dm755 shim.sh "$pkgdir/usr/bin/$pkgname"
    
      90  install -Dm644 tmpfiles.conf "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      91  install -Dm644 license.html "$pkgdir/usr/share/licenses/sunloginremote/license.html"
    
      92}
    
      93

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2