tencent-docs-bin

maintainer cheeseounce · 8 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt .deb binaries (containing an executed binary 'tdappdesktop') directly from docs.qq.com using 'version_id=latest' — a floating/mutable URL with no pinned version and SKIP'd checksums. This means the downloaded binary can change at any time without any integrity verification. While docs.qq.com is the official Tencent Docs domain (matching the package URL), the use of SKIP for checksums on an executed binary is a genuine supply-chain concern: if Tencent's CDN or API endpoint were compromised or silently updated, users would receive and execute arbitrary code with no integrity check. The 'latest' version parameter also means the pkgver in the PKGBUILD may not match what is actually installed. This is a real medium-severity concern — not clearly malicious, but the lack of checksums on executed binaries from a mutable endpoint is a legitimate packaging risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("${pkgname}-${pkgver}-${pkgrel}-x86_64.deb::https://docs.qq.com/api/package/get?channel_id=30001&version_id=latest&package_name=TencentDocs-x64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt .deb binaries (containing an executed binary 'tdappdesktop') directly from docs.qq.com using 'version_id=latest' — a floating/mutable URL with no pinned version and SKIP'd checksums. This means the downloaded binary can change at any time without any integrity verification. While docs.qq.com is the official Tencent Docs domain (matching the package URL), the use of SKIP for checksums on an executed binary is a genuine supply-chain concern: if Tencent's CDN or API endpoint were compromised or silently updated, users would receive and execute arbitrary code with no integrity check. The 'latest' version parameter also means the pkgver in the PKGBUILD may not match what is actually installed. This is a real medium-severity concern — not clearly malicious, but the lack of checksums on executed binaries from a mutable endpoint is a legitimate packaging risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: liuyifan115 <liuyifan115 at icloud dot com>
    
      2# Maintainer: V0IDPlusPlus <v0idplusplus at protonmail dot com>
    
      3# Maintainer: shilka <shilkazx at gmail dot com>
    
      4
    
      5pkgname=tencent-docs-bin
    
      6pkgver=3.10.29
    
      7pkgrel=1
    
      8pkgdesc="腾讯文档 Tencent Docs - 让协作更高效，创作更轻松"
    
      9arch=("x86_64" "aarch64")
    
      10url="https://docs.qq.com/home/"
    
      11
    
      12source=(
    
      13    "tencent-docs.desktop"
    
      14)
    
      15depends=(
    
      16    "electron"
    
      17)
    
      18source_x86_64=("${pkgname}-${pkgver}-${pkgrel}-x86_64.deb::https://docs.qq.com/api/package/get?channel_id=30001&version_id=latest&package_name=TencentDocs-x64.deb")
    
      19source_aarch64=("${pkgname}-${pkgver}-${pkgrel}-aarch64.deb::https://docs.qq.com/api/package/get?channel_id=30001&version_id=latest&package_name=TencentDocs-arm64.deb")
    
      20
    
      21
    
      22sha256sums=("7dd7432ece74ddd5d5fd6de07e6b521a4b84206a8fa099b754f2a994641404d7")
    
      23sha256sums_x86_64=('SKIP')
    
      24sha256sums_aarch64=('SKIP')
    
      25
    
      26
    
      27package() {
    
      28    tar xpf data.tar.xz -C ${pkgdir}
    
      29
    
      30    install -Dm 644 ./tencent-docs.desktop ${pkgdir}/usr/share/applications/tencent-docs.desktop
    
      31    rm -rf ${pkgdir}/usr/share/applications/tdappdesktop.desktop
    
      32
    
      33    cd ${pkgdir}/opt
    
      34    mkdir tencent
    
      35    mv 腾讯文档 tencent/tencent-docs
    
      36
    
      37    cd ${pkgdir}/opt/tencent/tencent-docs
    
      38    chmod a+x ./tdappdesktop
    
      39
    
      40    mkdir ${pkgdir}/usr/bin
    
      41    ln -sf /opt/tencent/tencent-docs/tdappdesktop ${pkgdir}/usr/bin/tdocs
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2