tencent-transmart-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball from cdn.transmart.qq.com, which is Tencent's own CDN for their TranSmart translation product. The host is a Tencent-operated CDN (qq.com domain), so it is not a random personal host — it is the official vendor distribution channel for this proprietary application. The sha256sum is pinned, providing integrity verification. However, the package installs a prebuilt closed-source binary from a proprietary vendor (Tencent), which inherently carries supply-chain risk: the binary could contain telemetry, backdoors, or other unwanted functionality, and users must trust Tencent's CDN integrity. This is the standard medium-risk pattern for prebuilt proprietary binary packages in the AUR — not clearly malicious, but not verifiable source code either. The cheaper model's concern about the non-standard host is partially valid but overstated: cdn.transmart.qq.com is the official Tencent CDN, not a personal or unofficial host. The risk is the standard prebuilt-binary supply-chain concern, not an active attack. Rating remains medium due to the executed prebuilt binary from a closed-source vendor, even though the host is legitimate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "${pkgname%-bin}-${pkgver}.tar.gz::https://cdn.transmart.qq.com/installation_pro/${_appname}_${pkgver}(20230713)_linux.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary tarball from cdn.transmart.qq.com, which is Tencent's own CDN for their TranSmart translation product. The host is a Tencent-operated CDN (qq.com domain), so it is not a random personal host — it is the official vendor distribution channel for this proprietary application. The sha256sum is pinned, providing integrity verification. However, the package installs a prebuilt closed-source binary from a proprietary vendor (Tencent), which inherently carries supply-chain risk: the binary could contain telemetry, backdoors, or other unwanted functionality, and users must trust Tencent's CDN integrity. This is the standard medium-risk pattern for prebuilt proprietary binary packages in the AUR — not clearly malicious, but not verifiable source code either. The cheaper model's concern about the non-standard host is partially valid but overstated: cdn.transmart.qq.com is the official Tencent CDN, not a personal or unofficial host. The risk is the standard prebuilt-binary supply-chain concern, not an active attack. Rating remains medium due to the executed prebuilt binary from a closed-source vendor, even though the host is legitimate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_pkgname=transmart
    
      3pkgname="tencent-${_pkgname}-bin"
    
      4_appname=TranSmart
    
      5_zhsname='腾讯交互翻译'
    
      6pkgver=Alpha0.10.1
    
      7pkgrel=9
    
      8pkgdesc="腾讯交互翻译融合了腾讯人工智能实验室自研的交互式机器翻译、神经网络机器翻译、 统计机器翻译、语义理解、信息检索等技术，帮助用户更快、更好地完成翻译任务。"
    
      9arch=('x86_64')
    
      10url="https://transmart.qq.com/"
    
      11license=('LicenseRef-custom')
    
      12provides=("${pkgname%-bin}=${pkgver}")
    
      13conflicts=("${pkgname%-bin}")
    
      14depends=(
    
      15    'qt5-base'
    
      16    'alsa-lib'
    
      17    'qt6-declarative'
    
      18    'openssl-1.1'
    
      19    'nspr'
    
      20    'nss'
    
      21)
    
      22makedepends=(
    
      23    'gendesk'
    
      24)
    
      25optdepends=(
    
      26    'fcitx-qt5'
    
      27)
    
      28options=('!strip')
    
      29source=(
    
      30    "${pkgname%-bin}-${pkgver}.tar.gz::https://cdn.transmart.qq.com/installation_pro/${_appname}_${pkgver}(20230713)_linux.tar.gz"
    
      31    "${pkgname%-bin}.sh"
    
      32)
    
      33sha256sums=('acef0abb8fc0af1fa11514ceb5ea3f615c132e2c7770c58cfb9ca29f571ad3d7'
    
      34            'edf41565ee37d6a8ee184307ca75908e932b4df15b2690a268d41ec65a0a71a7')
    
      35prepare() {
    
      36    sed -i -e "
    
      37        s/@appname@/${pkgname%-bin}/g
    
      38        s/@runname@/${_appname}/g
    
      39    " "${srcdir}/${pkgname%-bin}.sh"
    
      40    gendesk -q -f -n \
    
      41        --pkgname="tencent-${_pkgname}-bin" \
    
      42        --name="${_appname}" \
    
      43        --categories="Utility" \
    
      44        --mimetypes="x-scheme-handler/${_pkgname}" \
    
      45        --exec="${pkgname%-bin} %F"
    
      46    sed -i "3i\Name[zh_CN]=${_zhsname}" "${srcdir}/${pkgname%-bin}.desktop"
    
      47    mv "${srcdir}/${_pkgname}_${pkgver}_linux/使用说明" "${srcdir}/${_pkgname}_${pkgver}_linux/README"
    
      48}
    
      49package() {
    
      50    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      51    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      52    cp -Pr --no-preserve=ownership "${srcdir}/${_pkgname}_${pkgver}_linux/"* "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      53    install -Dm644 "${srcdir}/${_pkgname}_${pkgver}_linux/README" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      54    install -Dm644 "${srcdir}/${_pkgname}_${pkgver}_linux/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
    
      55    install -Dm644 "${srcdir}/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      56}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2