tenvideo

maintainer zxp19821005 · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt .deb binaries from a GitHub repository not officially affiliated with Tencent, which could be silently swapped to deliver malicious code, constituting a supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 "LICENSE.htm::https://www.qq.com/contract20180827.htm"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a GitHub repository not officially affiliated with Tencent, which could be silently swapped to deliver malicious code, constituting a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: qaz <fkxxyz@163.com>
    
      3pkgname=tenvideo
    
      4_pkgname=Tenvideo
    
      5_appname=TencentVideo
    
      6_zhsname='腾讯视频'
    
      7pkgver=11.164.9775.0
    
      8_electronversion=41
    
      9pkgrel=1
    
      10pkgdesc="China's leading online video media platform.(Prebuilt version.Use system-wide electron)"
    
      11arch=(
    
      12    'aarch64'
    
      13    'x86_64'
    
      14)
    
      15url="https://v.qq.com"
    
      16_dlurl="https://github.com/kota-rina3/hokeshi"
    
      17license=('LicenseRef-custom')
    
      18conflicts=("${pkgname}")
    
      19provides=("${pkgname}=${pkgver}")
    
      20depends=(
    
      21    "electron${_electronversion}"
    
      22    'libappindicator'
    
      23    'libayatana-appindicator'
    
      24    'xdg-utils'
    
      25)
    
      26source=(
    
      27    "LICENSE.htm::https://www.qq.com/contract20180827.htm"
    
      28    "${pkgname}.sh"
    
      29)
    
      30source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_dlurl}/releases/download/${pkgname}-v11/${pkgname}-universal_${pkgver}_arm64.deb")
    
      31source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_dlurl}/releases/download/${pkgname}-v11/${pkgname}-universal_${pkgver}_amd64.deb")
    
      32sha256sums=('7827da1d244c3f678ea95bf0f315311ebd3f0509c4efe306b2a3c523ab47a175'
    
      33            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      34sha256sums_aarch64=('da18b9f439a2e6b8b323d6bcaba979f807b1d502fa8e7c6c625a207b12245325')
    
      35sha256sums_x86_64=('5238faba9e2387f9827f9f466900fb764088e5ef85ba8ce85f4c876320885a14')
    
      36_get_app_dir() {
    
      37    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      38}
    
      39_check_electron_version() {
    
      40    echo "Verifying Electron version..."
    
      41    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
    
      42    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
    
      43    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
    
      44    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
    
      45    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
    
      46        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
    
      47        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      48}
    
      49prepare() {
    
      50    sed -i -e "
    
      51        s/@electronversion@/${_electronversion}/g
    
      52        s/@appname@/${pkgname}/g
    
      53        s/@runname@/app/g
    
      54        s/@cfgdirname@/${pkgname}_universal/g
    
      55    " "${srcdir}/${pkgname}.sh"
    
      56    bsdtar -xf "${srcdir}/data."*
    
      57    _check_electron_version
    
      58    sed -i -e "
    
      59        s/Categories=Video;/Categories=AudioVideo;/g
    
      60        s/Exec=\/opt\/apps\/${pkgname}-universal\/files\/${pkgname}/Exec=${pkgname}/g
    
      61        s/Icon=\/opt\/apps\/${pkgname}-universal\/files\/resources\/app\/${pkgname}.png/Icon=${pkgname}/g
    
      62        s/StartupWMClass=${pkgname}-universal/StartupWMClass=${pkgname}/g
    
      63    " "${srcdir}/opt/apps/${pkgname}-universal/entries/applications/${pkgname}-universal.desktop"
    
      64}
    
      65package() {
    
      66    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      67    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      68	local _app_dir=$(_get_app_dir)
    
      69	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      70    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      71		_extension="${_i##*.}"
    
      72		_icon_path="${_i#*icons/hicolor/}"
    
      73		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      74		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      75	done
    
      76    install -Dm644 "${srcdir}/opt/apps/${pkgname}-universal/entries/applications/${pkgname}-universal.desktop" \
    
      77        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      78    install -Dm644 "${srcdir}/LICENSE.htm" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      79}
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,49 +4,77 @@
 _pkgname=Tenvideo
 _appname=TencentVideo
 _zhsname='腾讯视频'
-pkgver=1.0.10
-_electronversion=7
-pkgrel=3
+pkgver=11.164.9775.0
+_electronversion=41
+pkgrel=1
 pkgdesc="China's leading online video media platform.(Prebuilt version.Use system-wide electron)"
-arch=('x86_64')
+arch=(
+    'aarch64'
+    'x86_64'
+)
 url="https://v.qq.com"
+_dlurl="https://github.com/kota-rina3/hokeshi"
 license=('LicenseRef-custom')
 conflicts=("${pkgname}")
 provides=("${pkgname}=${pkgver}")
 depends=(
-  "electron${_electronversion}"
-  'libappindicator-gtk3'
-  'xdg-utils'
+    "electron${_electronversion}"
+    'libappindicator'
+    'libayatana-appindicator'
+    'xdg-utils'
 )
 source=(
-    "${pkgname}-${pkgver}.rpm::https://dldir1.qq.com/qqtv/linux/Tenvideo_universal-${pkgver}.${arch}.rpm"
     "LICENSE.htm::https://www.qq.com/contract20180827.htm"
     "${pkgname}.sh"
 )
-sha256sums=('5f26f0cf722dac9dd764abbb860d709de3122f756e8e29e20944b40ac2e17fd1'
-            'SKIP'
-            '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
+source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_dlurl}/releases/download/${pkgname}-v11/${pkgname}-universal_${pkgver}_arm64.deb")
+source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_dlurl}/releases/download/${pkgname}-v11/${pkgname}-universal_${pkgver}_amd64.deb")
+sha256sums=('7827da1d244c3f678ea95bf0f315311ebd3f0509c4efe306b2a3c523ab47a175'
+            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+sha256sums_aarch64=('da18b9f439a2e6b8b323d6bcaba979f807b1d502fa8e7c6c625a207b12245325')
+sha256sums_x86_64=('5238faba9e2387f9827f9f466900fb764088e5ef85ba8ce85f4c876320885a14')
+_get_app_dir() {
+    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+}
+_check_electron_version() {
+    echo "Verifying Electron version..."
+    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
+    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
+    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
+    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
+    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
+        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
+        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
+}
 prepare() {
-    sed -e "
+    sed -i -e "
         s/@electronversion@/${_electronversion}/g
         s/@appname@/${pkgname}/g
-        s/@runname@/app.asar/g
+        s/@runname@/app/g
         s/@cfgdirname@/${pkgname}_universal/g
-        s/@options@//g
-    " -i "${srcdir}/${pkgname}.sh"
-    sed -e "
-        s/\"\/opt\/${_zhsname}\/${_appname}\"/${pkgname}/g
-        s/Icon=${_appname}/Icon=${pkgname}/g
-    " -i "${srcdir}/usr/share/applications/${_appname}.desktop"
+    " "${srcdir}/${pkgname}.sh"
+    bsdtar -xf "${srcdir}/data."*
+    _check_electron_version
+    sed -i -e "
+        s/Categories=Video;/Categories=AudioVideo;/g
+        s/Exec=\/opt\/apps\/${pkgname}-universal\/files\/${pkgname}/Exec=${pkgname}/g
+        s/Icon=\/opt\/apps\/${pkgname}-universal\/files\/resources\/app\/${pkgname}.png/Icon=${pkgname}/g
+        s/StartupWMClass=${pkgname}-universal/StartupWMClass=${pkgname}/g
+    " "${srcdir}/opt/apps/${pkgname}-universal/entries/applications/${pkgname}-universal.desktop"
 }
 package() {
     install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
-    install -Dm644 "${srcdir}/opt/${_zhsname}/resources/app.asar" -t "${pkgdir}/usr/lib/${pkgname}"
-    _icon_sizes=(16x16 22x22 24x24 32x32 36x36 48x48 64x64 72x72 96x96 128x128 256x256)
-    for _icons in "${_icon_sizes[@]}";do
-        install -Dm644 "${srcdir}/usr/share/icons/hicolor/${_icons}/apps/${_appname}.png" \
-            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
-    done
-    install -Dm644 "${srcdir}/usr/share/applications/${_appname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
+    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
+	local _app_dir=$(_get_app_dir)
+	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
+    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
+		_extension="${_i##*.}"
+		_icon_path="${_i#*icons/hicolor/}"
+		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
+		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
+	done
+    install -Dm644 "${srcdir}/opt/apps/${pkgname}-universal/entries/applications/${pkgname}-universal.desktop" \
+        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
     install -Dm644 "${srcdir}/LICENSE.htm" -t "${pkgdir}/usr/share/licenses/${pkgname}"
 }
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 11:14:12	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2