tenvideo

MEDIUM

maintainer zxp19821005 5 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a GitHub repository not officially affiliated with Tencent, which could be silently swapped to deliver malicious code, constituting a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 "LICENSE.htm::https://www.qq.com/contract20180827.htm"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a GitHub repository not officially affiliated with Tencent, which could be silently swapped to deliver malicious code, constituting a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: qaz <fkxxyz@163.com>
    
      3pkgname=tenvideo
    
      4_pkgname=Tenvideo
    
      5_appname=TencentVideo
    
      6_zhsname='腾讯视频'
    
      7pkgver=11.164.9775.0
    
      8_electronversion=41
    
      9pkgrel=1
    
      10pkgdesc="China's leading online video media platform.(Prebuilt version.Use system-wide electron)"
    
      11arch=(
    
      12    'aarch64'
    
      13    'x86_64'
    
      14)
    
      15url="https://v.qq.com"
    
      16_dlurl="https://github.com/kota-rina3/hokeshi"
    
      17license=('LicenseRef-custom')
    
      18conflicts=("${pkgname}")
    
      19provides=("${pkgname}=${pkgver}")
    
      20depends=(
    
      21    "electron${_electronversion}"
    
      22    'libappindicator'
    
      23    'libayatana-appindicator'
    
      24    'xdg-utils'
    
      25)
    
      26source=(
    
      27    "LICENSE.htm::https://www.qq.com/contract20180827.htm"
    
      28    "${pkgname}.sh"
    
      29)
    
      30source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_dlurl}/releases/download/${pkgname}-v11/${pkgname}-universal_${pkgver}_arm64.deb")
    
      31source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_dlurl}/releases/download/${pkgname}-v11/${pkgname}-universal_${pkgver}_amd64.deb")
    
      32sha256sums=('7827da1d244c3f678ea95bf0f315311ebd3f0509c4efe306b2a3c523ab47a175'
    
      33            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      34sha256sums_aarch64=('da18b9f439a2e6b8b323d6bcaba979f807b1d502fa8e7c6c625a207b12245325')
    
      35sha256sums_x86_64=('5238faba9e2387f9827f9f466900fb764088e5ef85ba8ce85f4c876320885a14')
    
      36_get_app_dir() {
    
      37    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      38}
    
      39_check_electron_version() {
    
      40    echo "Verifying Electron version..."
    
      41    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
    
      42    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
    
      43    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
    
      44    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
    
      45    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
    
      46        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
    
      47        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      48}
    
      49prepare() {
    
      50    sed -i -e "
    
      51        s/@electronversion@/${_electronversion}/g
    
      52        s/@appname@/${pkgname}/g
    
      53        s/@runname@/app/g
    
      54        s/@cfgdirname@/${pkgname}_universal/g
    
      55    " "${srcdir}/${pkgname}.sh"
    
      56    bsdtar -xf "${srcdir}/data."*
    
      57    _check_electron_version
    
      58    sed -i -e "
    
      59        s/Categories=Video;/Categories=AudioVideo;/g
    
      60        s/Exec=\/opt\/apps\/${pkgname}-universal\/files\/${pkgname}/Exec=${pkgname}/g
    
      61        s/Icon=\/opt\/apps\/${pkgname}-universal\/files\/resources\/app\/${pkgname}.png/Icon=${pkgname}/g
    
      62        s/StartupWMClass=${pkgname}-universal/StartupWMClass=${pkgname}/g
    
      63    " "${srcdir}/opt/apps/${pkgname}-universal/entries/applications/${pkgname}-universal.desktop"
    
      64}
    
      65package() {
    
      66    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      67    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      68	local _app_dir=$(_get_app_dir)
    
      69	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      70    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      71		_extension="${_i##*.}"
    
      72		_icon_path="${_i#*icons/hicolor/}"
    
      73		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      74		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      75	done
    
      76    install -Dm644 "${srcdir}/opt/apps/${pkgname}-universal/entries/applications/${pkgname}-universal.desktop" \
    
      77        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      78    install -Dm644 "${srcdir}/LICENSE.htm" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2