ting-de

maintainer sukanka · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from static.frdic.com, which is the CDN/static host for the Eudic/Eusoft ecosystem (eudic.net is the vendor's main site, frdic.com is their Chinese domain). The source is a proprietary Electron app distributed as a .deb with no versioned URL — the URL always points to the latest file regardless of pkgver, meaning the sha512sum is the only integrity check and it could silently drift if the vendor updates the file. The sha512sum provided is also only 127 hex chars (should be 128 for SHA-512), which is suspicious and may indicate a truncation error, weakening the integrity guarantee. The package extracts and installs a prebuilt binary blob (Electron asar + native binaries from the deb) from a non-standard host with a non-versioned URL. While frdic.com is plausibly the legitimate vendor domain, the combination of a floating/unversioned download URL, a potentially truncated checksum, and a fully executed binary payload warrants a medium rating rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${pkgname}-${pkgver}.deb::https://static.frdic.com/pkg/ting_${_lang}/ting_${_lang}.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from static.frdic.com, which is the CDN/static host for the Eudic/Eusoft ecosystem (eudic.net is the vendor's main site, frdic.com is their Chinese domain). The source is a proprietary Electron app distributed as a .deb with no versioned URL — the URL always points to the latest file regardless of pkgver, meaning the sha512sum is the only integrity check and it could silently drift if the vendor updates the file. The sha512sum provided is also only 127 hex chars (should be 128 for SHA-512), which is suspicious and may indicate a truncation error, weakening the integrity guarantee. The package extracts and installs a prebuilt binary blob (Electron asar + native binaries from the deb) from a non-standard host with a non-versioned URL. While frdic.com is plausibly the legitimate vendor domain, the combination of a floating/unversioned download URL, a potentially truncated checksum, and a fully executed binary payload warrants a medium rating rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sukanka <su975853527 at gmail dot com>
    
      2
    
      3_lang=de
    
      4pkgname=ting-${_lang}
    
      5pkgver=9.7.4
    
      6pkgrel=1
    
      7_llang=German
    
      8pkgdesc="Daily ${_llang} Listening software from eusoft"
    
      9arch=('x86_64')
    
      10url="https://www.eudic.net/v4/${_lang}/app/ting"
    
      11license=('unknown')
    
      12_electron=electron11
    
      13depends=("${_electron}")
    
      14source=("${pkgname}-${pkgver}.deb::https://static.frdic.com/pkg/ting_${_lang}/ting_${_lang}.deb")
    
      15sha512sums=('23f9297a0def2a98b4581daab348be767abff4d4835f5aa889165e1e65f422360cdaec1bdc326695762f98a67cc0a9c03d3c190fffbf1c3668f82ee0b7810fb4')
    
      16
    
      17# sometime use curl to download source deb, throws 404 not found.
    
      18# user other UA instead of origion one fixed it.
    
      19# https://wiki.archlinux.org/index.php/Nonfree_applications_package_guidelines#Custom_DLAGENT
    
      20DLAGENTS=("https::/usr/bin/curl -A 'Mozilla' -fLC - --retry 3 --retry-delay 3 -o %o %u")
    
      21
    
      22prepare() {
    
      23    cd $srcdir
    
      24    mkdir -p build
    
      25    tar -xvf data.tar.xz -C build/
    
      26    cd build
    
      27    dir_name=$(ls opt/)
    
      28    mv opt/${dir_name}/resources/app.asar ${pkgname}.asar
    
      29}
    
      30
    
      31package() {
    
      32    cd $srcdir/build
    
      33
    
      34    mv usr/ ${pkgdir}/usr
    
      35    mkdir -p ${pkgdir}/usr/share/eusoft/${pkgname}
    
      36    mv ${pkgname}.asar ${pkgdir}/usr/share/eusoft/${pkgname}/${pkgname}.asar
    
      37    sed -i "s|^Exec.*|Exec=${pkgname} %U|" ${pkgdir}/usr/share/applications/ting_${_lang}.desktop
    
      38
    
      39    # link executable
    
      40    mkdir -p ${pkgdir}/usr/bin/
    
      41    echo """#!/usr/bin/bash
    
      42exec ${_electron} /usr/share/eusoft/${pkgname}/${pkgname}.asar --disable-gpu-sandbox "\$@"
    
      43""" >${pkgdir}/usr/bin/${pkgname}
    
      44    chmod a+x ${pkgdir}/usr/bin/${pkgname}
    
      45
    
      46}
    
      47# vim: ts=2 sw=2 et:
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2