ting-en

maintainer sukanka · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .deb from static.frdic.com, which is the CDN/static host for frdic.com (Eudic/Eusoft), a legitimate Chinese software company that makes the Eudic dictionary and Ting listening apps. This is effectively the vendor's own distribution host, not a random personal server. The sha512sum is present and pins the specific binary. The package extracts the .deb, pulls out the ASAR archive, and runs it under the system electron11, which is a reasonable and common AUR pattern for repackaging Electron apps from vendor .deb files. The main concern is that static.frdic.com is not a well-known official mirror and the binary is unverifiable beyond the hash, but this is standard practice for proprietary Chinese software repackaged in AUR. The risk is real but typical for this class of package — a medium rating is appropriate rather than clean, since the executable payload comes from a proprietary vendor CDN with no source code available for audit.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${pkgname}-${pkgver}.deb::https://static.frdic.com/pkg/ting_${_lang}/ting_${_lang}.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb from static.frdic.com, which is the CDN/static host for frdic.com (Eudic/Eusoft), a legitimate Chinese software company that makes the Eudic dictionary and Ting listening apps. This is effectively the vendor's own distribution host, not a random personal server. The sha512sum is present and pins the specific binary. The package extracts the .deb, pulls out the ASAR archive, and runs it under the system electron11, which is a reasonable and common AUR pattern for repackaging Electron apps from vendor .deb files. The main concern is that static.frdic.com is not a well-known official mirror and the binary is unverifiable beyond the hash, but this is standard practice for proprietary Chinese software repackaged in AUR. The risk is real but typical for this class of package — a medium rating is appropriate rather than clean, since the executable payload comes from a proprietary vendor CDN with no source code available for audit.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sukanka <su975853527 at gmail dot com>
    
      2
    
      3_lang=en
    
      4pkgname=ting-${_lang}
    
      5pkgver=9.7.4
    
      6pkgrel=1
    
      7_llang=English
    
      8pkgdesc="Daily ${_llang} Listening software from eusoft"
    
      9arch=('x86_64')
    
      10url="https://www.eudic.net/v4/${_lang}/app/ting"
    
      11license=('unknown')
    
      12_electron=electron11
    
      13depends=("${_electron}")
    
      14source=("${pkgname}-${pkgver}.deb::https://static.frdic.com/pkg/ting_${_lang}/ting_${_lang}.deb")
    
      15sha512sums=('233940fe7c2f73f260c5d6a61478fea9b16d93f5cfd9518e0db7b25655c11bf30c0fc8d5567bb0c57d3c07770c20aa678f3538c169e318ab31d9e2e008fbc528')
    
      16
    
      17prepare() {
    
      18    cd $srcdir
    
      19    mkdir -p build
    
      20    tar -xvf data.tar.xz -C build/
    
      21    cd build
    
      22    dir_name=$(ls opt/)
    
      23    mv opt/${dir_name}/resources/app.asar ${pkgname}.asar
    
      24}
    
      25
    
      26package() {
    
      27    cd $srcdir/build
    
      28
    
      29    mv usr/ ${pkgdir}/usr
    
      30    mkdir -p ${pkgdir}/usr/share/eusoft/${pkgname}
    
      31    mv ${pkgname}.asar ${pkgdir}/usr/share/eusoft/${pkgname}/${pkgname}.asar
    
      32    sed -i "s|^Exec.*|Exec=${pkgname} %U|" ${pkgdir}/usr/share/applications/ting_${_lang}.desktop
    
      33
    
      34    # link executable
    
      35    mkdir -p ${pkgdir}/usr/bin/
    
      36    echo """#!/usr/bin/bash
    
      37exec ${_electron} /usr/share/eusoft/${pkgname}/${pkgname}.asar --disable-gpu-sandbox "\$@"
    
      38""" >${pkgdir}/usr/bin/${pkgname}
    
      39    chmod a+x ${pkgdir}/usr/bin/${pkgname}
    
      40
    
      41}
    
      42# vim: ts=2 sw=2 et:
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2