ting-es

maintainer sukanka · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb binary from static.frdic.com, which is the CDN/static asset host used by Eudic/Eusoft (the vendor behind the eudic dictionary and ting apps). This is not an unofficial personal host — frdic.com is the vendor's own domain (Eudic's Chinese brand site). The sha512sum is pinned, which mitigates silent substitution risk. However, the source URL is unversioned ('ting_es.deb' with no version in the filename), meaning the checksum could drift if the vendor updates the file in place, and there is no GPG signature verification. The binary is an Electron app extracted from a .deb and executed directly. This is a real medium-risk pattern (prebuilt proprietary binary from a vendor CDN, no signature, unversioned URL) but not a high-severity supply-chain attack — it is consistent with standard AUR packaging of proprietary Linux apps distributed as .deb files.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${pkgname}-${pkgver}.deb::https://static.frdic.com/pkg/ting_${_lang}/ting_${_lang}.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt .deb binary from static.frdic.com, which is the CDN/static asset host used by Eudic/Eusoft (the vendor behind the eudic dictionary and ting apps). This is not an unofficial personal host — frdic.com is the vendor's own domain (Eudic's Chinese brand site). The sha512sum is pinned, which mitigates silent substitution risk. However, the source URL is unversioned ('ting_es.deb' with no version in the filename), meaning the checksum could drift if the vendor updates the file in place, and there is no GPG signature verification. The binary is an Electron app extracted from a .deb and executed directly. This is a real medium-risk pattern (prebuilt proprietary binary from a vendor CDN, no signature, unversioned URL) but not a high-severity supply-chain attack — it is consistent with standard AUR packaging of proprietary Linux apps distributed as .deb files.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sukanka <su975853527 at gmail dot com>
    
      2
    
      3_lang=es
    
      4pkgname=ting-${_lang}
    
      5pkgver=9.7.4
    
      6pkgrel=1
    
      7_llang=Spanish
    
      8pkgdesc="Daily ${_llang} Listening software from eusoft"
    
      9arch=('x86_64')
    
      10url="https://www.eudic.net/v4/${_lang}/app/ting"
    
      11license=('unknown')
    
      12_electron=electron11
    
      13depends=("${_electron}")
    
      14source=("${pkgname}-${pkgver}.deb::https://static.frdic.com/pkg/ting_${_lang}/ting_${_lang}.deb")
    
      15sha512sums=('820baec73bc6df379b544f52a40cfe6870fd9013248ddc766426ab441e44fe5834cb1451ff1d658a52240e3a22cfa3059b2946981d5f105b5140e67147f816a8')
    
      16
    
      17# sometime use curl to download source deb, throws 404 not found.
    
      18# user other UA instead of origion one fixed it.
    
      19# https://wiki.archlinux.org/index.php/Nonfree_applications_package_guidelines#Custom_DLAGENT
    
      20DLAGENTS=("https::/usr/bin/curl -A 'Mozilla' -fLC - --retry 3 --retry-delay 3 -o %o %u")
    
      21
    
      22prepare() {
    
      23    cd $srcdir
    
      24    mkdir -p build
    
      25    tar -xvf data.tar.xz -C build/
    
      26    cd build
    
      27    dir_name=$(ls opt/)
    
      28    mv opt/${dir_name}/resources/app.asar ${pkgname}.asar
    
      29}
    
      30
    
      31package() {
    
      32    cd $srcdir/build
    
      33
    
      34    mv usr/ ${pkgdir}/usr
    
      35    mkdir -p ${pkgdir}/usr/share/eusoft/${pkgname}
    
      36    mv ${pkgname}.asar ${pkgdir}/usr/share/eusoft/${pkgname}/${pkgname}.asar
    
      37    sed -i "s|^Exec.*|Exec=${pkgname} %U|" ${pkgdir}/usr/share/applications/ting_${_lang}.desktop
    
      38
    
      39    # link executable
    
      40    mkdir -p ${pkgdir}/usr/bin/
    
      41    echo """#!/usr/bin/bash
    
      42exec ${_electron} /usr/share/eusoft/${pkgname}/${pkgname}.asar --disable-gpu-sandbox "\$@"
    
      43""" >${pkgdir}/usr/bin/${pkgname}
    
      44    chmod a+x ${pkgdir}/usr/bin/${pkgname}
    
      45
    
      46}
    
      47# vim: ts=2 sw=2 et:
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2