typora-cn

maintainer witt.9099 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged typoraio.cn is the official Chinese regional domain for Typora (the software is sold/distributed there for the Chinese market, and the domain is referenced in the package's own url= field). However, it is not the primary international distribution host (typora.io), and the package installs a prebuilt proprietary binary (Electron app) extracted from a .deb without building from source. The sha256sums are present and pinned, which mitigates but does not eliminate supply-chain risk if the host is ever compromised or serves different content. The binary is executed (Typora is an Electron app with a native binary), so this is a genuine medium-severity supply-chain concern rather than a false positive, though it is a well-known commercial product with a plausible official mirror. The cheaper model's assessment is essentially correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source_x86_64=("typora-${pkgver}.deb::https://typoraio.cn/linux/${_pkgname}_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): typoraio.cn is the official Chinese regional domain for Typora (the software is sold/distributed there for the Chinese market, and the domain is referenced in the package's own url= field). However, it is not the primary international distribution host (typora.io), and the package installs a prebuilt proprietary binary (Electron app) extracted from a .deb without building from source. The sha256sums are present and pinned, which mitigates but does not eliminate supply-chain risk if the host is ever compromised or serves different content. The binary is executed (Typora is an Electron app with a native binary), so this is a genuine medium-severity supply-chain concern rather than a false positive, though it is a well-known commercial product with a plausible official mirror. The cheaper model's assessment is essentially correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: witt <1989161762 at qq dot com>
    
      2pkgname=typora-cn
    
      3_pkgname=typora
    
      4pkgver=1.10.8
    
      5pkgrel=1
    
      6pkgdesc="A minimal markdown editor and reader."
    
      7arch=('x86_64' 'aarch64')
    
      8license=('custom:"Copyright (c) 2015 Abner Lee All Rights Reserved."')
    
      9url="https://typoraio.cn/"
    
      10depends=('gtk3' 'nss' 'alsa-lib')
    
      11optdepends=(
    
      12	'noto-fonts-emoji: Or some other emoji font to see emojis'
    
      13	'pandoc: Import/export for extra file formats'
    
      14	'typora-theme-lapis: A clean Typora theme in blue tones for Typora'
    
      15	'typora-theme-phycat: 一款精心打磨过的多色多功能Typora主题'
    
      16	'typora-theme-drake: Material Google JetBrains Vue Juejin Purple Ayu Dark for Typora'
    
      17)
    
      18previous=('typora' 'typora-cn')
    
      19conflicts=('typora')
    
      20source=("$_pkgname.sh")
    
      21source_x86_64=("typora-${pkgver}.deb::https://typoraio.cn/linux/${_pkgname}_${pkgver}_amd64.deb")
    
      22source_aarch64=("typora-${pkgver}.deb::https://typoraio.cn/linux/${_pkgname}_${pkgver}_arm64.deb")
    
      23sha256sums=('dd44018cd3e9eb13c71c12c4c93fc8176698cf5fed73729fe2b8262595a99ead')
    
      24sha256sums_x86_64=('edabb14ed75569fbccd9f229415bc47b2d50e9e2d51b798b7637595dca9213f4')
    
      25sha256sums_aarch64=('edabb14ed75569fbccd9f229415bc47b2d50e9e2d51b798b7637595dca9213f4')
    
      26
    
      27prepare() {
    
      28	# extract deb archive
    
      29	[ -f "data.tar.xz" ] && bsdtar -xf data.tar.xz
    
      30	[ -f "data.tar.zst" ] && bsdtar -xf data.tar.zst
    
      31
    
      32	# remove change log from application comment
    
      33	sed -i '/Change Log/d' "${srcdir}/usr/share/applications/typora.desktop"
    
      34}
    
      35
    
      36package() {
    
      37	install -Dm755 "${srcdir}/$_pkgname.sh" "$pkgdir/usr/bin/${_pkgname}"
    
      38
    
      39	cd "${srcdir}/";
    
      40	# icons
    
      41	find "usr/share/icons" -type f -exec install -Dm644 {} "${pkgdir}/{}" \;
    
      42
    
      43	# icons
    
      44	find "usr/share/${_pkgname}/" -type f -exec install -Dm644 {} "${pkgdir}/{}" \;
    
      45
    
      46	# typora command
    
      47	install -Dm755 "${srcdir}/usr/share/typora/Typora" "$pkgdir/usr/share/typora/"
    
      48
    
      49	# move license to correct path
    
      50	install -Dm644 "${srcdir}/usr/share/doc/$_pkgname/copyright" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      51
    
      52	# desktop file
    
      53	install -Dm644 "${srcdir}/usr/share/applications/typora.desktop" "$pkgdir/usr/share/applications/typora.desktop"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2