uuplugin-dns-patched-bin

MEDIUM

maintainer koswu 0 votes scanned 2026-10-28 15:53:09.149778

View on AUR

Why flagged

Downloads a prebuilt binary from a NetEase CDN host (uurouter.gdl.netease.com) that, while plausibly official NetEase infrastructure, is a non-standard distribution endpoint for a closed-source executable that gets patched and installed as a privileged system service; the binary itself is unverifiable beyond the checksum, and the patch script modifies it before installation, making the full supply chain difficult to audit.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "uuplugin-${pkgver}.tar.gz::https://uurouter.gdl.netease.com/uuplugin/steam-deck-plugin-${CARCH}/v${pkgver}/uu.tar.gz"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Downloads a prebuilt binary from a NetEase CDN host (uurouter.gdl.netease.com) that, while plausibly official NetEase infrastructure, is a non-standard distribution endpoint for a closed-source executable that gets patched and installed as a privileged system service; the binary itself is unverifiable beyond the checksum, and the patch script modifies it before installation, making the full supply chain difficult to audit.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: koswu <koswu at outlook dot com>
    
      2# Packaging reference: uuplugin-bin, maintained by akkarriin.
    
      3
    
      4pkgname=uuplugin-dns-patched-bin
    
      5pkgver=14.2.2
    
      6pkgrel=1
    
      7pkgdesc='UU Steam Deck Linux plugin patched to preserve Tailscale DNS'
    
      8arch=('x86_64')
    
      9url='https://github.com/Koswu/uuplugin-dns-patched'
    
      10license=('LicenseRef-UU' '0BSD')
    
      11depends=('iproute2' 'iptables' 'kmod' 'systemd')
    
      12makedepends=('python')
    
      13provides=("uuplugin-bin=${pkgver}" 'uuplugin')
    
      14conflicts=('uuplugin-bin' 'uuplugin')
    
      15backup=('etc/uuplugin/uu.conf')
    
      16# The output digest is part of the patch profile: do not mutate the binary.
    
      17options=('!strip' '!debug')
    
      18source=(
    
      19  "uuplugin-${pkgver}.tar.gz::https://uurouter.gdl.netease.com/uuplugin/steam-deck-plugin-${CARCH}/v${pkgver}/uu.tar.gz"
    
      20  'patch_uuplugin_tailnet.py'
    
      21  'test_uuplugin_patch.py'
    
      22  'uuplugin.service'
    
      23  'LICENSE'
    
      24)
    
      25sha256sums=('6881c8bd388630edfdbceef1f723bf43cf75b0ce5122ee891e99d2fb86c96652'
    
      26            '0573a865b7ff2e799d5882119af9369b6b566770d40a1b36581569a168b51902'
    
      27            'd39477cdae3ccfc35cc12af1f9968ceef6e43cdf49a83b1659ba7c0d4f8037cb'
    
      28            'c2831cbf26bb3629adbed3cb10efcc7a64f54b337496aa126e68195947f110e7'
    
      29            'd1cc264c9506464f18e849cb22e58842aaba5250a1815ee77456d6d661c0f979')
    
      30
    
      31prepare() {
    
      32  # Original and output SHA256 must both match the verified profile.
    
      33  # Separate output; repeat prepare() safely without touching the original.
    
      34  rm -f "${srcdir}/uuplugin-patched"
    
      35  python "${srcdir}/patch_uuplugin_tailnet.py" \
    
      36    "${srcdir}/uuplugin" "${srcdir}/uuplugin-patched"
    
      37}
    
      38
    
      39check() {
    
      40  cd "${srcdir}"
    
      41  python -m unittest -v test_uuplugin_patch
    
      42}
    
      43
    
      44package() {
    
      45  install -Dm755 "${srcdir}/uuplugin-patched" "${pkgdir}/usr/bin/uuplugin"
    
      46  # UU resolves its guardian as a sibling executable.
    
      47  install -Dm755 "${srcdir}/xuplugin-guardian" "${pkgdir}/usr/bin/xuplugin-guardian"
    
      48  install -Dm644 "${srcdir}/uu.conf" "${pkgdir}/etc/uuplugin/uu.conf"
    
      49  install -Dm644 "${srcdir}/uuplugin.service" \
    
      50    "${pkgdir}/usr/lib/systemd/system/uuplugin.service"
    
      51  # This license covers our patch and packaging only, not NetEase's binaries.
    
      52  install -Dm644 "${srcdir}/LICENSE" \
    
      53    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.patch"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-28 15:53:09	Medium	3
2026-10-28 15:50:30	Medium	2