uuyc-wine

maintainer Particle_G · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Windows executable installer from a non-standard, potentially swappable host (a56.gdl.netease.com) with no upstream source or verification beyond a fixed hash, posing a supply-chain risk if the host is compromised or the binary is tampered with.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "$pkgname-${pkgver}.exe::https://a56.gdl.netease.com/UURemote_Setup_${pkgver}_0715193023_gwqd.exe"
PKGBUILD:25 "UU-Remote-EULA-${_eula_semantic_sha256}.source.html::https://uuyc.163.com/contact/20240402/40294_1146065.html"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Windows executable installer from a non-standard, potentially swappable host (a56.gdl.netease.com) with no upstream source or verification beyond a fixed hash, posing a supply-chain risk if the host is compromised or the binary is tampered with.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: ParticleG <particle_g@outlook.com>
    
      2
    
      3pkgname=uuyc-wine
    
      4pkgver=4.33.0.8907
    
      5pkgrel=9
    
      6pkgdesc='Wine compatibility package for NetEase UU Remote (网易UU远程)'
    
      7arch=('x86_64')
    
      8url='https://uuyc.163.com/'
    
      9license=('LicenseRef-UU-Remote-EULA AND 0BSD')
    
      10depends=('wine>=11.1' 'hicolor-icon-theme' 'procps-ng' 'util-linux' 'diffutils')
    
      11makedepends=('7zip' 'python')
    
      12optdepends=('libnotify: desktop notifications during first-run setup')
    
      13options=('!strip' '!debug')
    
      14install="$pkgname.install"
    
      15_eula_semantic_sha256='5ac767dad456d304ed9be4a089b0bb26f6942544112a1842c720b1edcb7f44fd'
    
      16
    
      17source=(
    
      18  "$pkgname-${pkgver}.exe::https://a56.gdl.netease.com/UURemote_Setup_${pkgver}_0715193023_gwqd.exe"
    
      19  'uuyc-wine'
    
      20  'uuyc-wevtapi.S'
    
      21  'uuyc-wevtapi.def'
    
      22  'LICENSE'
    
      23  'uuyc-wine.desktop'
    
      24  'extract-uuyc-eula.py'
    
      25  "UU-Remote-EULA-${_eula_semantic_sha256}.source.html::https://uuyc.163.com/contact/20240402/40294_1146065.html"
    
      26)
    
      27noextract=("$pkgname-${pkgver}.exe")
    
      28sha256sums=(
    
      29  '5e3cfe8cfdc6552c1fc26f1ad2c94df133ca20dc3c45c23155358c32ac9bf53e'
    
      30  'f1df7ab0ec159e8c99759a8088c9fd3fcda93efbf611350dd019dee72ead0c7c'
    
      31  'b24c466c330b26aa0a9ef22577a1681705e9b1d092f59a7adda602ef31623ab4'
    
      32  'c56c72c159f47b1b812943cd2095a0f64d2c4972f3c7a1a7f75e994c7b52f691'
    
      33  'e91389eac5bc82c8398518cc7fd04ffbcc76ed009fcbec9f951015340a9ca2b3'
    
      34  'a55bf7d10211616967119ff57f4fe82bebf0b0ad12b93f6eafd3f2f2928fa840'
    
      35  '0b9c3e2e9f99367fc6339b70704c97d4ae291806718e16400bfe479689b5b10d'
    
      36  'SKIP'
    
      37)
    
      38
    
      39verify() {
    
      40  local eula_file="UU-Remote-EULA-${_eula_semantic_sha256}.source.html"
    
      41  local eula_path="$startdir/$eula_file"
    
      42  if [[ ! -f "$eula_path" ]]; then
    
      43    eula_path="$SRCDEST/$eula_file"
    
      44  fi
    
      45
    
      46  python "$startdir/extract-uuyc-eula.py" --verify-only \
    
      47    "$eula_path" "$_eula_semantic_sha256"
    
      48}
    
      49
    
      50prepare() {
    
      51  python "$srcdir/extract-uuyc-eula.py" \
    
      52    "$srcdir/UU-Remote-EULA-${_eula_semantic_sha256}.source.html" \
    
      53    "$srcdir/UU-Remote-EULA.html" \
    
      54    "$srcdir/UU-Remote-EULA.txt" \
    
      55    "$_eula_semantic_sha256"
    
      56
    
      57  rm -rf "$srcdir/$pkgname-icon"
    
      58  7z x -y -o"$srcdir/$pkgname-icon" \
    
      59    "$srcdir/$pkgname-${pkgver}.exe" '.rsrc/ICON/6'
    
      60}
    
      61
    
      62build() {
    
      63  cd "$srcdir"
    
      64  as --64 uuyc-wevtapi.S -o uuyc-wevtapi-elf.o
    
      65  objcopy --remove-section=.note.gnu.property -O pe-x86-64 \
    
      66    uuyc-wevtapi-elf.o uuyc-wevtapi-coff.o
    
      67  ld -mi386pep --dll --no-insert-timestamp --entry=DllMain \
    
      68    --subsystem windows -o wevtapi.dll \
    
      69    uuyc-wevtapi-coff.o uuyc-wevtapi.def \
    
      70    -L/usr/lib/wine/x86_64-windows -lkernel32
    
      71}
    
      72
    
      73package() {
    
      74  install -Dm755 "$srcdir/$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      75  install -Dm644 "$srcdir/wevtapi.dll" \
    
      76    "$pkgdir/usr/share/$pkgname/wevtapi.dll"
    
      77  install -Dm644 "$srcdir/$pkgname.desktop" \
    
      78    "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      79  install -Dm644 "$srcdir/$pkgname-${pkgver}.exe" \
    
      80    "$pkgdir/usr/share/$pkgname/uuyc-wine-installer.exe"
    
      81  install -Dm644 "$srcdir/$pkgname-icon/.rsrc/ICON/6" \
    
      82    "$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
    
      83  install -Dm644 "$srcdir/UU-Remote-EULA.html" \
    
      84    "$pkgdir/usr/share/licenses/$pkgname/UU-Remote-EULA.html"
    
      85  install -Dm644 "$srcdir/UU-Remote-EULA.txt" \
    
      86    "$pkgdir/usr/share/licenses/$pkgname/UU-Remote-EULA.txt"
    
      87  install -Dm644 "$srcdir/LICENSE" \
    
      88    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      89
    
      90  printf '%s\n' "$pkgver" >"$pkgdir/usr/share/$pkgname/upstream-version"
    
      91  printf '%s-%s\n' "$pkgver" "$pkgrel" \
    
      92    >"$pkgdir/usr/share/$pkgname/package-release"
    
      93}
    
      94

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,16 +2,18 @@
 
 pkgname=uuyc-wine
 pkgver=4.33.0.8907
-pkgrel=7
+pkgrel=9
 pkgdesc='Wine compatibility package for NetEase UU Remote (网易UU远程)'
 arch=('x86_64')
 url='https://uuyc.163.com/'
 license=('LicenseRef-UU-Remote-EULA AND 0BSD')
 depends=('wine>=11.1' 'hicolor-icon-theme' 'procps-ng' 'util-linux' 'diffutils')
-makedepends=('7zip')
+makedepends=('7zip' 'python')
 optdepends=('libnotify: desktop notifications during first-run setup')
 options=('!strip' '!debug')
 install="$pkgname.install"
+_eula_semantic_sha256='5ac767dad456d304ed9be4a089b0bb26f6942544112a1842c720b1edcb7f44fd'
+
 source=(
   "$pkgname-${pkgver}.exe::https://a56.gdl.netease.com/UURemote_Setup_${pkgver}_0715193023_gwqd.exe"
   'uuyc-wine'
@@ -19,20 +21,39 @@
   'uuyc-wevtapi.def'
   'LICENSE'
   'uuyc-wine.desktop'
-  'UU-Remote-EULA.html::https://uuyc.163.com/contact/20240402/40294_1146065.html'
+  'extract-uuyc-eula.py'
+  "UU-Remote-EULA-${_eula_semantic_sha256}.source.html::https://uuyc.163.com/contact/20240402/40294_1146065.html"
 )
 noextract=("$pkgname-${pkgver}.exe")
 sha256sums=(
   '5e3cfe8cfdc6552c1fc26f1ad2c94df133ca20dc3c45c23155358c32ac9bf53e'
-  'cc48ed6a045d3f462f682ad512cc846f9fef6da4181023557d7fad49a5c08e62'
+  'f1df7ab0ec159e8c99759a8088c9fd3fcda93efbf611350dd019dee72ead0c7c'
   'b24c466c330b26aa0a9ef22577a1681705e9b1d092f59a7adda602ef31623ab4'
   'c56c72c159f47b1b812943cd2095a0f64d2c4972f3c7a1a7f75e994c7b52f691'
   'e91389eac5bc82c8398518cc7fd04ffbcc76ed009fcbec9f951015340a9ca2b3'
   'a55bf7d10211616967119ff57f4fe82bebf0b0ad12b93f6eafd3f2f2928fa840'
-  '3a2b28509a7c54bb701ae877af8312f2c366388c198427f483cf791c6eae0b65'
+  '0b9c3e2e9f99367fc6339b70704c97d4ae291806718e16400bfe479689b5b10d'
+  'SKIP'
 )
 
+verify() {
+  local eula_file="UU-Remote-EULA-${_eula_semantic_sha256}.source.html"
+  local eula_path="$startdir/$eula_file"
+  if [[ ! -f "$eula_path" ]]; then
+    eula_path="$SRCDEST/$eula_file"
+  fi
+
+  python "$startdir/extract-uuyc-eula.py" --verify-only \
+    "$eula_path" "$_eula_semantic_sha256"
+}
+
 prepare() {
+  python "$srcdir/extract-uuyc-eula.py" \
+    "$srcdir/UU-Remote-EULA-${_eula_semantic_sha256}.source.html" \
+    "$srcdir/UU-Remote-EULA.html" \
+    "$srcdir/UU-Remote-EULA.txt" \
+    "$_eula_semantic_sha256"
+
   rm -rf "$srcdir/$pkgname-icon"
   7z x -y -o"$srcdir/$pkgname-icon" \
     "$srcdir/$pkgname-${pkgver}.exe" '.rsrc/ICON/6'
@@ -61,6 +82,8 @@
     "$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
   install -Dm644 "$srcdir/UU-Remote-EULA.html" \
     "$pkgdir/usr/share/licenses/$pkgname/UU-Remote-EULA.html"
+  install -Dm644 "$srcdir/UU-Remote-EULA.txt" \
+    "$pkgdir/usr/share/licenses/$pkgname/UU-Remote-EULA.txt"
   install -Dm644 "$srcdir/LICENSE" \
     "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 03:19:42	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 17:30:22	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 17:28:09	MEDIUM	3
2026-07-24 13:27:52	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 05:17:28	MEDIUM	3
2026-07-21 05:16:02	MEDIUM	2
2026-07-21 03:17:30	MEDIUM	3