uuyc-wine
MEDIUM
maintainer Particle_G
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt Windows executable installer from a non-standard, potentially swappable host (a56.gdl.netease.com) with no upstream source or verification beyond a fixed hash, posing a supply-chain risk if the host is compromised or the binary is tampered with.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
"$pkgname-${pkgver}.exe::https://a56.gdl.netease.com/UURemote_Setup_${pkgver}_0715193023_gwqd.exe" -
PKGBUILD:25
"UU-Remote-EULA-${_eula_semantic_sha256}.source.html::https://uuyc.163.com/contact/20240402/40294_1146065.html"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Windows executable installer from a non-standard, potentially swappable host (a56.gdl.netease.com) with no upstream source or verification beyond a fixed hash, posing a supply-chain risk if the host is compromised or the binary is tampered with.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: ParticleG <particle_g@outlook.com>
2
3
pkgname=uuyc-wine
4
pkgver=4.33.0.8907
5
pkgrel=9
6
pkgdesc='Wine compatibility package for NetEase UU Remote (网易UU远程)'
7
arch=('x86_64')
8
url='https://uuyc.163.com/'
9
license=('LicenseRef-UU-Remote-EULA AND 0BSD')
10
depends=('wine>=11.1' 'hicolor-icon-theme' 'procps-ng' 'util-linux' 'diffutils')
11
makedepends=('7zip' 'python')
12
optdepends=('libnotify: desktop notifications during first-run setup')
13
options=('!strip' '!debug')
14
install="$pkgname.install"
15
_eula_semantic_sha256='5ac767dad456d304ed9be4a089b0bb26f6942544112a1842c720b1edcb7f44fd'
16
17
source=(
18
"$pkgname-${pkgver}.exe::https://a56.gdl.netease.com/UURemote_Setup_${pkgver}_0715193023_gwqd.exe"
19
'uuyc-wine'
20
'uuyc-wevtapi.S'
21
'uuyc-wevtapi.def'
22
'LICENSE'
23
'uuyc-wine.desktop'
24
'extract-uuyc-eula.py'
25
"UU-Remote-EULA-${_eula_semantic_sha256}.source.html::https://uuyc.163.com/contact/20240402/40294_1146065.html"
26
)
27
noextract=("$pkgname-${pkgver}.exe")
28
sha256sums=(
29
'5e3cfe8cfdc6552c1fc26f1ad2c94df133ca20dc3c45c23155358c32ac9bf53e'
30
'f1df7ab0ec159e8c99759a8088c9fd3fcda93efbf611350dd019dee72ead0c7c'
31
'b24c466c330b26aa0a9ef22577a1681705e9b1d092f59a7adda602ef31623ab4'
32
'c56c72c159f47b1b812943cd2095a0f64d2c4972f3c7a1a7f75e994c7b52f691'
33
'e91389eac5bc82c8398518cc7fd04ffbcc76ed009fcbec9f951015340a9ca2b3'
34
'a55bf7d10211616967119ff57f4fe82bebf0b0ad12b93f6eafd3f2f2928fa840'
35
'0b9c3e2e9f99367fc6339b70704c97d4ae291806718e16400bfe479689b5b10d'
36
'SKIP'
37
)
38
39
verify() {
40
local eula_file="UU-Remote-EULA-${_eula_semantic_sha256}.source.html"
41
local eula_path="$startdir/$eula_file"
42
if [[ ! -f "$eula_path" ]]; then
43
eula_path="$SRCDEST/$eula_file"
44
fi
45
46
python "$startdir/extract-uuyc-eula.py" --verify-only \
47
"$eula_path" "$_eula_semantic_sha256"
48
}
49
50
prepare() {
51
python "$srcdir/extract-uuyc-eula.py" \
52
"$srcdir/UU-Remote-EULA-${_eula_semantic_sha256}.source.html" \
53
"$srcdir/UU-Remote-EULA.html" \
54
"$srcdir/UU-Remote-EULA.txt" \
55
"$_eula_semantic_sha256"
56
57
rm -rf "$srcdir/$pkgname-icon"
58
7z x -y -o"$srcdir/$pkgname-icon" \
59
"$srcdir/$pkgname-${pkgver}.exe" '.rsrc/ICON/6'
60
}
61
62
build() {
63
cd "$srcdir"
64
as --64 uuyc-wevtapi.S -o uuyc-wevtapi-elf.o
65
objcopy --remove-section=.note.gnu.property -O pe-x86-64 \
66
uuyc-wevtapi-elf.o uuyc-wevtapi-coff.o
67
ld -mi386pep --dll --no-insert-timestamp --entry=DllMain \
68
--subsystem windows -o wevtapi.dll \
69
uuyc-wevtapi-coff.o uuyc-wevtapi.def \
70
-L/usr/lib/wine/x86_64-windows -lkernel32
71
}
72
73
package() {
74
install -Dm755 "$srcdir/$pkgname" "$pkgdir/usr/bin/$pkgname"
75
install -Dm644 "$srcdir/wevtapi.dll" \
76
"$pkgdir/usr/share/$pkgname/wevtapi.dll"
77
install -Dm644 "$srcdir/$pkgname.desktop" \
78
"$pkgdir/usr/share/applications/$pkgname.desktop"
79
install -Dm644 "$srcdir/$pkgname-${pkgver}.exe" \
80
"$pkgdir/usr/share/$pkgname/uuyc-wine-installer.exe"
81
install -Dm644 "$srcdir/$pkgname-icon/.rsrc/ICON/6" \
82
"$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
83
install -Dm644 "$srcdir/UU-Remote-EULA.html" \
84
"$pkgdir/usr/share/licenses/$pkgname/UU-Remote-EULA.html"
85
install -Dm644 "$srcdir/UU-Remote-EULA.txt" \
86
"$pkgdir/usr/share/licenses/$pkgname/UU-Remote-EULA.txt"
87
install -Dm644 "$srcdir/LICENSE" \
88
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
89
90
printf '%s\n' "$pkgver" >"$pkgdir/usr/share/$pkgname/upstream-version"
91
printf '%s-%s\n' "$pkgver" "$pkgrel" \
92
>"$pkgdir/usr/share/$pkgname/package-release"
93
}
94
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |