wechat-bin
LOW
maintainer Kimiblock
25 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads official WeChat .deb binaries from Tencent's own domain (dldir1v6.qq.com), which is the project's legitimate source; although checksums are skipped, the host is not inherently untrustworthy and the binaries are from the official vendor.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official WeChat .deb binaries from Tencent's own domain (dldir1v6.qq.com), which is the project's legitimate source; although checksums are skipped, the host is not inherently untrustworthy and the binaries are from the official vendor.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:74
wechat-x86-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Kimiblock Moe
2
# Contributor: wszqkzqk
3
4
pkgname=wechat-bin
5
pkgver=4.1.13.9
6
pkgrel=1
7
epoch=
8
pkgdesc="微信是一种生活方式. This is a repackage of WeChat."
9
arch=('x86_64' 'aarch64' 'loong64')
10
url="https://weixin.qq.com/"
11
license=('LicenseRef-proprietary')
12
groups=()
13
options=(!debug !strip)
14
15
makedepends+=()
16
17
replaces+=()
18
19
depends=(
20
"nss"
21
"xcb-util-renderutil"
22
"xcb-util-keysyms"
23
"xcb-util-image"
24
"xcb-util-wm"
25
"libxkbcommon-x11"
26
"libxkbcommon"
27
"libxcb"
28
"gcc-libs"
29
"nspr"
30
"glibc"
31
"zlib"
32
"libxcomposite"
33
"glib2"
34
"libxrender"
35
"libxext"
36
"alsa-lib"
37
"dbus"
38
"libxrandr"
39
"fontconfig"
40
"pango"
41
"freetype2"
42
"libxfixes"
43
"cairo"
44
"libx11"
45
"expat"
46
"libvlc"
47
"libxdamage"
48
"libdrm"
49
"mesa"
50
"libglvnd"
51
"libpulse"
52
"hicolor-icon-theme"
53
)
54
55
optdepends=(
56
"wechat: Sandbox support and enhancements"
57
'ttf-twemoji: An emoji font that will work with WeChat'
58
'libjack.so: libjack_plugin.so'
59
'at-spi2-core: Accessibility in the browser part'
60
'xdg-desktop-portal-impl: XDG Desktop Portal implementation for File Chooser and ScreenCast'
61
)
62
63
makedepends+=(
64
"libarchive"
65
)
66
67
checkdepends=()
68
69
source=()
70
71
# The official site does not have versioned download, so checksums are skipped
72
73
source_x86_64=(
74
wechat-x86-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb"
75
)
76
77
source_aarch64=(
78
wechat-arm-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb"
79
)
80
81
source_loong64=(
82
wechat-loong64-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb"
83
)
84
85
86
md5sums_x86_64=('SKIP')
87
md5sums_aarch64=('SKIP')
88
md5sums_loong64=('SKIP')
89
90
function pkgver() {
91
tar -xf control.tar.xz ./control
92
cat control | grep 'Version: ' | cut -c '10-'
93
}
94
95
function package() {
96
tar -xf data.tar.xz ./opt
97
cp -r opt \
98
"${pkgdir}/"
99
tar -xf data.tar.xz ./usr
100
cp -r usr \
101
"${pkgdir}/"
102
install -d "${pkgdir}/usr/share/licenses/${pkgname}"
103
echo "https://www.wechat.com/us/service_terms.html" \
104
>"${pkgdir}/usr/share/licenses/${pkgname}/ToS.txt"
105
sed -i 's|/usr/bin/wechat|/opt/wechat/wechat|g' \
106
"${pkgdir}/usr/share/applications"/*.desktop
107
ln -sf "/opt/wechat/wechat" \
108
"${pkgdir}/usr/bin/wechat"
109
}
110
Changes since previous scan
--- PKGBUILD @ 2026-09-07 00:30+++ PKGBUILD @ 2026-09-17 00:27@@ -2,7 +2,7 @@ # Contributor: wszqkzqk pkgname=wechat-bin-pkgver=4.1.1.8+pkgver=4.1.13.9 pkgrel=1 epoch= pkgdesc="微信是一种生活方式. This is a repackage of WeChat."@@ -57,6 +57,7 @@ 'ttf-twemoji: An emoji font that will work with WeChat' 'libjack.so: libjack_plugin.so' 'at-spi2-core: Accessibility in the browser part'+ 'xdg-desktop-portal-impl: XDG Desktop Portal implementation for File Chooser and ScreenCast' ) makedepends+=(Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 09:14:05 | Medium | 1 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 09:59:47 | Medium | 1 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |