wechat-bin

maintainer Kimiblock · 24 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt .deb files from Tencent's official domain (dldir1v6.qq.com) for WeChat, a proprietary application; although checksums are skipped, the source is from the official vendor, and the package merely repackages it without executing untrusted code or modifying the binary.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb files from Tencent's official domain (dldir1v6.qq.com) for WeChat, a proprietary application; although checksums are skipped, the source is from the official vendor, and the package merely repackages it without executing untrusted code or modifying the binary.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:73 wechat-x86-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kimiblock Moe
    
      2# Contributor: wszqkzqk
    
      3
    
      4pkgname=wechat-bin
    
      5pkgver=4.1.1.8
    
      6pkgrel=1
    
      7epoch=
    
      8pkgdesc="微信是一种生活方式. This is a repackage of WeChat."
    
      9arch=('x86_64' 'aarch64' 'loong64')
    
      10url="https://weixin.qq.com/"
    
      11license=('LicenseRef-proprietary')
    
      12groups=()
    
      13options=(!debug !strip)
    
      14
    
      15makedepends+=()
    
      16
    
      17replaces+=()
    
      18
    
      19depends=(
    
      20	"nss"
    
      21	"xcb-util-renderutil"
    
      22	"xcb-util-keysyms"
    
      23	"xcb-util-image"
    
      24	"xcb-util-wm"
    
      25	"libxkbcommon-x11"
    
      26	"libxkbcommon"
    
      27	"libxcb"
    
      28	"gcc-libs"
    
      29	"nspr"
    
      30	"glibc"
    
      31	"zlib"
    
      32	"libxcomposite"
    
      33	"glib2"
    
      34	"libxrender"
    
      35	"libxext"
    
      36	"alsa-lib"
    
      37	"dbus"
    
      38	"libxrandr"
    
      39	"fontconfig"
    
      40	"pango"
    
      41	"freetype2"
    
      42	"libxfixes"
    
      43	"cairo"
    
      44	"libx11"
    
      45	"expat"
    
      46	"libvlc"
    
      47	"libxdamage"
    
      48	"libdrm"
    
      49	"mesa"
    
      50	"libglvnd"
    
      51	"libpulse"
    
      52	"hicolor-icon-theme"
    
      53)
    
      54
    
      55optdepends=(
    
      56	"wechat: Sandbox support and enhancements"
    
      57	'ttf-twemoji: An emoji font that will work with WeChat'
    
      58	'libjack.so: libjack_plugin.so'
    
      59	'at-spi2-core: Accessibility in the browser part'
    
      60)
    
      61
    
      62makedepends+=(
    
      63	"libarchive"
    
      64)
    
      65
    
      66checkdepends=()
    
      67
    
      68source=()
    
      69
    
      70# The official site does not have versioned download, so checksums are skipped
    
      71
    
      72source_x86_64=(
    
      73	wechat-x86-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.deb"
    
      74)
    
      75
    
      76source_aarch64=(
    
      77	wechat-arm-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.deb"
    
      78)
    
      79
    
      80source_loong64=(
    
      81	wechat-loong64-${pkgver}.deb::"https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_LoongArch.deb"
    
      82)
    
      83
    
      84
    
      85md5sums_x86_64=('SKIP')
    
      86md5sums_aarch64=('SKIP')
    
      87md5sums_loong64=('SKIP')
    
      88
    
      89function pkgver() {
    
      90	tar -xf control.tar.xz ./control
    
      91	cat control | grep 'Version: ' | cut -c '10-'
    
      92}
    
      93
    
      94function package() {
    
      95	tar -xf data.tar.xz ./opt
    
      96	cp -r opt \
    
      97		"${pkgdir}/"
    
      98	tar -xf data.tar.xz ./usr
    
      99	cp -r usr \
    
      100		"${pkgdir}/"
    
      101	install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      102	echo "https://www.wechat.com/us/service_terms.html" \
    
      103		>"${pkgdir}/usr/share/licenses/${pkgname}/ToS.txt"
    
      104	sed -i 's|/usr/bin/wechat|/opt/wechat/wechat|g' \
    
      105		"${pkgdir}/usr/share/applications"/*.desktop
    
      106	ln -sf "/opt/wechat/wechat" \
    
      107		"${pkgdir}/usr/bin/wechat"
    
      108}
    
      109

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2