welink-wine

LOW

maintainer legendt 0 votes scanned 2026-09-21 07:36:08.208468

View on AUR

Why flagged

The installer is downloaded from welink.huaweicloud.com (Huawei's official cloud domain) with a pinned sha256 checksum; it is never executed but only unpacked with 7z to extract embedded payload archives, which is a legitimate packaging technique. The bundled .sh and .py scripts lack checksums (SKIP) but are local files distributed with the package itself, not fetched from a remote host. No obfuscation, exfiltration, or remote code execution is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The installer is downloaded from welink.huaweicloud.com (Huawei's official cloud domain) with a pinned sha256 checksum; it is never executed but only unpacked with 7z to extract embedded payload archives, which is a legitimate packaging technique. The bundled .sh and .py scripts lack checksums (SKIP) but are local files distributed with the package itself, not fetched from a remote host. No obfuscation, exfiltration, or remote code execution is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "${_installer}::https://welink.huaweicloud.com/appstore/file/web/free/down/7a8e659ca19b40e5bfa81411b4f92bcb/${_installer}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Wensheng Tang <sp3478 at gmail dot com>
    
      2pkgname=welink-wine
    
      3pkgver=7.60.2
    
      4_build=202607081412_36816_release_2026.06.0_cloud_7.60.2_615
    
      5pkgrel=1
    
      6pkgdesc="华为云 WeLink 数字化办公平台（官方 Windows 客户端 + wine，已修复输入框无法打字）"
    
      7arch=('x86_64')
    
      8url="https://www.huaweicloud.com/product/welink.html"
    
      9license=('LicenseRef-proprietary')
    
      10depends=(
    
      11    'wine'
    
      12    '7zip'
    
      13    'python-fonttools'
    
      14    'noto-fonts-cjk'
    
      15    'hicolor-icon-theme'
    
      16)
    
      17makedepends=('icoutils')
    
      18optdepends=('fcitx5: 中文输入法')
    
      19conflicts=('deepin-wine-welink')
    
      20replaces=('deepin-wine-welink')
    
      21install="${pkgname}.install"
    
      22_installer="WeLink_Win_cloud_${_build}.exe"
    
      23# 官方安装器是自研格式：应用文件以 5 个 7z 存放在 PE 资源段 .rsrc/ZIPRES/ 里，
    
      24# 7z 可直接取出，无需运行安装器。本包只随包分发这些 7z，首次启动时解到用户容器。
    
      25source=(
    
      26    "${_installer}::https://welink.huaweicloud.com/appstore/file/web/free/down/7a8e659ca19b40e5bfa81411b4f92bcb/${_installer}"
    
      27    "${pkgname}.sh"
    
      28    "welink-mkfont.py"
    
      29)
    
      30sha256sums=('6042c4409431dd7827d7f351531e6957387b198f2fef7e007fbb83f84fc42301'
    
      31            'SKIP'
    
      32            'SKIP')
    
      33noextract=("${_installer}")
    
      34
    
      35prepare() {
    
      36    cd "${srcdir}"
    
      37    rm -rf rsrc ico
    
      38    7z x -o"${srcdir}/rsrc" "${_installer}" '.rsrc/ZIPRES/*' >/dev/null
    
      39    mkdir -p ico
    
      40    wrestool -x -t14 -o ico "${_installer}" >/dev/null 2>&1 || true
    
      41}
    
      42
    
      43package() {
    
      44    cd "${srcdir}"
    
      45    local _p="${pkgdir}/opt/${pkgname}"
    
      46
    
      47    # 应用负载：安装器内嵌的 7z，按资源编号顺序解压即得完整安装树
    
      48    install -dm755 "${_p}/payload"
    
      49    local _z
    
      50    for _z in "${srcdir}"/rsrc/.rsrc/ZIPRES/*; do
    
      51        install -Dm644 "${_z}" "${_p}/payload/$(basename "${_z}").7z"
    
      52    done
    
      53    printf '%s' "${pkgver}" > "${srcdir}/version"
    
      54    install -Dm644 "${srcdir}/version" "${_p}/payload/version"
    
      55
    
      56    install -Dm755 "${srcdir}/welink-mkfont.py" "${_p}/welink-mkfont.py"
    
      57    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      58
    
      59    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
    
      60[Desktop Entry]
    
      61Type=Application
    
      62Name=WeLink
    
      63Name[zh_CN]=华为云 WeLink
    
      64Comment=Huawei Cloud digital workplace
    
      65Comment[zh_CN]=华为云数字化办公平台
    
      66Exec=${pkgname}
    
      67Icon=${pkgname}
    
      68Terminal=false
    
      69Categories=Network;InstantMessaging;
    
      70StartupNotify=false
    
      71StartupWMClass=welink.exe
    
      72EOF
    
      73
    
      74    # 图标：从 exe 资源里取最大的一个 ico，拆成各尺寸 png
    
      75    local _ico
    
      76    _ico=$(ls -S "${srcdir}"/ico/*.ico 2>/dev/null | head -1)
    
      77    if [ -n "${_ico}" ]; then
    
      78        mkdir -p "${srcdir}/png"
    
      79        icotool -x -o "${srcdir}/png" "${_ico}" >/dev/null 2>&1 || true
    
      80        local _png _s
    
      81        for _png in "${srcdir}"/png/*.png; do
    
      82            _s=$(basename "${_png}" | grep -oE '[0-9]+x[0-9]+' | head -1)
    
      83            [ -n "${_s}" ] || continue
    
      84            install -Dm644 "${_png}" "${pkgdir}/usr/share/icons/hicolor/${_s}/apps/${pkgname}.png"
    
      85        done
    
      86    fi
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-21 07:36:08	Low	3
2026-09-21 07:34:25	Medium	2