wiznote-desktop-bin

maintainer zxp19821005 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt AppImage binaries from get.wiz.cn, which is the official download host for WizNote (a well-known Chinese note-taking application by Beijing Wiz Technology). The domain get.wiz.cn is the vendor's own CDN/download server, not a personal or unofficial host. However, the binaries are executed during the build process (AppImage extraction via --appimage-extract, then asar manipulation), meaning any compromise of get.wiz.cn or a MITM attack would result in arbitrary code execution on the builder's machine. The sha256sums provide integrity verification, which mitigates substitution attacks but not a scenario where the upstream vendor itself distributes malicious content. This is a standard pattern for AUR binary packages pulling from a vendor's own download infrastructure — the risk is real but typical for this class of package. The cheaper model's MEDIUM rating is appropriate: it's a prebuilt binary from a non-standard (though vendor-official) host that gets executed during build, which is a genuine supply-chain concern even with checksums present.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.AppImage::https://get.wiz.cn/x/${_pkgname}-desktop-${pkgver}-linux-arm64.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt AppImage binaries from get.wiz.cn, which is the official download host for WizNote (a well-known Chinese note-taking application by Beijing Wiz Technology). The domain get.wiz.cn is the vendor's own CDN/download server, not a personal or unofficial host. However, the binaries are executed during the build process (AppImage extraction via --appimage-extract, then asar manipulation), meaning any compromise of get.wiz.cn or a MITM attack would result in arbitrary code execution on the builder's machine. The sha256sums provide integrity verification, which mitigates substitution attacks but not a scenario where the upstream vendor itself distributes malicious content. This is a standard pattern for AUR binary packages pulling from a vendor's own download infrastructure — the risk is real but typical for this class of package. The cheaper model's MEDIUM rating is appropriate: it's a prebuilt binary from a non-standard (though vendor-official) host that gets executed during build, which is a genuine supply-chain concern even with checksums present.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_pkgname=wiznote
    
      3pkgname="${_pkgname}-desktop-bin"
    
      4_appname=WizNote
    
      5pkgver=0.1.107
    
      6_electronversion=16
    
      7pkgrel=2
    
      8pkgdesc="A powerful note-taking tool.(Prebuilt version.Use system-wide electron)"
    
      9arch=(
    
      10    'aarch64'
    
      11    'x86_64'
    
      12)
    
      13url="https://www.wiz.cn"
    
      14license=('LicenseRef-custom')
    
      15provides=("${pkgname%-bin}=${pkgver}")
    
      16conflicts=(
    
      17    "${pkgname%-bin}"
    
      18    "${_pkgname}-electron"
    
      19)
    
      20depends=(
    
      21    "electron${_electronversion}"
    
      22)
    
      23makedepends=(
    
      24    'fuse2'
    
      25    'asar'
    
      26)
    
      27source=(
    
      28    "LICENSE.html::${url}/share-termsofuse.html"
    
      29    "${pkgname%-bin}.sh"
    
      30)
    
      31source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.AppImage::https://get.wiz.cn/x/${_pkgname}-desktop-${pkgver}-linux-arm64.AppImage")
    
      32source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.AppImage::https://get.wiz.cn/x/${_pkgname}-desktop-${pkgver}-linux-x86_64.AppImage")
    
      33sha256sums=('6eb921349b33cde5824067c8dd01c4a2616da110ade63fda9ebf5c9657283cdf'
    
      34            '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
    
      35sha256sums_aarch64=('b1f2d7602ea533056129eb3575256fd149e14ed08131c3b6d3c45544cac5c4da')
    
      36sha256sums_x86_64=('d0370c1dfb06ce09e8502720156d530d2c7e98e68e632a133a194b0116df261c')
    
      37prepare() {
    
      38    sed -i -e "
    
      39        s/@electronversion@/${_electronversion}/g
    
      40        s/@appname@/${pkgname%-bin}/g
    
      41        s/@runname@/app.asar/g
    
      42        s/@cfgdirname@/${_appname}/g
    
      43        s/@options@//g
    
      44    " "${srcdir}/${pkgname%-bin}.sh"
    
      45    if [ ! -x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" ];then
    
      46        chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage"
    
      47    fi
    
      48    "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" --appimage-extract > /dev/null
    
      49    sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "${srcdir}/squashfs-root/${pkgname%-bin}.desktop"
    
      50    asar e "${srcdir}/squashfs-root/resources/app.asar" "${srcdir}/app.asar.unpacked"
    
      51    find "${srcdir}/app.asar.unpacked/dist" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} +
    
      52    asar p "${srcdir}/app.asar.unpacked" "${srcdir}/app.asar"
    
      53    find "${srcdir}/squashfs-root/resources" -type d -exec chmod 755 {} +
    
      54}
    
      55package() {
    
      56    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      57    install -Dm644 "${srcdir}/app.asar" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      58    cp -Pr --no-preserve=ownership "${srcdir}/squashfs-root/resources/"{app.asar.unpacked,assets} "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      59    install -Dm644 "${srcdir}/squashfs-root/usr/lib/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
    
      60    _icon_sizes=(16x16 32x32 256x256 1024x1024)
    
      61    for _icons in "${_icon_sizes[@]}";do
    
      62        install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png" \
    
      63            -t "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps"
    
      64    done
    
      65    install -Dm644 "${srcdir}/squashfs-root/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      66    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      67}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2