wps-office-mime

maintainer Universebenzene · 489 votes · base wps-office · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary Debian package (containing closed-source executables and shared libraries that are directly installed and executed) from wdl1.pcfg.cache.wpscdn.com. This is a CDN host used by Kingsoft/WPS for distributing their Linux builds, so it is not a random personal host — it is the actual official WPS Linux download CDN. The sha1sum is pinned, which mitigates substitution risk. However, the host is not the canonical project URL listed (wps-community.org), the package installs a large blob of proprietary prebuilt binaries directly into /usr/lib and /usr/bin, and there is no source build — all of which are inherent supply-chain concerns for any prebuilt proprietary package. The CDN domain (wpscdn.com) is plausibly Kingsoft-controlled infrastructure, making this more of a 'prebuilt proprietary binary' concern than a clear unofficial-host concern. Overall this is a borderline medium: the risk is real (prebuilt closed-source binaries from a CDN) but consistent with how WPS Office is legitimately distributed on Linux, and the checksum is pinned.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/${pkgver##*.}/wps-office_${pkgver}.XA_amd64.deb"

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary Debian package (containing closed-source executables and shared libraries that are directly installed and executed) from wdl1.pcfg.cache.wpscdn.com. This is a CDN host used by Kingsoft/WPS for distributing their Linux builds, so it is not a random personal host — it is the actual official WPS Linux download CDN. The sha1sum is pinned, which mitigates substitution risk. However, the host is not the canonical project URL listed (wps-community.org), the package installs a large blob of proprietary prebuilt binaries directly into /usr/lib and /usr/bin, and there is no source build — all of which are inherent supply-chain concerns for any prebuilt proprietary package. The CDN domain (wpscdn.com) is plausibly Kingsoft-controlled infrastructure, making this more of a 'prebuilt proprietary binary' concern than a clear unofficial-host concern. Overall this is a borderline medium: the risk is real (prebuilt closed-source binaries from a CDN) but consistent with how WPS Office is legitimately distributed on Linux, and the checksum is pinned.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ouyang Jun <ouyangjun1999@gmail.com>
    
      2# Maintainer: Astro Benzene <universebenzene at sina dot com>
    
      3# Maintainer: Felix Yan <felixonmars@archlinux.org>
    
      4# Contributor: Jove Yu <yushijun110 [at] gmail.com>
    
      5# Contributor: Ariel AxionL <axionl at aosc dot io>
    
      6# Contributor: v71
    
      7
    
      8pkgbase=wps-office
    
      9pkgname=('wps-office' 'wps-office-mime')
    
      10pkgver=11.1.0.11723
    
      11#_pkgver=8372
    
      12pkgrel=2
    
      13#_pkgrel=1
    
      14pkgdesc="Kingsoft Office (WPS Office) - an office productivity suite"
    
      15arch=('x86_64')
    
      16license=('LicenseRef-WPS-EULA')
    
      17url="http://wps-community.org"
    
      18options=('!emptydirs')
    
      19#[[ "$CARCH" = "i686" ]] && _archext=x86 || _archext=x86_64
    
      20#source_i686=("http://kdl.cc.ksosoft.com/wps-community/download/${pkgver##*.}/wps-office_${pkgver}_i386.deb"
    
      21#            'add_no_kdialog_variable.patch')
    
      22#source=("http://kdl.cc.ksosoft.com/wps-community/download/${pkgver##*.}/wps-office_${pkgver}_amd64.deb"
    
      23source=("https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/${pkgver##*.}/wps-office_${pkgver}.XA_amd64.deb"
    
      24        'fix-wps-python-parse.patch')
    
      25#sha1sums_i686=('60b1c9e33ee6fc1edcefe40dc9ec529d4a668825'
    
      26#               'dd8b5283ee17a88a3eb0531976abccd6e5e08c48')
    
      27sha1sums=('24132c03e1b53fe8983274c5165caa9128bdb1a6'
    
      28          'f3713481edf04ffb08be8d24dce66554dd5a4f13')
    
      29
    
      30prepare() {
    
      31    bsdtar -xpf data.tar.xz
    
      32
    
      33    cd "${srcdir}/usr/bin"
    
      34    sed -i 's|/opt/kingsoft/wps-office|/usr/lib|' *
    
      35#   sed -i 's|/office6/${gApp}  ${gOptExt}|/office6/${gApp} -style gtk+ ${gOptExt}|' wps
    
      36#   sed -i 's|/office6/${gApp} ${gOptExt}|/office6/${gApp} -style gtk+ ${gOptExt}|' wpp et
    
      37
    
      38    cd "${srcdir}/usr/share/icons/hicolor"
    
      39
    
      40    for _file in ./*; do
    
      41        if [ -e ${_file}/mimetypes/wps-office2019-etmain.png ]; then
    
      42            mkdir -p ${_file}/apps
    
      43            cp -p ${_file}/mimetypes/wps-office2019* ${_file}/apps
    
      44        fi
    
      45    done
    
      46
    
      47    cd "${srcdir}"
    
      48#   patch -Np1 -i "${srcdir}/fix_desktop_exec.patch"
    
      49    patch -Np1 -i "${srcdir}/fix-wps-python-parse.patch"
    
      50}
    
      51
    
      52package_wps-office() {
    
      53    depends=('fontconfig' 'xorg-mkfontdir' 'libxrender' 'desktop-file-utils' 'shared-mime-info' 'xdg-utils' 'glu' 'sdl2' 'libxml2-legacy' 'libpulse' 'hicolor-icon-theme' 'libxss' 'sqlite' 'libtool' 'libxslt' 'libjpeg-turbo')
    
      54    optdepends=('libtiff5: Provide libtiff.so.5 for wpspdf working'
    
      55                'cups: for printing support'
    
      56                'libjpeg-turbo: JPEG image codec support'
    
      57                'pango: for complex (right-to-left) text support'
    
      58                'curl: An URL retrieval utility and library'
    
      59                'ttf-wps-fonts: Symbol fonts required by wps-office'
    
      60                'ttf-ms-fonts: Microsft Fonts recommended for wps-office'
    
      61                'wps-office-fonts: FZ TTF fonts provided by wps community'
    
      62                'wps-office-mime: Use mime files provided by Kingsoft'
    
      63                'wps-office-mui-zh-cn: zh_CN support for WPS Office')
    
      64    install=${pkgname}.install
    
      65    conflicts=('kingsoft-office')
    
      66#   cd wps-office_${pkgver}_$_archext
    
      67    cd "${srcdir}/opt/kingsoft/wps-office/"
    
      68
    
      69    install -d "${pkgdir}/usr/lib"
    
      70    cp -r office6 "${pkgdir}/usr/lib"
    
      71    # Fix for icu>=71.1
    
      72    rm ${pkgdir}/usr/lib/office6/libstdc++.so*
    
      73    # Use system libjpeg
    
      74    rm ${pkgdir}/usr/lib/office6/libjpeg.so*
    
      75#   chmod -x "${pkgdir}/usr/lib/office6/wpsoffice"
    
      76#   ln -rTsf "${pkgdir}/usr/lib/office6"/{libcef.so,addons/cef/libcef.so}
    
      77    install -Dm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" office6/mui/default/*.html
    
      78
    
      79    install -d "${pkgdir}/usr/bin"
    
      80    cd "${srcdir}/usr/bin"
    
      81    install -m755 * "${pkgdir}/usr/bin"
    
      82
    
      83    cd "${srcdir}/usr/share"
    
      84
    
      85    install -d "${pkgdir}/usr/share/applications"
    
      86    cp -r applications/* "${pkgdir}/usr/share/applications"
    
      87#   rm "${pkgdir}/usr/share/applications/appurl.desktop"
    
      88
    
      89    install -d "${pkgdir}/usr/share/desktop-directories"
    
      90    cp -r desktop-directories/* "${pkgdir}/usr/share/desktop-directories"
    
      91
    
      92    install -d "${pkgdir}/usr/share/icons"
    
      93    cp -r icons/* "${pkgdir}/usr/share/icons"
    
      94
    
      95#   cp -r "$srcdir/usr/share" "${pkgdir}/usr/"
    
      96
    
      97    install -Dm644 -t "${pkgdir}/usr/share/fonts/wps-office" fonts/wps-office/*
    
      98
    
      99    install -Dm644 -t "${pkgdir}/etc/xdg/menus/applications-merged" "${srcdir}/etc/xdg/menus/applications-merged/wps-office.menu"
    
      100}
    
      101
    
      102package_wps-office-mime() {
    
      103    pkgdesc="Mime files provided by Kingsoft Office (WPS Office)"
    
      104    arch=('any')
    
      105    depends=('shared-mime-info')
    
      106    cd "${srcdir}/usr/share"
    
      107
    
      108    install -d "${pkgdir}/usr/share/mime"
    
      109    cp -r mime/* "${pkgdir}/usr/share/mime"
    
      110
    
      111    cd "${srcdir}/opt/kingsoft/wps-office/"
    
      112    install -Dm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" office6/mui/default/*.html
    
      113}
    
      114

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2