wuyou-docs

MEDIUM

maintainer duanluan 0 votes scanned 2026-08-21 21:15:20.444724

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release hosted on a personal account with few votes and no official project link, creating a supply-chain risk if the binary is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release hosted on a personal account with few votes and no official project link, creating a supply-chain risk if the binary is compromised.

PKGBUILD

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=wuyou-docs
    
      4_pkgname=wuyou-docs
    
      5pkgver=0.8.0
    
      6pkgrel=1
    
      7pkgdesc='Local-first desktop document workspace (prebuilt binary)'
    
      8arch=('x86_64')
    
      9url='https://github.com/duanluan/wuyou-docs-releases'
    
      10license=('NOASSERTION')
    
      11depends=('gtk3' 'webkit2gtk-4.1')
    
      12provides=("wuyou-docs-bin=${pkgver}")
    
      13options=('!strip')
    
      14source=("${_pkgname}_${pkgver}_amd64.deb::https://github.com/duanluan/wuyou-docs-releases/releases/download/v${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
    
      15sha256sums=('a4bda981b590349a37b8b299d4e0234dd699435a5113d3d455efc54b95e548ae')
    
      16
    
      17package() {
    
      18  local _app_dir _app_source _desktop_dir _desktop_file _desktop_source _extractdir
    
      19  _extractdir="$(mktemp -d)"
    
      20  trap 'rm -rf "${_extractdir}"' EXIT
    
      21
    
      22  bsdtar -C "${_extractdir}" -xf "${srcdir}/${_pkgname}_${pkgver}_amd64.deb"
    
      23  bsdtar -C "${pkgdir}" -xf "${_extractdir}/data.tar.gz"
    
      24
    
      25  _app_dir="${pkgdir}/usr/lib/wuyou-docs"
    
      26  if [[ ! -d "${_app_dir}" ]]; then
    
      27    _app_source="$(find "${pkgdir}/usr/lib" -mindepth 1 -maxdepth 1 -type d -print -quit)"
    
      28    if [[ -z "${_app_source}" ]]; then
    
      29      printf 'wuyou-docs app directory not found\n' >&2
    
      30      return 1
    
      31    fi
    
      32    mv "${_app_source}" "${_app_dir}"
    
      33  fi
    
      34
    
      35  _desktop_dir="${pkgdir}/usr/share/applications"
    
      36  _desktop_file="${_desktop_dir}/wuyou-docs.desktop"
    
      37  if [[ ! -f "${_desktop_file}" ]]; then
    
      38    _desktop_source="$(find "${_desktop_dir}" -maxdepth 1 -type f -name '*.desktop' -print -quit)"
    
      39    if [[ -z "${_desktop_source}" ]]; then
    
      40      printf 'wuyou-docs desktop entry not found\n' >&2
    
      41      return 1
    
      42    fi
    
      43    mv "${_desktop_source}" "${_desktop_file}"
    
      44  fi
    
      45
    
      46  sed -i     -e 's/^Name=.*/Name=Wuyou Docs/'     -e '/^Name\[en\]=/d'     -e '/^Name\[en_US\]=/d'     -e '/^Name\[zh\]=/d'     -e '/^Name\[zh_CN\]=/d'     -e '/^Name\[zh_HK\]=/d'     -e '/^Name\[zh_MO\]=/d'     -e '/^Name\[zh_TW\]=/d'     -e 's/^Comment=.*/Comment=Local-first desktop document workspace/'     -e 's/^Categories=.*/Categories=Office;WordProcessor;/'     "${_desktop_file}"
    
      47  sed -i '/^Name=/a Name[en]=Wuyou Docs\nName[en_US]=Wuyou Docs\nName[zh]=无尤文档\nName[zh_CN]=无尤文档\nName[zh_HK]=無尤文檔\nName[zh_MO]=無尤文檔\nName[zh_TW]=無尤文檔' "${_desktop_file}"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 21:15:20	Medium	2