xdroid-bin

maintainer orphaned · 8 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary archive (a .run executable) from a personal SharePoint OneDrive-style URL (zhuolin-my.sharepoint.cn) belonging to an individual account (shiyang_zhuolin_partner_onmschina_cn). While SharePoint/OneDrive is a legitimate Microsoft cloud service, this is a personal storage location rather than an official vendor release server, meaning the file could be replaced or tampered with by the account holder at any time without changing the URL. The archive contains a .run binary that is installed and executed directly on the user's system. A sha256sum is provided, which mitigates the risk of silent substitution somewhat, but the host is still non-authoritative and the content is a closed-source prebuilt executable. This is a genuine medium-severity supply-chain concern: a prebuilt binary from a personal/unofficial host that gets executed on the target system. It is not clearly malicious, but the combination of unofficial hosting + opaque prebuilt binary warrants the medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 "${pkgname}-${pkgver}.tar.xz::https://zhuolin-my.sharepoint.cn/personal/shiyang_zhuolin_partner_onmschina_cn/Documents/卓懿/xDroidInstall-${arch}-v${pkgver}-${_date}.tar.xz?ga=1"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary archive (a .run executable) from a personal SharePoint OneDrive-style URL (zhuolin-my.sharepoint.cn) belonging to an individual account (shiyang_zhuolin_partner_onmschina_cn). While SharePoint/OneDrive is a legitimate Microsoft cloud service, this is a personal storage location rather than an official vendor release server, meaning the file could be replaced or tampered with by the account holder at any time without changing the URL. The archive contains a .run binary that is installed and executed directly on the user's system. A sha256sum is provided, which mitigates the risk of silent substitution somewhat, but the host is still non-authoritative and the content is a closed-source prebuilt executable. This is a genuine medium-severity supply-chain concern: a prebuilt binary from a personal/unofficial host that gets executed on the target system. It is not clearly malicious, but the combination of unofficial hosting + opaque prebuilt binary warrants the medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2# Contributor: little_sheepycn <little_sheepycn@redstonebuild.onmicrosoft.com>
    
      3
    
      4pkgname=xdroid-bin
    
      5pkgver=13.2.380
    
      6pkgrel=3
    
      7epoch=
    
      8pkgdesc="卓懿,让安卓应用融入Linux平台应用生态体系，卓懿 x86_64 版（个人免费下载使用，不得用于商业用途）。"
    
      9arch=('x86_64')
    
      10url="https://www.linzhuotech.com/Product/download"
    
      11license=('LicenseRef-custom')
    
      12groups=()
    
      13depends=(
    
      14    dkms
    
      15    xdg-utils
    
      16)
    
      17makedepends=(
    
      18    libarchive
    
      19    unzip
    
      20)
    
      21checkdepends=()
    
      22optdepends=(
    
      23    'linux-headers: Headers and scripts for building modules for the Linux kernel'
    
      24    'linux-lts-headers: Headers and scripts for building modules for the LTS Linux kernel'
    
      25    'linux-zen-headers: Headers and scripts for building modules for the Linux ZEN kernel'
    
      26)
    
      27provides=("xDroidInstall")
    
      28conflicts=()
    
      29replaces=()
    
      30backup=()
    
      31options=('!strip')
    
      32install=${pkgname}.install
    
      33changelog=
    
      34_date=20250306
    
      35# https://zhuolin-my.sharepoint.cn/personal/shiyang_zhuolin_partner_onmschina_cn/Documents/%e5%8d%93%e6%87%bf/xDroidInstall-x86_64-v13.2.380-20250306.tar.xz?ga=1
    
      36source=(
    
      37    "${pkgname}-${pkgver}.tar.xz::https://zhuolin-my.sharepoint.cn/personal/shiyang_zhuolin_partner_onmschina_cn/Documents/卓懿/xDroidInstall-${arch}-v${pkgver}-${_date}.tar.xz?ga=1"
    
      38    "${pkgname}.install"
    
      39)
    
      40noextract=(${pkgname}-${pkgver}.tar.xz)
    
      41sha256sums=('cd06938f10c9227969c4af52ee23cb6b7a6b81c0a9ec44fec7446616b34d4ae9'
    
      42    '7d6168f0402ad58d35a7900ebc4e3008b6c0cb96261e2f216731e28188cd1d5d')
    
      43#validpgpkeys=()
    
      44
    
      45package() {
    
      46    install -dm0755 "${pkgdir}/opt/${pkgname}" \
    
      47        "${pkgdir}/usr/bin" \
    
      48        "${pkgdir}/usr/share/icons" \
    
      49        "${pkgdir}/usr/share/applications"
    
      50
    
      51    bsdtar -xf "${srcdir}/${pkgname}-${pkgver}.tar.xz" --no-same-owner --no-same-permissions -C "${pkgdir}/opt/${pkgname}"
    
      52    # unzip "${srcdir}/${pkgname}-${pkgver}.tar.gz" -d "${pkgdir}/opt/${pkgname}"
    
      53    chmod +x "${pkgdir}/opt/${pkgname}"/*.run
    
      54    chown root:root "${pkgdir}/opt/${pkgname}"/*.run
    
      55    #mv -v "${pkgdir}"/opt/${pkgname}/xDroidInstall-${arch}-v${pkgver}*.run "${pkgdir}/opt/${pkgname}/xDroidInstall-${arch}-v${pkgver}.run"
    
      56
    
      57    ln -sf "/opt/${pkgname%-bin}/xAppCenter.png" "${pkgdir}/usr/share/icons/xAppCenter.png"
    
      58    ln -sf "/opt/${pkgname%-bin}/xAppCenter.desktop" "${pkgdir}/usr/share/applications/xAppCenter.desktop"
    
      59
    
      60    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/${pkgname%-bin}-guide" <<EOF
    
      61xdg-open https://www.linzhuotech.com/Public/Home/img/gitbook/user_manual_nv/_book/index.html
    
      62EOF
    
      63
    
      64    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/xDroidInstall" <<EOF
    
      65#!/bin/env bash
    
      66export LD_LIBRARY_PATH="/opt/${pkgname}:\$LD_LIBRARY_PATH"
    
      67exec /opt/${pkgname}/xDroidInstall-${arch}-v${pkgver}-${_date}.run "\$@"
    
      68EOF
    
      69    install -Dm0644 /dev/stdin "${pkgdir}/usr/share/applications/xDroidInstall.desktop" <<EOF
    
      70[Desktop Entry]
    
      71Categories=System;
    
      72Comment=LinZhuo xDroid xDroidInstall
    
      73Exec=xDroidInstall
    
      74Hidden=false
    
      75Icon=xAppCenter
    
      76Name=xDroidInstall
    
      77NoDisplay=false
    
      78Type=Application
    
      79X-Deepin-Vendor=user-custom
    
      80EOF
    
      81    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/xDroidUninstall" <<EOF
    
      82#!/bin/env bash
    
      83exec /opt/${pkgname%-bin}/uninstall "\$@"
    
      84EOF
    
      85    install -Dm0644 /dev/stdin "${pkgdir}/usr/share/applications/xDroidUninstall.desktop" <<EOF
    
      86[Desktop Entry]
    
      87Categories=System;
    
      88Comment=LinZhuo xDroid xDroidUninstall
    
      89Exec=xDroidUninstall
    
      90Hidden=false
    
      91Icon=xAppCenter
    
      92Name=xDroidUninstall
    
      93NoDisplay=false
    
      94Type=Application
    
      95X-Deepin-Vendor=user-custom
    
      96EOF
    
      97}
    
      98

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2