xterminal-bin

maintainer zxp19821005 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt RPM binaries from cdn-cn.xterminal.cn, which is the official CDN for the XTerminal application (xterminal.cn). The source is the vendor's own distribution CDN, not a random personal host. However, it is still a Chinese CDN for a proprietary closed-source application, and the binaries are executed code (Electron app). The sha256sums are pinned, which mitigates substitution attacks. The PKGBUILD also runs a Node.js script (safe_extract_asar.js) from the source array — this script is included in the local source files with a pinned hash, so it is not fetched from an external host. The pattern of unpacking an RPM, patching the asar, and repackaging with system electron is standard for this class of AUR packages. The main concern is that the application itself is proprietary/closed-source from a Chinese vendor distributed via their CDN, and the asar contents are not auditable. This is a real but typical supply-chain concern for binary AUR packages — not clearly malicious, but not clean either. Medium is the appropriate rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 source_aarch64=("${pkgname%-bin}-${_aarch64_ver}-aarch64.rpm::https://cdn-cn.xterminal.cn/downloads/${_pkgname}-${_aarch64_ver}-linux-aarch64.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt RPM binaries from cdn-cn.xterminal.cn, which is the official CDN for the XTerminal application (xterminal.cn). The source is the vendor's own distribution CDN, not a random personal host. However, it is still a Chinese CDN for a proprietary closed-source application, and the binaries are executed code (Electron app). The sha256sums are pinned, which mitigates substitution attacks. The PKGBUILD also runs a Node.js script (safe_extract_asar.js) from the source array — this script is included in the local source files with a pinned hash, so it is not fetched from an external host. The pattern of unpacking an RPM, patching the asar, and repackaging with system electron is standard for this class of AUR packages. The main concern is that the application itself is proprietary/closed-source from a Chinese vendor distributed via their CDN, and the asar contents are not auditable. This is a real but typical supply-chain concern for binary AUR packages — not clearly malicious, but not clean either. Medium is the appropriate rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=xterminal-bin
    
      3_pkgname=XTerminal
    
      4_aarch64_ver=5.7.17
    
      5_x86_64_ver=5.7.17
    
      6case "${CARCH}" in
    
      7    aarch64)
    
      8        pkgver="${_aarch64_ver}"
    
      9        ;;
    
      10    x86_64)
    
      11        pkgver="${_x86_64_ver}"
    
      12        ;;
    
      13esac
    
      14_electronversion=40
    
      15pkgrel=1
    
      16pkgdesc="Not only powerful SSH tools, but also local consoles, and more coming soon.(Prebuilt version.Use system-wide electron)不仅是强大的SSH工具,更提供本地控制台,以及更多即将推出的开发相关功能."
    
      17arch=(
    
      18    'aarch64'
    
      19    'x86_64'
    
      20)
    
      21url="https://www.xterminal.cn/"
    
      22license=('LicenseRef-custom')
    
      23provides=("${pkgname%-bin}=${pkgver}")
    
      24conflicts=("${pkgname%-bin}")
    
      25depends=(
    
      26    "electron${_electronversion}"
    
      27)
    
      28makedepends=(
    
      29    'asar'
    
      30    'nodejs'
    
      31)
    
      32options=(
    
      33    '!emptydirs'
    
      34)
    
      35source=(
    
      36    "LICENSE.html"
    
      37    "safe_extract_asar.js"
    
      38    "${pkgname%-bin}.sh"
    
      39)
    
      40source_aarch64=("${pkgname%-bin}-${_aarch64_ver}-aarch64.rpm::https://cdn-cn.xterminal.cn/downloads/${_pkgname}-${_aarch64_ver}-linux-aarch64.rpm")
    
      41source_x86_64=("${pkgname%-bin}-${_x86_64_ver}-x86_64.rpm::https://cdn-cn.xterminal.cn/downloads/${_pkgname}-${_x86_64_ver}-linux-x86_64.rpm")
    
      42sha256sums=('8d08a959e0086a206ef3454cc0fc323454c73609cd764f102d8d2d076dafa0af'
    
      43            'a273949f3f2352eb4c4347717b5330695ef3c155c687f19064af628ab47a9cda'
    
      44            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      45sha256sums_aarch64=('ac1ae844db81df42473c4c8cbfb1977b1bf2cfe0b12c16d381e80af52932db26')
    
      46sha256sums_x86_64=('f6ee2aab31dfe99d4e0347315c67a1210d254efb2168be36db7868185ff9c24b')
    
      47_check_electron_version() {
    
      48    echo "Verifying Electron version..."
    
      49    local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
    
      50    local _main_exe=""
    
      51    if [[ -n "${_app_dir}" ]]; then
    
      52        _main_exe=$(find "${_app_dir}" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -n 1 | cut -d' ' -f2-)
    
      53    fi
    
      54    if [[ -n "${_main_exe}" ]]; then
    
      55        local _elec_ver=$(strings "${_main_exe}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1 | head -n 1)
    
      56        if [[ -n "${_elec_ver}" ]]; then
    
      57            if [[ "${_elec_ver}" != "${_electronversion}" ]]; then
    
      58                echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m"
    
      59            else
    
      60                echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      61            fi
    
      62        fi
    
      63    else
    
      64        echo -e "\033[1;33mNote: Could not find Electron binary for version verification.\033[0m"
    
      65    fi
    
      66}
    
      67prepare() {
    
      68    sed -i -e "
    
      69        s/@electronversion@/${_electronversion}/g
    
      70        s/@appname@/${pkgname%-bin}/g
    
      71        s/@runname@/app.asar/g
    
      72        s/@cfgdirname@/${pkgname%-bin}/g
    
      73    " "${srcdir}/${pkgname%-bin}.sh"
    
      74    _check_electron_version
    
      75    sed -i "s/\/opt\/${_pkgname}\/${pkgname%-bin}/${pkgname%-bin}/g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      76    export SRC_DIR="${srcdir}"
    
      77    node safe_extract_asar.js
    
      78    rm -rf "${srcdir}/opt/${_pkgname}/resources/app.asar"
    
      79    find "${srcdir}/app.asar.unpacked/dist" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} \;
    
      80    asar p "${srcdir}/app.asar.unpacked" "${srcdir}/opt/${_pkgname}/resources/app.asar"
    
      81    rm -rf "${srcdir}/opt/${_pkgname}/resources/app.asar.unpacked/node_modules/font-list/libs/"{darwin,win32}
    
      82}
    
      83package() {
    
      84    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      85    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      86	local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
    
      87	cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      88    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      89    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      90        _extension="${_i##*.}"
    
      91        _icon_path="${_i#*share/icons/}"
    
      92        _target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      93        install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      94    done
    
      95    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      96}
    
      97

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2