xterminal-bin

LOW

maintainer zxp19821005 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt RPMs from the project's own CDN (cdn-cn.xterminal.cn), which is plausibly official; while not on a standard host whitelist, it hosts legitimate binaries for the software being packaged, and the build process involves unpacking and repackaging ASAR resources without executing arbitrary remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt RPMs from the project's own CDN (cdn-cn.xterminal.cn), which is plausibly official; while not on a standard host whitelist, it hosts legitimate binaries for the software being packaged, and the build process involves unpacking and repackaging ASAR resources without executing arbitrary remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 source_aarch64=("${pkgname%-bin}-${_aarch64_ver}-aarch64.rpm::https://cdn-cn.xterminal.cn/downloads/${_pkgname}-${_aarch64_ver}-linux-aarch64.rpm")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=xterminal-bin
    
      3_pkgname=XTerminal
    
      4_aarch64_ver=5.8.6
    
      5_x86_64_ver=5.8.6
    
      6case "${CARCH}" in
    
      7    aarch64)
    
      8        pkgver="${_aarch64_ver}"
    
      9        ;;
    
      10    x86_64)
    
      11        pkgver="${_x86_64_ver}"
    
      12        ;;
    
      13esac
    
      14_electronversion=40
    
      15pkgrel=1
    
      16pkgdesc="Not only powerful SSH tools, but also local consoles, and more coming soon.(Prebuilt version.Use system-wide electron)不仅是强大的SSH工具,更提供本地控制台,以及更多即将推出的开发相关功能."
    
      17arch=(
    
      18    'aarch64'
    
      19    'x86_64'
    
      20)
    
      21url="https://www.xterminal.cn/"
    
      22license=('LicenseRef-custom')
    
      23provides=("${pkgname%-bin}=${pkgver}")
    
      24conflicts=("${pkgname%-bin}")
    
      25depends=(
    
      26    "electron${_electronversion}"
    
      27)
    
      28makedepends=(
    
      29    'asar'
    
      30    'nodejs'
    
      31)
    
      32options=(
    
      33    '!emptydirs'
    
      34)
    
      35source=(
    
      36    "LICENSE.html"
    
      37    "safe_extract_asar.js"
    
      38    "${pkgname%-bin}.sh"
    
      39)
    
      40source_aarch64=("${pkgname%-bin}-${_aarch64_ver}-aarch64.rpm::https://cdn-cn.xterminal.cn/downloads/${_pkgname}-${_aarch64_ver}-linux-aarch64.rpm")
    
      41source_x86_64=("${pkgname%-bin}-${_x86_64_ver}-x86_64.rpm::https://cdn-cn.xterminal.cn/downloads/${_pkgname}-${_x86_64_ver}-linux-x86_64.rpm")
    
      42sha256sums=('8d08a959e0086a206ef3454cc0fc323454c73609cd764f102d8d2d076dafa0af'
    
      43            'a273949f3f2352eb4c4347717b5330695ef3c155c687f19064af628ab47a9cda'
    
      44            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      45sha256sums_aarch64=('a8acc2b2aeb97f0c163b8b212f29d09cb030653ee084f416d69b805f28dc9418')
    
      46sha256sums_x86_64=('a89c9dbd14ac8323a45b040851a67537825e94345de2e29cf28283a0d4591753')
    
      47_get_app_dir() {
    
      48    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      49}
    
      50_check_electron_version() {
    
      51    echo "Verifying Electron version..."
    
      52    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
    
      53    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
    
      54    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
    
      55    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
    
      56    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
    
      57        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
    
      58        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      59}
    
      60prepare() {
    
      61    sed -i -e "
    
      62        s/@electronversion@/${_electronversion}/g
    
      63        s/@appname@/${pkgname%-bin}/g
    
      64        s/@runname@/app.asar/g
    
      65        s/@cfgdirname@/${pkgname%-bin}/g
    
      66    " "${srcdir}/${pkgname%-bin}.sh"
    
      67    _check_electron_version
    
      68    sed -i "s/\/opt\/${_pkgname}\/${pkgname%-bin}/${pkgname%-bin}/g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      69    local _app_dir=$(_get_app_dir)
    
      70    asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked" || continue
    
      71    rm -rf "${_app_dir}/resources/app.asar"
    
      72    find "${srcdir}/app.asar.unpacked/dist" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} \;
    
      73    asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
    
      74    rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/font-list/libs/"{darwin,win32}
    
      75}
    
      76package() {
    
      77    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      78    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      79	local _app_dir=$(_get_app_dir)
    
      80	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      81    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      82    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      83        _extension="${_i##*.}"
    
      84        _icon_path="${_i#*share/icons/}"
    
      85        _target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      86        install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      87    done
    
      88    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2