ydbg

maintainer Integral · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt proprietary .deb binary from dlydbg.cmzq-office.com, which is a non-standard host (not an official distro mirror or well-known vendor CDN). The package is a closed-source Chinese government/enterprise office application from China Mobile (10086.cn), and the download host is a subdomain that appears to be the vendor's own CDN for this software. The sha512sums are pinned, which mitigates substitution attacks for the specific version. However, the binary is a prebuilt executable installed directly to /opt and run as the user, from a host that cannot be independently verified as the canonical upstream. This is a real supply-chain concern: if the host is compromised or the maintainer updates the version without community review, arbitrary code could be executed. The pattern (proprietary binary from vendor CDN, pinned checksums) is common in AUR for commercial software, but the non-standard host and opaque Chinese government-enterprise software context keep this at medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source_x86_64=("https://dlydbg.cmzq-office.com/pc/uos_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt proprietary .deb binary from dlydbg.cmzq-office.com, which is a non-standard host (not an official distro mirror or well-known vendor CDN). The package is a closed-source Chinese government/enterprise office application from China Mobile (10086.cn), and the download host is a subdomain that appears to be the vendor's own CDN for this software. The sha512sums are pinned, which mitigates substitution attacks for the specific version. However, the binary is a prebuilt executable installed directly to /opt and run as the user, from a host that cannot be independently verified as the canonical upstream. This is a real supply-chain concern: if the host is compromised or the maintainer updates the version without community review, arbitrary code could be executed. The pattern (proprietary binary from vendor CDN, pinned checksums) is common in AUR for commercial software, but the non-standard host and opaque Chinese government-enterprise software context keep this at medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Integral <integral@member.fsf.org>
    
      2
    
      3pkgname=ydbg
    
      4pkgver=1.0.6
    
      5pkgrel=1
    
      6pkgdesc="移动办公 An office software for government & enterprise, developed by China Mobile."
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://zhengqi.10086.cn/hebangong/index.html"
    
      9license=('LicenseRef-ydbg')
    
      10depends=('gtk3' 'libwebp' 'kwin' 'libbsd')
    
      11source_x86_64=("https://dlydbg.cmzq-office.com/pc/uos_${pkgver}_amd64.deb")
    
      12source_aarch64=("https://dlydbg.cmzq-office.com/pc/uos_${pkgver}_arm64.deb")
    
      13sha512sums_x86_64=('736ef40a14ec799c9857200f1f4aa5f99ab598164a42bbb75b563d3c139f068f462d92131f08618e56f36a21dbf40e62e9e07cf38d39cc2d30a76814c0f0d1b5')
    
      14sha512sums_aarch64=('7cb8948d4eab79d3e73853c6bbbc418660256f097d26ec0c5caeef7762c2d1cd772a3fea300d14b87b9841a4483cef636f0a9ede72fca0c95eebfd24e0f67285')
    
      15
    
      16package() {
    
      17	bsdtar -xvf data.tar.xz -C "${pkgdir}/"
    
      18
    
      19	# Launcher
    
      20	mkdir -p "${pkgdir}/usr/bin/"
    
      21	ln -s "/opt/apps/com.cmic.yidongbangong/files/yidongbangong" "${pkgdir}/usr/bin/${pkgname}"
    
      22
    
      23	# Desktop Entry
    
      24	install -Dm644 "${pkgdir}/opt/apps/com.cmic.yidongbangong/entries/applications/com.cmic.yidongbangong.desktop" \
    
      25		-t "${pkgdir}/usr/share/applications/"
    
      26
    
      27	# Icon
    
      28	cp -a "${pkgdir}/opt/apps/com.cmic.yidongbangong/entries/icons/" "${pkgdir}/usr/share/"
    
      29
    
      30	# License
    
      31	install -Dm644 ${pkgdir}/opt/apps/com.cmic.yidongbangong/files/{LICENSE.electron.txt,LICENSES.chromium.html} \
    
      32		-t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2