yiyang-suite-bin
LOW
maintainer zxp19821005
0 votes
scanned 2026-09-23 13:43:18.444085
Why flagged
Downloads a prebuilt .deb from pkg-cdn.jianguoyun.com (Jianguoyun/Nutstore CDN, a Chinese cloud storage/CDN service) which is not the project's own official domain, but checksums are provided and verified; the package is a standard Electron app repackager with no obfuscated payloads or exfiltration, making this low risk despite the non-standard download host.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt .deb from pkg-cdn.jianguoyun.com (Jianguoyun/Nutstore CDN, a Chinese cloud storage/CDN service) which is not the project's own official domain, but checksums are provided and verified; the package is a standard Electron app repackager with no obfuscated payloads or exfiltration, making this low risk despite the non-standard download host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::https://pkg-cdn.jianguoyun.com/static/exe/installer/${_pkgname}-Setup-linux-arm64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=yiyang-suite-bin
3
_pkgname=YiYang-Suite
4
pkgver=2.5.1
5
_electronversion=29
6
pkgrel=1
7
pkgdesc="An office tool suite that integrates mind maps, outline notes, flowcharts, Markdown, Office, and PDF annotations, dedicated to creating a concise and convenient document production environment for professionals."
8
arch=(
9
'aarch64'
10
'x86_64'
11
)
12
url="https://www.eo2suite.cn"
13
license=('LicenseRef-custom')
14
provides=("${pkgname%-bin}=${pkgver}")
15
conflicts=("${pkgname%-bin}")
16
depends=(
17
"electron${_electronversion}-bin"
18
'7zip'
19
)
20
makedepends=(
21
'asar'
22
)
23
options=(
24
'!strip'
25
'!emptydirs'
26
)
27
source=("${pkgname%-bin}.sh")
28
source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::https://pkg-cdn.jianguoyun.com/static/exe/installer/${_pkgname}-Setup-linux-arm64.deb")
29
source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.deb::https://pkg-cdn.jianguoyun.com/static/exe/installer/${_pkgname}-Setup-linux-amd64.deb")
30
sha256sums=('5ec6b59a287204cbcbac040071f19d88897a0cb3156e794e6f05847cf5449a9e')
31
sha256sums_aarch64=('e1df492c702d5d256dd8c52ae5e9115ca5e01aa13ae5afeb595d7f1216c17fe1')
32
sha256sums_x86_64=('116955dce936b0a0a8407bf062c600d7c429e8da9c09ba7052cd573f640bccb4')
33
pkgver() {
34
cd "${srcdir}/app.asar.unpacked"
35
awk -F'"' '/"version"/{print $4}' package.json
36
}
37
_get_app_dir() {
38
find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
39
}
40
_check_electron_version() {
41
echo "Verifying Electron version..."
42
local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
43
[[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
44
local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
45
[[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
46
[[ "${_elec_ver}" != "${_electronversion}" ]] &&
47
echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
48
echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
49
}
50
prepare() {
51
sed -i -e "
52
s/@electronversion@/${_electronversion}/g
53
s/@appname@/${pkgname%-bin}/g
54
s/@runname@/app.asar/g
55
s/@cfgdirname@/${pkgname%-bin}/g
56
" "${srcdir}/${pkgname%-bin}.sh"
57
bsdtar -xf "${srcdir}/data."*
58
_check_electron_version
59
sed -i "s/\/opt\/eo2suite\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
60
local _app_dir=$(_get_app_dir)
61
case "${CARCH}" in
62
aarch64)
63
_arch_rem="x64"
64
_archdir="arm64"
65
;;
66
x86_64)
67
_arch_rem="arm"
68
_archdir="x64"
69
;;
70
esac
71
asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked"
72
find "${srcdir}/app.asar.unpacked/dist" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} +
73
find "${srcdir}" \
74
\( -name "*mac*" -o -name "*${_arch_rem}*" -o -name "*ia32*" -o -name "*darwin*" \) \
75
-exec rm -rf {} +
76
asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
77
ln -sf "/usr/bin/7za" "${_app_dir}/resources/app.asar.unpacked/node_modules/7zip-bin/linux/${_archdir}/7za"
78
}
79
package() {
80
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
81
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
82
local _app_dir=$(_get_app_dir)
83
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
84
install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
85
find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
86
_extension="${_i##*.}"
87
_icon_path="${_i#*share/icons/}"
88
_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
89
install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
90
done
91
install -Dm644 "${_app_dir}/LICENSE"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
92
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-23 13:43:18 | Low | 3 |
| 2026-09-23 13:40:34 | Medium | 3 |