ynote-desktop-bin
MEDIUM
maintainer zxp19821005
5 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (artifact.lx.netease.com), which is not the project's official release domain, creating a supply-chain risk if the host is compromised or spoofed.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
"${pkgname%-bin}-${pkgver}.deb::https://artifact.lx.netease.com/download/ynote-electron/%E6%9C%89%E9%81%93%E4%BA%91%E7%AC%94%E8%AE%B0-web.deb" -
PKGBUILD:28
"LICENSE.html::https://note.youdao.com/license.html"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (artifact.lx.netease.com), which is not the project's official release domain, creating a supply-chain risk if the host is compromised or spoofed.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
# Contributor: yjun <jerrysteve1101 at gmail dot com>
3
# Contributor: FlyInWind <2518509078@qq.com>
4
pkgname=ynote-desktop-bin
5
_zhsname='有道云笔记'
6
pkgver=8.2.81
7
_electronversion=22
8
pkgrel=1
9
pkgdesc="Netease Youdao Ynote for Linux.(Prebuilt version.Use system-wide electron)"
10
arch=('x86_64')
11
url="https://note.youdao.com/"
12
license=('LicenseRef-custom')
13
provides=("${pkgname%-bin}=${pkgver}")
14
conflicts=("${pkgname%-bin}")
15
depends=(
16
"electron${_electronversion}"
17
'perl'
18
)
19
makedepends=(
20
'asar'
21
)
22
options=(
23
'!strip'
24
'!emptydirs'
25
)
26
source=(
27
"${pkgname%-bin}-${pkgver}.deb::https://artifact.lx.netease.com/download/ynote-electron/%E6%9C%89%E9%81%93%E4%BA%91%E7%AC%94%E8%AE%B0-web.deb"
28
"LICENSE.html::https://note.youdao.com/license.html"
29
"${pkgname%-bin}.sh"
30
)
31
sha256sums=('SKIP'
32
'a8aec47c7cc6e6d838d525c89b58a962d650c84b0ebec09ecfb8955381fe6460'
33
'cebedc3391cbab6d43f37fbf3a87ddaad16597cb5ea487a4d55b1f478d810082')
34
pkgver() {
35
cat "${srcdir}/.pkgver" 2>/dev/null || echo "${pkgver}"
36
}
37
_get_app_dir() {
38
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
39
}
40
_check_electron_version() {
41
local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
42
-executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
43
| grep -oP 'Electron/\K[0-9]+' | head -1)
44
[[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
45
(( _v == _electronversion )) && c=32 || c=31
46
echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
47
}
48
prepare() {
49
sed -i -e "
50
s/@electronversion@/${_electronversion}/g
51
s/@appname@/${pkgname%-bin}/g
52
s/@runname@/app.asar/g
53
" "${srcdir}/${pkgname%-bin}.sh"
54
bsdtar -xf "${srcdir}/data."*
55
_check_electron_version
56
local _app_dir="$(_get_app_dir)"
57
sed -i -e "
58
s/\"\/opt\/${_zhsname}\/${pkgname%-bin}\" --no-sandbox/${pkgname%-bin}/g
59
s/\/opt\/${_zhsname}\/resources\/build\/icon.svg/${pkgname%-bin}/g
60
s/Utility/Office/g
61
" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
62
asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked"
63
grep '"version":' "${srcdir}/app.asar.unpacked/package.json" | awk -F'"version": "' '{print $2}' | awk -F',' '{print $1}' | tr -d '"' > "${srcdir}/.pkgver"
64
sed -i -e "
65
s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g
66
s/\.\.\/dll\/scholar/dll\/scholar/g
67
" "${srcdir}/app.asar.unpacked/dist/"{main.js,scholar.js}
68
asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
69
rm -rf \
70
"${_app_dir}/resources/app.asar.unpacked/node_modules/ffi-napi/prebuilds/"{darwin-x64,linux-arm64,win32-ia32,win32-x64} \
71
"${_app_dir}/resources/app.asar.unpacked/node_modules/ref-napi/prebuilds/"{darwin-x64,linux-arm64,win32-ia32,win32-x64} \
72
"${_app_dir}/resources/app.asar.unpacked/node_modules/node-screenshots-linux-x64-musl" \
73
"${_app_dir}/resources/app.asar.unpacked/node_modules/koffi/build/koffi/"{*win*,*bsd*,*arm*,linux_ia32,linux_loong64,linux_riscv64d}
74
}
75
package() {
76
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
77
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
78
local _app_dir="$(_get_app_dir)"
79
cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
80
install -Dm644 "${_app_dir}/dll/scholar/client.so" -t "${pkgdir}/usr/lib/${pkgname%-bin}/dll/scholar"
81
install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
82
find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
83
_extension="${_i##*.}"
84
_icon_path="${_i#*share/icons/}"
85
_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
86
install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
87
done
88
install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
89
}
90
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 01:15:21 | Medium | 2 |