yong
LOW
maintainer orphaned
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from source hosted on a non-whitelisted but plausible project mirror (fastgit.org), which is a common practice on AUR; the build process uses standard tools and the source is the project's own, with no remote code execution or malicious payload observed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from source hosted on a non-whitelisted but plausible project mirror (fastgit.org), which is a common practice on AUR; the build process uses standard tools and the source is the project's own, with no remote code execution or malicious payload observed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=("git+https://hub.fastgit.org/dgod/yong.git" "git+https://hub.fastgit.org/dgod/build.js.git")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: firef <use_my_id at gmail dot com>
2
3
pkgname=yong
4
pkgver=2.5.0
5
pkgrel=1
6
pkgdesc="Tiny Small Chinese Input Method"
7
arch=('x86_64')
8
url="https://github.com/dgod/yong"
9
license=('GPL')
10
11
makedepends=('git' 'nodejs' 'gcc' 'wayland' 'gtk2' 'gtk3' 'qt5-base')
12
#provides=("yong=$pkgver")
13
14
depends=('gtk3')
15
16
#install=yong.install
17
18
source=("git+https://hub.fastgit.org/dgod/yong.git" "git+https://hub.fastgit.org/dgod/build.js.git")
19
md5sums=('SKIP' 'SKIP')
20
21
22
pkgver() {
23
cd "$srcdir/$pkgname/install"
24
awk '/%define +version/{print $3}' yong.spec | sed 's|-|.|g'
25
}
26
prepare(){
27
cd $srcdir/$pkgname
28
mkdir -p {llib,cloud,gbk,mb,vim}/l64
29
mkdir -p {im,config}/{l64-gtk3,l64-gtk2}
30
mkdir -p im/gtk-im/{l64-gtk3,l64-gtk2}
31
mkdir -p im/IMdkit/l64
32
mkdir -p im/qt5-im/l64-qt5
33
34
35
sed -i 's/copy_build("l32");//' install/build.txt
36
sed -i 's_MOC=.*_MOC="/usr/bin/moc"_' im/qt5-im/build.txt
37
# modify shuangping rules
38
sed -i -r -e "s/'p'(,[1|2],\"\wh{0,1}un\")/'y'\1/g" \
39
-e "s/'d'(,[1|2],\"\wh{0,1}uang\")/'l'\1/g" \
40
-e "s/'d'(,[1|2],\"\wh{0,1}iang\")/'l'\1/g" \
41
-e "s/'y'(,[1|2],\"\wh{0,1}uai\")/'k'\1/g" \
42
-e "s/'y'(,[1|2],\"\wh{0,1}ing\")/'k'\1/g" \
43
-e "s/'w'(,[1|2],\"\wh{0,1}ua\")/'x'\1/g" \
44
-e "s/'w'(,[1|2],\"\wh{0,1}ia\")/'x'\1/g" \
45
-e "s/'b'(,[1|2],\"\wh{0,1}ou\")/'z'\1/g" \
46
-e "s/'z'(,[1|2],\"\wh{0,1}ei\")/'w'\1/g" \
47
-e "s/'k'(,[1|2],\"\wh{0,1}ao\")/'c'\1/g" \
48
-e "s/'l'(,[1|2],\"\wh{0,1}ai\")/'d'\1/g" \
49
-e "s/'n'(,[1|2],\"\wh{0,1}in\")/'b'\1/g" \
50
-e "s/'x'(,[1|2],\"\wh{0,1}ie\")/'p'\1/g" \
51
-e "s/'c'(,[1|2],\"\wh{0,1}iao\")/'n'\1/g" common/pinyin.c
52
cp -f common/pinyin.c cloud/pinyin.c
53
54
sed -i 's/"自然码"/"小鹤双拼"/' config/config_ui.c
55
}
56
build() {
57
58
buildjs="$srcdir/build.js/build.js"
59
cd $srcdir/$pkgname
60
node $buildjs l64
61
node $buildjs -C install copy
62
}
63
64
package() {
65
mkdir -p $pkgdir/usr/bin
66
mkdir -p $pkgdir/usr/share
67
cp -a $srcdir/$pkgname/install/yong $pkgdir/usr/share
68
cd $pkgdir/usr/share/yong
69
ln -sf ../share/yong/l64/yong-gtk3 $pkgdir/usr/bin/yong
70
ln -sf ../share/yong/l64/yong-config-gtk3 $pkgdir/usr/bin/yong-config
71
install -D $srcdir/$pkgname/im/qt5-im/l64-qt5/libyongplatforminputcontextplugin.so $pkgdir/usr/lib/qt/plugins/platforminputcontexts/libyongplatforminputcontextplugin.so
72
install -D locale/zh_CN.mo $pkgdir/usr/share/locale/zh_CN/LC_MESSAGES/yong.mo
73
install -D l64/gtk-im/im-yong-gtk2.so $pkgdir/usr/lib/gtk-2.0/2.10.0/immodules/im-yong.so
74
install -D l64/gtk-im/im-yong-gtk3.so $pkgdir/usr/lib/gtk-3.0/3.0.0/immodules/im-yong.so
75
76
# modify config file
77
sed -i -e 's/default=0/default=4/' \
78
-e "s/select=LSHIFT RSHIFT/select=; '/" \
79
-e "s/CNen=LCTRL/CNen=LSHIFT/" \
80
-e "s/page=- =/page=, ./" \
81
-e "/keypad=0/a\ABCD=1" \
82
./yong.ini
83
84
cat << EOF >> ./yong.ini
85
[hepy]
86
name=双拼
87
engine=libmb.so
88
arg=mb/pinyin.txt
89
overlay=mb/sp.ini
90
sp=zrm
91
EOF
92
sed -i -e 's/4=gbk/4=pinyin/' \
93
-e 's/5=pinyin/5=hepy/' \
94
./yong.ini
95
96
# modify end
97
98
# change default skin
99
png="iVBORw0KGgoAAAANSUhEUgAAAB4AAAATCAIAAAAIzCorAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9sFCwYzDrySergAAAAhSURBVDjLY/z8+TMDbQATA83AqNGjRo8aPWr0qNEj3mgAvhgC/8aR0LcAAAAASUVORK5CYII="
100
echo $png | base64 -d > ./skin/name1.png
101
for name in skin skin0 skin1 skin2; do
102
sed -i -e 's/s2t=84,3/name=90,6/' \
103
-e 's/s2t_s=jian1.png/name_img=name1.png/' \
104
-e 's/s2t_t=fan1.png/name_font=Bold 18/' \
105
-e 's/keyboard=108,3/name_color=#3975ce/' \
106
-e '/keyboard_img/d' ./skin/${name}.ini
107
done
108
# modify end
109
110
}
111
post_install() {
112
gtk-query-immodules-2.0 --update-cache
113
gtk-query-immodules-3.0 --update-cache
114
}
115
116
post_remove() {
117
gtk-query-immodules-2.0 --update-cache
118
gtk-query-immodules-3.0 --update-cache
119
}
120
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |