yong
maintainer orphaned
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from source hosted on a non-whitelisted but plausible project mirror (fastgit.org), which is a common practice on AUR; the build process uses standard tools and the source is the project's own, with no remote code execution or malicious payload observed.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from source hosted on a non-whitelisted but plausible project mirror (fastgit.org), which is a common practice on AUR; the build process uses standard tools and the source is the project's own, with no remote code execution or malicious payload observed.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=("git+https://hub.fastgit.org/dgod/yong.git" "git+https://hub.fastgit.org/dgod/build.js.git")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: firef <use_my_id at gmail dot com>
2
3
pkgname=yong
4
pkgver=2.5.0
5
pkgrel=1
6
pkgdesc="Tiny Small Chinese Input Method"
7
arch=('x86_64')
8
url="https://github.com/dgod/yong"
9
license=('GPL')
10
11
makedepends=('git' 'nodejs' 'gcc' 'wayland' 'gtk2' 'gtk3' 'qt5-base')
12
#provides=("yong=$pkgver")
13
14
depends=('gtk3')
15
16
#install=yong.install
17
18
source=("git+https://hub.fastgit.org/dgod/yong.git" "git+https://hub.fastgit.org/dgod/build.js.git")
19
md5sums=('SKIP' 'SKIP')
20
21
22
pkgver() {
23
cd "$srcdir/$pkgname/install"
24
awk '/%define +version/{print $3}' yong.spec | sed 's|-|.|g'
25
}
26
prepare(){
27
cd $srcdir/$pkgname
28
mkdir -p {llib,cloud,gbk,mb,vim}/l64
29
mkdir -p {im,config}/{l64-gtk3,l64-gtk2}
30
mkdir -p im/gtk-im/{l64-gtk3,l64-gtk2}
31
mkdir -p im/IMdkit/l64
32
mkdir -p im/qt5-im/l64-qt5
33
34
35
sed -i 's/copy_build("l32");//' install/build.txt
36
sed -i 's_MOC=.*_MOC="/usr/bin/moc"_' im/qt5-im/build.txt
37
# modify shuangping rules
38
sed -i -r -e "s/'p'(,[1|2],\"\wh{0,1}un\")/'y'\1/g" \
39
-e "s/'d'(,[1|2],\"\wh{0,1}uang\")/'l'\1/g" \
40
-e "s/'d'(,[1|2],\"\wh{0,1}iang\")/'l'\1/g" \
41
-e "s/'y'(,[1|2],\"\wh{0,1}uai\")/'k'\1/g" \
42
-e "s/'y'(,[1|2],\"\wh{0,1}ing\")/'k'\1/g" \
43
-e "s/'w'(,[1|2],\"\wh{0,1}ua\")/'x'\1/g" \
44
-e "s/'w'(,[1|2],\"\wh{0,1}ia\")/'x'\1/g" \
45
-e "s/'b'(,[1|2],\"\wh{0,1}ou\")/'z'\1/g" \
46
-e "s/'z'(,[1|2],\"\wh{0,1}ei\")/'w'\1/g" \
47
-e "s/'k'(,[1|2],\"\wh{0,1}ao\")/'c'\1/g" \
48
-e "s/'l'(,[1|2],\"\wh{0,1}ai\")/'d'\1/g" \
49
-e "s/'n'(,[1|2],\"\wh{0,1}in\")/'b'\1/g" \
50
-e "s/'x'(,[1|2],\"\wh{0,1}ie\")/'p'\1/g" \
51
-e "s/'c'(,[1|2],\"\wh{0,1}iao\")/'n'\1/g" common/pinyin.c
52
cp -f common/pinyin.c cloud/pinyin.c
53
54
sed -i 's/"自然码"/"小鹤双拼"/' config/config_ui.c
55
}
56
build() {
57
58
buildjs="$srcdir/build.js/build.js"
59
cd $srcdir/$pkgname
60
node $buildjs l64
61
node $buildjs -C install copy
62
}
63
64
package() {
65
mkdir -p $pkgdir/usr/bin
66
mkdir -p $pkgdir/usr/share
67
cp -a $srcdir/$pkgname/install/yong $pkgdir/usr/share
68
cd $pkgdir/usr/share/yong
69
ln -sf ../share/yong/l64/yong-gtk3 $pkgdir/usr/bin/yong
70
ln -sf ../share/yong/l64/yong-config-gtk3 $pkgdir/usr/bin/yong-config
71
install -D $srcdir/$pkgname/im/qt5-im/l64-qt5/libyongplatforminputcontextplugin.so $pkgdir/usr/lib/qt/plugins/platforminputcontexts/libyongplatforminputcontextplugin.so
72
install -D locale/zh_CN.mo $pkgdir/usr/share/locale/zh_CN/LC_MESSAGES/yong.mo
73
install -D l64/gtk-im/im-yong-gtk2.so $pkgdir/usr/lib/gtk-2.0/2.10.0/immodules/im-yong.so
74
install -D l64/gtk-im/im-yong-gtk3.so $pkgdir/usr/lib/gtk-3.0/3.0.0/immodules/im-yong.so
75
76
# modify config file
77
sed -i -e 's/default=0/default=4/' \
78
-e "s/select=LSHIFT RSHIFT/select=; '/" \
79
-e "s/CNen=LCTRL/CNen=LSHIFT/" \
80
-e "s/page=- =/page=, ./" \
81
-e "/keypad=0/a\ABCD=1" \
82
./yong.ini
83
84
cat << EOF >> ./yong.ini
85
[hepy]
86
name=双拼
87
engine=libmb.so
88
arg=mb/pinyin.txt
89
overlay=mb/sp.ini
90
sp=zrm
91
EOF
92
sed -i -e 's/4=gbk/4=pinyin/' \
93
-e 's/5=pinyin/5=hepy/' \
94
./yong.ini
95
96
# modify end
97
98
# change default skin
99
png="iVBORw0KGgoAAAANSUhEUgAAAB4AAAATCAIAAAAIzCorAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9sFCwYzDrySergAAAAhSURBVDjLY/z8+TMDbQATA83AqNGjRo8aPWr0qNEj3mgAvhgC/8aR0LcAAAAASUVORK5CYII="
100
echo $png | base64 -d > ./skin/name1.png
101
for name in skin skin0 skin1 skin2; do
102
sed -i -e 's/s2t=84,3/name=90,6/' \
103
-e 's/s2t_s=jian1.png/name_img=name1.png/' \
104
-e 's/s2t_t=fan1.png/name_font=Bold 18/' \
105
-e 's/keyboard=108,3/name_color=#3975ce/' \
106
-e '/keyboard_img/d' ./skin/${name}.ini
107
done
108
# modify end
109
110
}
111
post_install() {
112
gtk-query-immodules-2.0 --update-cache
113
gtk-query-immodules-3.0 --update-cache
114
}
115
116
post_remove() {
117
gtk-query-immodules-2.0 --update-cache
118
gtk-query-immodules-3.0 --update-cache
119
}
120
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |