youdaodict-bin
MEDIUM
maintainer zxp19821005
0 votes
scanned 2026-11-05 10:11:24.252079
Why flagged
Installs a prebuilt Electron app (.deb) from a personal third-party GitHub repo (kota-rina3/hokeshi) unrelated to official Youdao/NetEase infrastructure; while checksums are present, the binary is unofficial and unverifiable, posing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
"LICENSE.html::https://c.youdao.com/dict/law/youdaofanyi_pc_privacy.html"
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review
llm_review
An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Installs a prebuilt Electron app (.deb) from a personal third-party GitHub repo (kota-rina3/hokeshi) unrelated to official Youdao/NetEase infrastructure; while checksums are present, the binary is unofficial and unverifiable, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
_appname=youdao
3
pkgname="${_appname}dict-bin"
4
_debname="netease.${_appname}.dict.otohime"
5
pkgver=11.3.26.0
6
_electronversion=42
7
pkgrel=1
8
pkgdesc="Third-party A copy of Youdao Dict translation.有道翻译复刻版"
9
arch=(
10
'aarch64'
11
'x86_64'
12
)
13
url="http://cidian.youdao.com/"
14
_dlurl="https://github.com/kota-rina3/hokeshi"
15
license=('LicenseRef-youdaodict')
16
provides=("${pkgname%-bin}=${pkgver}")
17
conflicts=("${pkgname%-bin}")
18
depends=(
19
"electron${_electronversion}"
20
)
21
source=(
22
"LICENSE.html::https://c.youdao.com/dict/law/youdaofanyi_pc_privacy.html"
23
"${pkgname%-bin}.js"
24
"${pkgname%-bin}.sh"
25
)
26
source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::${_dlurl}/releases/download/${pkgname%-bin}-v${pkgver}/${_debname}_${pkgver}_arm64.deb")
27
source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.deb::${_dlurl}/releases/download/${pkgname%-bin}-v${pkgver}/${_debname}_${pkgver}_amd64.deb")
28
sha256sums=('5d60752880454c54621bfe3c8a886c714f6f47f7fe4890b230e9cd7f78e300f5'
29
'562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
30
'e0aa8bf265dbd30108314bbd34948d9d878320f97d6b4e5d85e1ce6f83a655e1')
31
sha256sums_aarch64=('7210f5ba4f5894311c3e1bb8d5a9e7216a501431f9acb63a7cefb7bf465c6f15')
32
sha256sums_x86_64=('43e2f891b20fa3ffd52b18c948abb17c6c7136bf93f7db18dc9f51e23abfbe3e')
33
_get_app_dir() {
34
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
35
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
36
}
37
_check_electron_version() {
38
local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
39
-executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
40
| grep -oP 'Electron/\K[0-9]+' | head -1)
41
[[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
42
(( _v == _electronversion )) && c=32 || c=31
43
echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
44
}
45
_install_icons() {
46
local _src="${1:-${srcdir}}" _name="${pkgname%-bin}" _icon _ext _size _dest
47
while IFS= read -r -d '' _icon; do
48
_ext="${_icon##*.}"
49
_size=$(echo "${_icon%/*}" | grep -oE '[0-9]+x[0-9]+|scalable' | head -1)
50
[[ -z "${_size}" ]] && _size=$([[ "${_ext}" == svg ]] && echo scalable || od -An -tu1 -j16 -N8 "${_icon}" 2>/dev/null | awk '{printf "%dx%d",$1*16777216+$2*65536+$3*256+$4,$5*16777216+$6*65536+$7*256+$8}')
51
[[ "${_size}" =~ ^[0-9]+x[0-9]+$ ]] || _size=scalable
52
_dest=$([[ "${_icon}" == */share/pixmaps/* ]] && echo pixmaps || echo "icons/hicolor/${_size}/apps")
53
install -Dm644 "${_icon}" "${pkgdir}/usr/share/${_dest}/${_name}.${_ext}"
54
done < <(find "${_src}" \( -path '*/share/icons/*' -o -path '*/share/pixmaps/*' -o -path '*entries/icons/*' \) -type f \( -name '*.png' -o -name '*.svg' \) -print0 2>/dev/null)
55
}
56
prepare() {
57
sed -i -e "
58
s/@electronversion@/${_electronversion}/g
59
s/@appname@/${pkgname%-bin}/g
60
" "${srcdir}/${pkgname%-bin}.sh" "${srcdir}/${pkgname%-bin}.js"
61
bsdtar -xf "${srcdir}/data."*
62
_check_electron_version
63
sed -i -e "
64
s/Exec=\/opt\/apps\/${_debname}\/files\/${_appname}.sh/Exec=${pkgname%-bin} %U/g
65
s/Icon=\/opt\/apps\/${_debname}\/files\/resources\/${_appname}.png/Icon=${pkgname%-bin}/g
66
" "${srcdir}/opt/apps/${_debname}/entries/applications/${_appname}.desktop"
67
}
68
package() {
69
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
70
install -Dm644 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
71
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
72
install -Dm644 "${srcdir}/opt/apps/${_debname}/entries/applications/${_appname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
73
_install_icons
74
install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
75
}
76
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-05 10:11:24 | Medium | 3 |
| 2026-11-05 10:09:05 | Medium | 3 |