yy-wine-1

LOW

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

This PKGBUILD packages YY Voice (a Chinese VoIP client) to run under Wine on Linux. The Windows installer (YYSetup) is downloaded from yydl.duowan.com, which is actually the official CDN/download host for YY/Duowan (duowan.com is the parent company of YY). This is not an unofficial or personal host — it is the vendor's own distribution infrastructure. The exe is not executed during the build or package() phase; it is merely copied into opt/${pkgname}/ for the user to run later via Wine through run.sh. There is no code execution of the binary during packaging. The md5sums provide basic integrity checking. The main concerns are: (1) the package is quite old and uses md5 checksums, (2) the FTP source from icmp.eu.org for the tarball is a third-party mirror which is more concerning than the vendor CDN, but still just data/scripts being copied. Overall this is sloppy/non-standard packaging (old md5 hashes, third-party FTP mirror, unknown license) but does not represent a genuine supply-chain attack or code execution risk during installation.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): This PKGBUILD packages YY Voice (a Chinese VoIP client) to run under Wine on Linux. The Windows installer (YYSetup) is downloaded from yydl.duowan.com, which is actually the official CDN/download host for YY/Duowan (duowan.com is the parent company of YY). This is not an unofficial or personal host — it is the vendor's own distribution infrastructure. The exe is not executed during the build or package() phase; it is merely copied into opt/${pkgname}/ for the user to run later via Wine through run.sh. There is no code execution of the binary during packaging. The md5sums provide basic integrity checking. The main concerns are: (1) the package is quite old and uses md5 checksums, (2) the FTP source from icmp.eu.org for the tarball is a third-party mirror which is more concerning than the vendor CDN, but still just data/scripts being copied. Overall this is sloppy/non-standard packaging (old md5 hashes, third-party FTP mirror, unknown license) but does not represent a genuine supply-chain attack or code execution risk during installation.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("ftp://ftp.icmp.eu.org/tools/${pkgname}-${pkgver}-${pkgrel}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# 
    
      2# Maintainer: Goodman Leung<gbcbooksmj@gmail.com>
    
      3#
    
      4
    
      5pkgname=yy-wine-1
    
      6pkgver=1.0
    
      7pkgrel=1
    
      8pkgdesc="YY Voice from douwan run on wine"
    
      9arch=('i686' 'x86_64')
    
      10url="http://www.yy.com/"
    
      11license=('unknow')
    
      12groups=()
    
      13depends=('p7zip' 'wine' 'xorg-xwininfo' 'xdotool')
    
      14makedepends=()
    
      15install=
    
      16changelog=
    
      17_mirror="http://yydl.duowan.com"
    
      18YYver=8.30.0.0
    
      19source=("ftp://ftp.icmp.eu.org/tools/${pkgname}-${pkgver}-${pkgrel}.tar.gz"
    
      20	"${_mirror}/4/setup/YYSetup-${YYver}-zh-CN.exe"
    
      21	"run.sh")
    
      22md5sums=("03a803bc2e36b3e48a855f0bf96be1ef"
    
      23	"dc0bcee0ab07845e3c0b4156c042d9cc"
    
      24	"dab77123bed67a79d771fd718dea4be2")
    
      25
    
      26build() {
    
      27  pushd ${srcdir}
    
      28  msg "update shell infornamtion ..."
    
      29  sed -i "s/PKGNAME/${pkgname}/" run.sh 
    
      30  sed -i "s/APPVERSION/${YYver}/" run.sh
    
      31  sed -i "s/PKGNAME/${pkgname}/" usr/share/applications/YY_Voice.desktop
    
      32  sed -i "s/Name=/Name=1/" usr/share/applications/YY_Voice.desktop
    
      33  popd
    
      34}
    
      35
    
      36package() {
    
      37  pushd ${pkgdir}
    
      38  msg "Preparing icons and startup entry..."
    
      39  mkdir -p usr/share
    
      40  cp -r ${srcdir}/usr/share/* usr/share/
    
      41  msg "Copying start script to opt/${pkgname} ..."
    
      42  mkdir -p opt/${pkgname}
    
      43  cp ${srcdir}/{files.7z,run.sh,YYSetup-${YYver}-zh-CN.exe} -i opt/${pkgname}
    
      44  chmod +x opt/${pkgname}/run.sh
    
      45  popd
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2