ziniaobrowser-bin

maintainer xifan · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt Chromium-based browser binary downloaded from a vendor-controlled CDN (cdn-superbrowser-web.ziniao.com). The binary is not built from source, so users must trust the vendor's CDN entirely. The sha256sum provides integrity against accidental corruption or MITM but not against a malicious upstream. The package installs executables with elevated permissions (including a setuid chrome-sandbox at 4755) and multiple binaries (ziniaobrowser, ziniao-gateway, env-kit) that run with user privileges. This is a legitimate pattern for binary browser packages in the AUR (similar to google-chrome, microsoft-edge-stable, etc.), but the host is a Chinese commercial CDN for a lesser-known browser, which carries higher supply-chain risk than major vendors. There is no reproducibility or source-build option. This is a genuine medium-risk supply-chain concern: executed closed-source binaries from a non-major vendor CDN, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("$pkgname-$pkgver.deb::https://cdn-superbrowser-web.ziniao.com/v6/ziniao_x64_6.9.0.9_production.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD installs a prebuilt Chromium-based browser binary downloaded from a vendor-controlled CDN (cdn-superbrowser-web.ziniao.com). The binary is not built from source, so users must trust the vendor's CDN entirely. The sha256sum provides integrity against accidental corruption or MITM but not against a malicious upstream. The package installs executables with elevated permissions (including a setuid chrome-sandbox at 4755) and multiple binaries (ziniaobrowser, ziniao-gateway, env-kit) that run with user privileges. This is a legitimate pattern for binary browser packages in the AUR (similar to google-chrome, microsoft-edge-stable, etc.), but the host is a Chinese commercial CDN for a lesser-known browser, which carries higher supply-chain risk than major vendors. There is no reproducibility or source-build option. This is a genuine medium-risk supply-chain concern: executed closed-source binaries from a non-major vendor CDN, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: xifan <xifan233@163.com>
    
      2pkgname=ziniaobrowser-bin
    
      3pkgver=6.9.0.9
    
      4pkgrel=2
    
      5pkgdesc="紫鸟浏览器 - 基于 Chromium 的浏览器"
    
      6arch=('x86_64')
    
      7url="https://www.ziniao.com/"
    
      8license=('custom')
    
      9depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libsecret')
    
      10optdepends=('libappindicator-gtk3: for system tray support')
    
      11source=("$pkgname-$pkgver.deb::https://cdn-superbrowser-web.ziniao.com/v6/ziniao_x64_6.9.0.9_production.deb")
    
      12sha256sums=('8c3ef239674bc861618059dc8d792bb2c762ba7dd1a58af7af3cbdb7d6d1486b')
    
      13noextract=("$pkgname-$pkgver.deb")
    
      14
    
      15package() {
    
      16    cd "$srcdir"
    
      17    
    
      18    # 提取 deb 包
    
      19    ar x "$pkgname-$pkgver.deb"
    
      20    tar -xf data.tar.xz -C "$pkgdir/"
    
      21    
    
      22    # 修复权限
    
      23    find "$pkgdir" -type d -exec chmod 755 {} \;
    
      24    find "$pkgdir" -type f -exec chmod 644 {} \;
    
      25    
    
      26    # 设置可执行文件权限
    
      27    if [ -d "$pkgdir/opt" ]; then
    
      28        find "$pkgdir/opt" -name "ziniaobrowser" -exec chmod 755 {} \;
    
      29        find "$pkgdir/opt" -name "chrome_crashpad_handler" -exec chmod 755 {} \;
    
      30        find "$pkgdir/opt" -name "chrome-sandbox" -exec chmod 4755 {} \;
    
      31        find "$pkgdir/opt" -name "env-kit" -exec chmod 755 {} \;
    
      32        find "$pkgdir/opt" -name "ziniao-gateway" -exec chmod 755 {} \;
    
      33    fi
    
      34    
    
      35    # 创建启动脚本
    
      36    mkdir -p "$pkgdir/usr/bin"
    
      37    cat > "$pkgdir/usr/bin/ziniao" << 'EOF'
    
      38#!/bin/bash
    
      39exec /opt/ziniao/ziniaobrowser "$@"
    
      40EOF
    
      41    chmod 755 "$pkgdir/usr/bin/ziniao"
    
      42    
    
      43    # 修改桌面文件
    
      44    sed -i 's|Name=ziniao|Name=紫鸟浏览器\nName[en]=ziniao|' "$pkgdir/usr/share/applications/ziniaobrowser.desktop"
    
      45    sed -i 's|Exec=/opt/ziniao/ziniaobrowser %U|Exec=ziniao %U|' "$pkgdir/usr/share/applications/ziniaobrowser.desktop"
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2