zwcad-bin

maintainer Sienna · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt proprietary CAD binary (.deb) from aur-repo.taotieren.com, which is a personal/third-party mirror operated by one of the maintainers, not the upstream vendor (zwsoft.cn/zwcad.com). The comment in the PKGBUILD explicitly acknowledges this: the upstream uses dynamic/authenticated download URLs that change, so the maintainer re-hosts the binary on their own server. This is a genuine supply-chain concern: the binary is executed on the user's system, and its integrity depends entirely on the trustworthiness of that personal host. The sha512sums provide some protection against tampering in transit, but do not protect against the host serving a malicious binary that was checksummed at submission time. The original upstream URL (download.zwsoft.cn) is commented out. This is a real medium-severity supply-chain risk — a prebuilt executable from a non-vendor-controlled host — not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:54 source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::https://aur-repo.taotieren.com:3443/atzlinux/pool/non-free/z/zwcad${_year}/zwcad${_year}_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt proprietary CAD binary (.deb) from aur-repo.taotieren.com, which is a personal/third-party mirror operated by one of the maintainers, not the upstream vendor (zwsoft.cn/zwcad.com). The comment in the PKGBUILD explicitly acknowledges this: the upstream uses dynamic/authenticated download URLs that change, so the maintainer re-hosts the binary on their own server. This is a genuine supply-chain concern: the binary is executed on the user's system, and its integrity depends entirely on the trustworthiness of that personal host. The sha512sums provide some protection against tampering in transit, but do not protect against the host serving a malicious binary that was checksummed at submission time. The original upstream URL (download.zwsoft.cn) is commented out. This is a real medium-severity supply-chain risk — a prebuilt executable from a non-vendor-controlled host — not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer sukanka <su975853527 at gmail dot com>
    
      2# Maintainer: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname='zwcad-bin'
    
      5_pkgname='zwcad'
    
      6pkgver=25.0.3.4
    
      7_year=20${pkgver:0:2}
    
      8pkgrel=2
    
      9epoch=1
    
      10pkgdesc="ZWSOFT研发的二维CAD软件，可满足看图、审图、打印工作需要"
    
      11# arch=('x86_64' 'aarch64')
    
      12arch=('x86_64')
    
      13license=('unknown')
    
      14url="https://www.zwcad.com"
    
      15provides=("zwcad")
    
      16depends=(
    
      17    bash
    
      18    curl
    
      19    expat
    
      20    freeimage
    
      21    freetype2
    
      22    gcc-libs
    
      23    qrencode
    
      24    glib2
    
      25    glibc
    
      26    glu
    
      27    giflib
    
      28    hicolor-icon-theme
    
      29    log4cpp
    
      30    libdrm
    
      31    libglvnd
    
      32    libjpeg-turbo
    
      33    libidn11
    
      34    libpng12
    
      35    libx11
    
      36    libxcb
    
      37    libxext
    
      38    libxxf86vm
    
      39    libxfixes
    
      40    libxshmfence
    
      41    mesa
    
      42    python
    
      43    krb5
    
      44    util-linux-libs
    
      45    zlib
    
      46    # AUR
    
      47    openssl-1.0
    
      48    libldap24
    
      49)
    
      50makedepends=('patchelf')
    
      51source=('zwcad.sh')
    
      52# 由于上游使用动态验证下载，每次下载中间的信息会变动，于是改为从第三方软件下载。
    
      53# source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::https://download.zwsoft.cn/202411012038/ded6b656f41763609ece8ac461699cd3/zwcad/cad_linux/${_year}/zwcad${_year}_${pkgver}_amd64.deb")
    
      54source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::https://aur-repo.taotieren.com:3443/atzlinux/pool/non-free/z/zwcad${_year}/zwcad${_year}_${pkgver}_amd64.deb")
    
      55# source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::https://dl.zwsoft.cn/zwcad/cad_linux/${_year}/zwcad${_year}_${pkgver}_arm64.deb?auth_key=1690549857-0-0-5896181fcadbec59eb315d18a65cc634")
    
      56# source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::https://aur-repo.taotieren.com:3443/atzlinux/pool/non-free/z/zwcad${_year}/zwcad${_year}_${pkgver}_arm64.deb")
    
      57sha512sums=('138d2be8843326e7a53cd62e18c4b7173e655a61435931a4a19588da89fa9af61cc808c020e91900d3f7a60b4c5c1b720bb6442f1c0cafe226372687ed686e70')
    
      58sha512sums_x86_64=('6545800e3cfa648fcca2d16de698ed532ab6116a30bbfbc1057aafb6d200462731b01ed5b03fa5532a3059e1c4eb47fbb07af56b69b97f535f625b663fbb19da')
    
      59options=(!strip !debug)
    
      60# no need to strip, it only decreases the installed size by 24.44 MiB.
    
      61
    
      62prepare() {
    
      63    cd $srcdir
    
      64    tar -xJf data.tar.xz -C "${srcdir}"
    
      65
    
      66    cp zwcad.sh zwlmgr.sh
    
      67    sed -i '$d' zwlmgr.sh
    
      68    echo './ZwLmgr /language zh-CN /language zh-CN' >>zwlmgr.sh
    
      69
    
      70    cd $srcdir/opt/apps/zwcad${_year}
    
      71    #system qt
    
      72    rm -rf lib/libQt* plugins qt.conf
    
      73
    
      74    #system python
    
      75    cd ZwPyRuntime
    
      76    local _pyver=$(python -V | cut -d' ' -f2)
    
      77    test -d python${_pyver%.*} || mkdir python${_pyver%.*}
    
      78    cp python3.8/ZwPyRuntime.so python${_pyver%.*}
    
      79    rm -rf python3.{4,5,6,7,8}
    
      80}
    
      81build() {
    
      82
    
      83    cd $srcdir/opt/apps/zwcad${_year}
    
      84
    
      85    # Fix ./ZWLMGRRUN.sh and ./ZWCADRUN.sh not found
    
      86    sed -i 's|ZWLMGRRUN.sh|zwlmgr\x0\x0\x0\x0\x0\x0|g' ZWCAD
    
      87    sed -i 's|ZWCADRUN.sh|zwcad\x0\x0\x0\x0\x0\x0|g' ZwLmgr
    
      88
    
      89    # Fix desktop
    
      90    cd $srcdir/usr/share/applications/
    
      91    sed -i "s|^Exec=.*|Exec=zwcad %F|g;s|^Icon=.*|Icon=zwcad${_year}|g" "zwcad${_year}.desktop"
    
      92    sed -i "s|^Exec=.*|Exec=zwlmgr|g;s|^Icon=.*|Icon=zwcad${_year}|g" "zwlmgr${_year}.desktop"
    
      93    sed -i "s|^Exec=.*|Exec=zwcloud2d|g;s|^Icon=.*|Icon=zwcad${_year}|g" "zwcloud2d${_year}.desktop"
    
      94
    
      95}
    
      96
    
      97package() {
    
      98    mkdir -p "$pkgdir"/opt
    
      99    cp -rf "${srcdir}"/usr "$pkgdir"
    
      100    mkdir -p "${pkgdir}"/usr/share/icons/hicolor/scalable/apps
    
      101    cp -rf "${srcdir}"/opt/apps/zwcad${_year} "${pkgdir}"/opt/zwcad
    
      102
    
      103    # create executable
    
      104    install -Dm755 ${srcdir}/zwcad.sh "$pkgdir"/usr/bin/zwcad
    
      105    install -Dm755 ${srcdir}/zwlmgr.sh "$pkgdir"/usr/bin/zwlmgr
    
      106    ln -s /opt/zwcad/ZwCloud2DLauncher "$pkgdir"/usr/bin/zwcloud2d
    
      107
    
      108    cd "$pkgdir"/opt/zwcad
    
      109    install -Dm644 sense4_usb.rules ${pkgdir}/etc/udev/rules.d/sense4_usb.rules
    
      110
    
      111    # fix rpath
    
      112    find ${pkgdir}/opt/zwcad -executable -type f -print0 |
    
      113        xargs -0 -i sh -c 'patchelf --set-rpath "\$ORIGIN:/usr/lib/zwcad" "{}" 2> /dev/null||true'
    
      114
    
      115    # move libs
    
      116    mkdir -p ${pkgdir}/usr/lib/zwcad
    
      117    #     rm -rf "$pkgdir"/opt/zwcad/lib/{libcurl*,libidn*,libpng*}
    
      118    mv "$pkgdir"/opt/zwcad/lib/lib* ${pkgdir}/usr/lib/zwcad
    
      119    mv "$pkgdir"/opt/zwcad/lib/GL ${pkgdir}/usr/lib/zwcad/
    
      120    # remove unused files
    
      121    rm -rf "$pkgdir"/opt/zwcad/{Icons,ZWCADRUN.sh,ZWLMGRRUN.sh}
    
      122    rm -rf ${pkgdir}/opt/zwcad/{libfree*,libqren*,libcrypto*,libgmp*,liblog4cpp*,libssl*,*.rules}
    
      123    rm -rf ${pkgdir}/opt/zwcad/lib/{libicu*,libpcre*}
    
      124}
    
      125

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3