Review Results

Comment

The change is a straightforward version bump in .SRCINFO. The source remains an HTTPS download from the vendor’s CDN, and the package metadata no longer references the local patch file. I don’t see any new red flags in this diff alone: no added build-time commands, no new install scripts, no privilege-related metadata, and no suspicious extra sources. The only notable change is that the source filename is now a generic `wps-office.deb` with a renamed local target, but the URL still points to the official WPS CDN and the checksum is pinned. Based on this diff alone, risk is low.

@@ -1,15 +1,13 @@
 pkgbase = wps-office
 	pkgdesc = Kingsoft Office (WPS Office) - an office productivity suite
-	pkgver = 11.1.0.11723
-	pkgrel = 2
-	url = http://wps-community.org
+	pkgver = 12.1.2.29183
+	pkgrel = 1
+	url = https://www.wps.com/office/linux
 	arch = x86_64
 	license = LicenseRef-WPS-EULA
 	options = !emptydirs
-	source = https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/11723/wps-office_11.1.0.11723.XA_amd64.deb
-	source = fix-wps-python-parse.patch
-	sha1sums = 24132c03e1b53fe8983274c5165caa9128bdb1a6
-	sha1sums = f3713481edf04ffb08be8d24dce66554dd5a4f13
+	source = wps-office-12.1.2.29183_amd64.deb::https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/wps-office.deb
+	sha1sums = f1ebc6ae0013e868324e289bbfd0a74ddddd0e73
 
 pkgname = wps-office
 	install = wps-office.install

Comment

The .SRCINFO update is a routine package metadata refresh for a new upstream WPS Office release. It switches to the new official HTTPS download URL, updates the version/release, and removes several dependencies/optdepends that are no longer declared by the PKGBUILD. I do not see any new suspicious sources, build-time network fetches beyond the packaged source, privilege escalation, or persistence-related metadata. The only notable change is that the package now points at a generic wpscdn download endpoint rather than a versioned filename, but it still uses HTTPS and the official WPS domain, so this is not a security issue by itself.

@@ -21,15 +19,12 @@ pkgname = wps-office
 	depends = xdg-utils
 	depends = glu
 	depends = sdl2
-	depends = libxml2-legacy
-	depends = libpulse
 	depends = hicolor-icon-theme
 	depends = libxss
 	depends = sqlite
 	depends = libtool
 	depends = libxslt
 	depends = libjpeg-turbo
-	optdepends = libtiff5: Provide libtiff.so.5 for wpspdf working
 	optdepends = cups: for printing support
 	optdepends = libjpeg-turbo: JPEG image codec support
 	optdepends = pango: for complex (right-to-left) text support

Comment

The change only removes one optional dependency entry from .SRCINFO: `wps-office-mui-zh-cn` (zh_CN language support). This does not introduce any new code execution, network access, privilege changes, or packaging integrity issues. It slightly reduces advertised functionality but is not a security concern.

@@ -38,7 +33,6 @@ pkgname = wps-office
 	optdepends = ttf-ms-fonts: Microsft Fonts recommended for wps-office
 	optdepends = wps-office-fonts: FZ TTF fonts provided by wps community
 	optdepends = wps-office-mime: Use mime files provided by Kingsoft
-	optdepends = wps-office-mui-zh-cn: zh_CN support for WPS Office
 	conflicts = kingsoft-office
 
 pkgname = wps-office-mime

Comment

The change is a straightforward version bump of a binary package, but it materially weakens source integrity: the source URL now points to a generic, unversioned `wps-office.deb` rather than a version-pinned release artifact, while the checksum list was reduced to a single hash for that blob. That means the build no longer clearly binds the package to the declared `pkgver`, and future upstream changes at the same URL could silently alter what gets packaged if the checksum is updated in a later commit. I do not see evidence of code execution, install-script abuse, or privilege escalation in this hunk, so the risk is limited to supply-chain/integrity concerns rather than an immediate backdoor.

@@ -7,25 +7,25 @@
 
 pkgbase=wps-office
 pkgname=('wps-office' 'wps-office-mime')
-pkgver=11.1.0.11723
+pkgver=12.1.2.29183
 #_pkgver=8372
-pkgrel=2
+pkgrel=1
 #_pkgrel=1
 pkgdesc="Kingsoft Office (WPS Office) - an office productivity suite"
 arch=('x86_64')
 license=('LicenseRef-WPS-EULA')
-url="http://wps-community.org"
+url="https://www.wps.com/office/linux"
 options=('!emptydirs')
 #[[ "$CARCH" = "i686" ]] && _archext=x86 || _archext=x86_64
 #source_i686=("http://kdl.cc.ksosoft.com/wps-community/download/${pkgver##*.}/wps-office_${pkgver}_i386.deb"
 #            'add_no_kdialog_variable.patch')
 #source=("http://kdl.cc.ksosoft.com/wps-community/download/${pkgver##*.}/wps-office_${pkgver}_amd64.deb"
-source=("https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/${pkgver##*.}/wps-office_${pkgver}.XA_amd64.deb"
-        'fix-wps-python-parse.patch')
+#source=("https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/${pkgver##*.}/wps-office_${pkgver}.XA_amd64.deb"
+source=("wps-office-${pkgver}_amd64.deb::https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/wps-office.deb")
+#       'fix-wps-python-parse.patch')
 #sha1sums_i686=('60b1c9e33ee6fc1edcefe40dc9ec529d4a668825'
 #               'dd8b5283ee17a88a3eb0531976abccd6e5e08c48')
-sha1sums=('24132c03e1b53fe8983274c5165caa9128bdb1a6'
-          'f3713481edf04ffb08be8d24dce66554dd5a4f13')
+sha1sums=('f1ebc6ae0013e868324e289bbfd0a74ddddd0e73')
 
 prepare() {
     bsdtar -xpf data.tar.xz

Comment

The change is low risk overall. It updates the package to a new upstream release, switches the homepage to the official WPS site, and keeps the source download on HTTPS with a pinned checksum. The removed prepare() patching/commented-out icon copying does not introduce new execution paths. The only notable packaging concern is that the source URL now points to a generic filename (`wps-office.deb`) rather than a versioned artifact, which is a reproducibility/integrity smell, but it is still fetched via HTTPS and verified by checksum. No evidence of added network fetches, privilege escalation, persistence, or malicious install-script behavior in this diff.

@@ -35,32 +35,30 @@ prepare() {
 #   sed -i 's|/office6/${gApp}  ${gOptExt}|/office6/${gApp} -style gtk+ ${gOptExt}|' wps
 #   sed -i 's|/office6/${gApp} ${gOptExt}|/office6/${gApp} -style gtk+ ${gOptExt}|' wpp et
 
-    cd "${srcdir}/usr/share/icons/hicolor"
+#   cd "${srcdir}/usr/share/icons/hicolor"
 
-    for _file in ./*; do
-        if [ -e ${_file}/mimetypes/wps-office2019-etmain.png ]; then
-            mkdir -p ${_file}/apps
-            cp -p ${_file}/mimetypes/wps-office2019* ${_file}/apps
-        fi
-    done
+#   for _file in ./*; do
+#       if [ -e ${_file}/mimetypes/wps-office2019-etmain.png ]; then
+#           mkdir -p ${_file}/apps
+#           cp -p ${_file}/mimetypes/wps-office2019* ${_file}/apps
+#       fi
+#   done
 
-    cd "${srcdir}"
-#   patch -Np1 -i "${srcdir}/fix_desktop_exec.patch"
-    patch -Np1 -i "${srcdir}/fix-wps-python-parse.patch"
+#   cd "${srcdir}"
+##  patch -Np1 -i "${srcdir}/fix_desktop_exec.patch"
+#   patch -Np1 -i "${srcdir}/fix-wps-python-parse.patch"
 }
 
 package_wps-office() {
-    depends=('fontconfig' 'xorg-mkfontdir' 'libxrender' 'desktop-file-utils' 'shared-mime-info' 'xdg-utils' 'glu' 'sdl2' 'libxml2-legacy' 'libpulse' 'hicolor-icon-theme' 'libxss' 'sqlite' 'libtool' 'libxslt' 'libjpeg-turbo')
-    optdepends=('libtiff5: Provide libtiff.so.5 for wpspdf working'
-                'cups: for printing support'
+    depends=('fontconfig' 'xorg-mkfontdir' 'libxrender' 'desktop-file-utils' 'shared-mime-info' 'xdg-utils' 'glu' 'sdl2'  'hicolor-icon-theme' 'libxss' 'sqlite' 'libtool' 'libxslt' 'libjpeg-turbo')
+    optdepends=('cups: for printing support'
                 'libjpeg-turbo: JPEG image codec support'
                 'pango: for complex (right-to-left) text support'
                 'curl: An URL retrieval utility and library'
                 'ttf-wps-fonts: Symbol fonts required by wps-office'
                 'ttf-ms-fonts: Microsft Fonts recommended for wps-office'
                 'wps-office-fonts: FZ TTF fonts provided by wps community'
-                'wps-office-mime: Use mime files provided by Kingsoft'
-                'wps-office-mui-zh-cn: zh_CN support for WPS Office')
+                'wps-office-mime: Use mime files provided by Kingsoft')
     install=${pkgname}.install
     conflicts=('kingsoft-office')
 #   cd wps-office_${pkgver}_$_archext

Comment

The change is low risk. It only comments out the removal of bundled libstdc++.so* in package_wps-office(), which means the package will now ship WPS's bundled C++ runtime instead of forcing the system one. That is a packaging/compatibility change, not an obvious security backdoor: there is no new code execution, network access, privilege escalation, or persistence mechanism introduced by this diff. The rest of the PKGBUILD changes are source/version updates and dependency cleanup. The main security concern is that shipping a bundled shared library can reduce the benefit of system security updates and may increase attack surface, but this is not high-confidence malicious behavior in this context.

@@ -69,7 +67,7 @@ package_wps-office() {
     install -d "${pkgdir}/usr/lib"
     cp -r office6 "${pkgdir}/usr/lib"
     # Fix for icu>=71.1
-    rm ${pkgdir}/usr/lib/office6/libstdc++.so*
+#   rm ${pkgdir}/usr/lib/office6/libstdc++.so*
     # Use system libjpeg
     rm ${pkgdir}/usr/lib/office6/libjpeg.so*
 #   chmod -x "${pkgdir}/usr/lib/office6/wpsoffice"