boss-job-agent-bin

MEDIUM

maintainer wearzdk 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt .deb binary from a non-whitelisted, non-standard host (storage2.maoertech.cn), which is under the maintainer's control and not the official project domain; this creates a supply-chain risk if the host is compromised or the binary is silently replaced, though the fixed checksum provides some verification.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("boss-job-agent-${pkgver}-amd64.deb::https://storage2.maoertech.cn/releases/boss-job-agent/v${pkgver}/_Boss_${pkgver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted, non-standard host (storage2.maoertech.cn), which is under the maintainer's control and not the official project domain; this creates a supply-chain risk if the host is compromised or the binary is silently replaced, though the fixed checksum provides some verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 面灵Boss助手 <karentia@maoertech.cn>
    
      2#
    
      3# 客户端闭源，安装包不进 GitHub Releases，而是发版 CI 构建后传到自有 storage
    
      4# （storage2.maoertech.cn，下载 URL 由版本号确定性推导）。所以这是「重打包官方
    
      5# 预编译 .deb」的 -bin 包 —— AUR `-bin` 后缀的标准含义。
    
      6#
    
      7# pkgver 与 sha256sums 由 .github/workflows/release.yml 的 publish-aur 任务在每次
    
      8# v* tag 发版时自动改写并推到 AUR，别手动 bump。
    
      9pkgname=boss-job-agent-bin
    
      10pkgver=0.3.0
    
      11pkgrel=1
    
      12pkgdesc="AI 自动刷 Boss 直聘：自动筛岗位、写定制打招呼、和 HR 聊天约面"
    
      13arch=('x86_64')
    
      14url="https://boss.mianlingai.com"
    
      15license=('LicenseRef-proprietary')
    
      16# 对应上游 .deb 的 Depends: libwebkit2gtk-4.1-0, libgtk-3-0。
    
      17# webkit2gtk-4.1 会带来 gtk3 / libsoup3，但二进制直接链接 gtk3，显式列出。
    
      18# libayatana-appindicator 供托盘图标运行时按需加载（不被 webkit 带入）。
    
      19depends=('webkit2gtk-4.1' 'gtk3' 'libayatana-appindicator')
    
      20provides=('boss-job-agent')
    
      21conflicts=('boss-job-agent')
    
      22# 预编译二进制，禁止 strip / 重新打包，避免破坏官方产物。
    
      23options=('!strip')
    
      24install="${pkgname}.install"
    
      25source=("boss-job-agent-${pkgver}-amd64.deb::https://storage2.maoertech.cn/releases/boss-job-agent/v${pkgver}/_Boss_${pkgver}_amd64.deb")
    
      26noextract=("boss-job-agent-${pkgver}-amd64.deb")
    
      27sha256sums=('1dd215a5a95f49dc2c572c53f44b80dcf6ce3ec1593c1486af605538746cd924')
    
      28
    
      29package() {
    
      30  cd "$srcdir"
    
      31  # .deb 是 ar 归档，libarchive(bsdtar) 能直接拆；再解内层 data.tar.*。
    
      32  bsdtar -xf "boss-job-agent-${pkgver}-amd64.deb"
    
      33  bsdtar -xf data.tar.*
    
      34
    
      35  # 上游 .deb 的布局已经是规范 FHS，整份搬进 $pkgdir 即可：
    
      36  #   /usr/bin/boss-job-agent          主程序
    
      37  #   /usr/bin/job-agent-sidecar       agent 子进程
    
      38  #   /usr/lib/<productName>/          Tauri 资源目录
    
      39  #   /usr/share/icons/hicolor/*/apps/boss-job-agent.png
    
      40  #
    
      41  # ⚠️ 资源目录名是中文（Tauri 在 Linux 下按 **productName** 定位资源目录到
    
      42  # /usr/lib/<productName>，与可执行文件实际所在目录无关）。**不要**为了好看
    
      43  # 把它改成 ASCII —— 改了 Tauri 就找不到资源。
    
      44  cp -a usr "$pkgdir/usr"
    
      45
    
      46  # Tauri 按中文 productName 生成 .desktop，文件名也就成了中文。
    
      47  # 装进系统时换成 ASCII 名，Name= 字段保持中文不变。
    
      48  local desktop_dir="$pkgdir/usr/share/applications"
    
      49  local f
    
      50  for f in "$desktop_dir"/*.desktop; do
    
      51    [ -e "$f" ] || continue
    
      52    [ "${f##*/}" = "${pkgname%-bin}.desktop" ] && continue
    
      53    mv -- "$f" "$desktop_dir/${pkgname%-bin}.desktop"
    
      54    break
    
      55  done
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2
2026-10-10 00:11:52	Medium	2
2026-10-09 00:05:33	Medium	2
2026-10-08 00:28:03	Medium	2
2026-10-07 00:21:34	Medium	2
2026-10-06 00:13:36	Medium	2
2026-10-05 00:08:03	Medium	2
2026-10-04 00:18:08	Medium	2
2026-10-03 00:23:04	Medium	2
2026-10-02 00:00:32	Medium	2
2026-10-01 00:02:06	Medium	2
2026-09-30 00:20:07	Medium	2
2026-09-29 00:07:46	Medium	2
2026-09-28 00:28:32	Medium	2