boss-job-agent-bin

MEDIUM

maintainer wearzdk 0 votes scanned 2026-08-28 17:39:13.633855

View on AUR

Why flagged

Installs a prebuilt proprietary binary downloaded from a vendor-owned but non-standard personal storage host (storage2.maoertech.cn) that is not official public release infrastructure; while a sha256sum is provided and the host appears to be the project's own, the binary is closed-source and hosted on a private storage server that could be silently swapped, making this a typical -bin repackage with moderate supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("boss-job-agent-${pkgver}-amd64.deb::https://storage2.maoertech.cn/releases/boss-job-agent/v${pkgver}/_Boss_${pkgver}_amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary binary downloaded from a vendor-owned but non-standard personal storage host (storage2.maoertech.cn) that is not official public release infrastructure; while a sha256sum is provided and the host appears to be the project's own, the binary is closed-source and hosted on a private storage server that could be silently swapped, making this a typical -bin repackage with moderate supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 面灵Boss助手 <karentia@maoertech.cn>
    
      2#
    
      3# 客户端闭源，安装包不进 GitHub Releases，而是发版 CI 构建后传到自有 storage
    
      4# （storage2.maoertech.cn，下载 URL 由版本号确定性推导）。所以这是「重打包官方
    
      5# 预编译 .deb」的 -bin 包 —— AUR `-bin` 后缀的标准含义。
    
      6#
    
      7# pkgver 与 sha256sums 由 .github/workflows/release.yml 的 publish-aur 任务在每次
    
      8# v* tag 发版时自动改写并推到 AUR，别手动 bump。
    
      9pkgname=boss-job-agent-bin
    
      10pkgver=0.2.0
    
      11pkgrel=1
    
      12pkgdesc="AI 自动刷 Boss 直聘：自动筛岗位、写定制打招呼、和 HR 聊天约面"
    
      13arch=('x86_64')
    
      14url="https://boss.mianlingai.com"
    
      15license=('LicenseRef-proprietary')
    
      16# 对应上游 .deb 的 Depends: libwebkit2gtk-4.1-0, libgtk-3-0。
    
      17# webkit2gtk-4.1 会带来 gtk3 / libsoup3，但二进制直接链接 gtk3，显式列出。
    
      18# libayatana-appindicator 供托盘图标运行时按需加载（不被 webkit 带入）。
    
      19depends=('webkit2gtk-4.1' 'gtk3' 'libayatana-appindicator')
    
      20provides=('boss-job-agent')
    
      21conflicts=('boss-job-agent')
    
      22# 预编译二进制，禁止 strip / 重新打包，避免破坏官方产物。
    
      23options=('!strip')
    
      24install="${pkgname}.install"
    
      25source=("boss-job-agent-${pkgver}-amd64.deb::https://storage2.maoertech.cn/releases/boss-job-agent/v${pkgver}/_Boss_${pkgver}_amd64.deb")
    
      26noextract=("boss-job-agent-${pkgver}-amd64.deb")
    
      27sha256sums=('6322de569e0b87cdf19e10083b4fd42a91697bb68af4b48ed3a455749bc2c5e0')
    
      28
    
      29package() {
    
      30  cd "$srcdir"
    
      31  # .deb 是 ar 归档，libarchive(bsdtar) 能直接拆；再解内层 data.tar.*。
    
      32  bsdtar -xf "boss-job-agent-${pkgver}-amd64.deb"
    
      33  bsdtar -xf data.tar.*
    
      34
    
      35  # 上游 .deb 的布局已经是规范 FHS，整份搬进 $pkgdir 即可：
    
      36  #   /usr/bin/boss-job-agent          主程序
    
      37  #   /usr/bin/job-agent-sidecar       agent 子进程
    
      38  #   /usr/lib/<productName>/          Tauri 资源目录
    
      39  #   /usr/share/icons/hicolor/*/apps/boss-job-agent.png
    
      40  #
    
      41  # ⚠️ 资源目录名是中文（Tauri 在 Linux 下按 **productName** 定位资源目录到
    
      42  # /usr/lib/<productName>，与可执行文件实际所在目录无关）。**不要**为了好看
    
      43  # 把它改成 ASCII —— 改了 Tauri 就找不到资源。
    
      44  cp -a usr "$pkgdir/usr"
    
      45
    
      46  # Tauri 按中文 productName 生成 .desktop，文件名也就成了中文。
    
      47  # 装进系统时换成 ASCII 名，Name= 字段保持中文不变。
    
      48  local desktop_dir="$pkgdir/usr/share/applications"
    
      49  local f
    
      50  for f in "$desktop_dir"/*.desktop; do
    
      51    [ -e "$f" ] || continue
    
      52    [ "${f##*/}" = "${pkgname%-bin}.desktop" ] && continue
    
      53    mv -- "$f" "$desktop_dir/${pkgname%-bin}.desktop"
    
      54    break
    
      55  done
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-28 17:39:13	Medium	3
2026-08-28 17:36:11	Medium	3