cindy-cn-bin

MEDIUM

maintainer czyt 0 votes scanned 2026-09-08 07:16:32.151301

View on AUR

Why flagged

The package installs a prebuilt Debian binary from GitHub releases, which is an unverifiable executable artifact that could be silently swapped if the source is compromised, representing a supply-chain risk despite the project being open-source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt Debian binary from GitHub releases, which is an unverifiable executable artifact that could be silently swapped if the source is compromised, representing a supply-chain risk despite the project being open-source.

PKGBUILD

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2
    
      3pkgname=cindy-cn-bin
    
      4pkgver=0.1.73
    
      5pkgrel=1
    
      6pkgdesc="Open-source AI agent that works out of the box (cn edition)"
    
      7arch=('x86_64')
    
      8url="https://github.com/makecindy/cindy"
    
      9license=('Apache-2.0' 'MIT')
    
      10depends=(
    
      11  'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'glibc'
    
      12  'gtk3' 'libcups' 'libdrm' 'libgcc' 'libstdc++' 'libnotify' 'libx11' 'libxcb'
    
      13  'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon'
    
      14  'libxrandr' 'mesa' 'nspr' 'nss' 'pango' 'systemd-libs' 'xdg-utils'
    
      15)
    
      16makedepends=('libarchive')
    
      17optdepends=('libsecret: desktop credential storage')
    
      18provides=("cindy=${pkgver}")
    
      19conflicts=('cindy' 'cindy-bin')
    
      20options=('!strip' '!debug')
    
      21
    
      22_deb="cindy-${pkgver}-linux-x64-cn.deb"
    
      23source_x86_64=("${_deb}::${url}/releases/download/v${pkgver}/${_deb}")
    
      24sha256sums_x86_64=('94e7ffa8fbf9d232022eddeb01d75e80ad3f2b4ac907358f7b336d95c7f5b69d')
    
      25noextract=("${_deb}")
    
      26
    
      27package() {
    
      28  local data_archive
    
      29  data_archive=$(bsdtar -tf "${srcdir}/${_deb}" | awk '/^data\.tar(\.|$)/ {print}')
    
      30  [[ -n "$data_archive" && "$data_archive" != *$'\n'* ]] || return 1
    
      31  bsdtar -xOf "${srcdir}/${_deb}" "$data_archive" |
    
      32    bsdtar --no-same-owner -xf - -C "${pkgdir}" || return 1
    
      33
    
      34  install -Dm644 "${pkgdir}/usr/share/doc/cindy/copyright" \
    
      35    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron"
    
      36  install -Dm644 "${pkgdir}/usr/lib/cindy/LICENSES.chromium.html" \
    
      37    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      38  rm -r "${pkgdir}/usr/share/doc" "${pkgdir}/usr/share/lintian"
    
      39  # Windows-only development scripts are unused by the Linux prebuilt node-pty.
    
      40  rm -r "${pkgdir}/usr/lib/cindy/resources/app.asar.unpacked/node_modules/node-pty/deps/winpty"
    
      41  chmod 4755 "${pkgdir}/usr/lib/cindy/chrome-sandbox"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 07:16:32	Medium	2