codearts-agent-bin

LOW

maintainer theorangeguo 0 votes scanned 2026-10-18 03:22:23.263909

View on AUR

Why flagged

Downloads a prebuilt .deb binary from huaweicloud.com (codearts-agent-obs-cdn.huaweicloud.com), which is plausibly Huawei's own official CDN for their CodeArts product; checksums are provided and not SKIP'd, so integrity is verifiable. The main concern is that it installs an unreviewed proprietary binary from a Chinese cloud vendor, but there is no obfuscation, no exfiltration, and the host appears to be the project's own official infrastructure.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt .deb binary from huaweicloud.com (codearts-agent-obs-cdn.huaweicloud.com), which is plausibly Huawei's own official CDN for their CodeArts product; checksums are provided and not SKIP'd, so integrity is verifiable. The main concern is that it installs an unreviewed proprietary binary from a Chinese cloud vendor, but there is no obfuscation, no exfiltration, and the host appears to be the project's own official infrastructure.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=(codearts-agent-bin-26.9.902-x86_64.deb::https://codearts-agent-obs-cdn.huaweicloud.com/codearts/ai/latest/codearts-agent-linux-x64-26.9.902-eea7a9e.deb )

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: theorangeguo
    
      2# Packaging Repo: https://github.com/theorangeguo/aur-packages/tree/main/packages/codearts-agent-bin
    
      3pkgname=codearts-agent-bin
    
      4pkgver=26.9.902
    
      5pkgrel=1
    
      6pkgdesc=AI-powered\ coding\ assistant\ and\ IDE\ by\ Huawei\ Cloud
    
      7arch=(x86_64 aarch64 )
    
      8url=https://codearts.huaweicloud.com/
    
      9license=(custom:huaweicloud )
    
      10depends=(alsa-lib at-spi2-core cairo curl glibc gtk3 libnotify libsecret libxkbfile libxss nss shared-mime-info xdg-utils )
    
      11makedepends=()
    
      12checkdepends=()
    
      13optdepends=(libvulkan-driver:\ Vulkan\ support bash-completion:\ Bash\ completion\ support zsh-completions:\ Zsh\ completion\ support )
    
      14options=(\!strip )
    
      15provides=(codearts-agent )
    
      16conflicts=(codearts-agent )
    
      17validpgpkeys=()
    
      18
    
      19source=(LICENSE )
    
      20sha256sums=('e106bf05e0a1abbbcaa65d1d8f9d67ab1c020ee623dfcab780ff05a8e91ba117')
    
      21sha256sums_x86_64=('f3add76553a5e958f3fe629949e7b8f54297f78e6c6bef3a2da864cf6aafeb5f')
    
      22sha256sums_aarch64=('1e3ca272c1c5b851f949b6542a4589553fd2ad8196236b3a512361666c7afc5f')
    
      23source_x86_64=(codearts-agent-bin-26.9.902-x86_64.deb::https://codearts-agent-obs-cdn.huaweicloud.com/codearts/ai/latest/codearts-agent-linux-x64-26.9.902-eea7a9e.deb )
    
      24source_aarch64=(codearts-agent-bin-26.9.902-aarch64.deb::https://codearts-agent-obs-cdn.huaweicloud.com/codearts/ai/latest/codearts-agent-linux-arm64-26.9.902-eea7a9e.deb )
    
      25
    
      26_deb_relocate_usr_local=false
    
      27_install_bin_path=/usr/bin/codearts-agent
    
      28_binary_source_path=/usr/share/codearts-agent/bin/codearts-agent
    
      29_service_file=''
    
      30_service_install_path=''
    
      31_doc_files=()
    
      32_license_files=(LICENSE )
    
      33
    
      34
    
      35prepare() {
    
      36    local _deb_source_file
    
      37    case "$CARCH" in
    
      38        x86_64) _deb_source_file=codearts-agent-bin-26.9.902-x86_64.deb ;;
    
      39        aarch64) _deb_source_file=codearts-agent-bin-26.9.902-aarch64.deb ;;
    
      40        *)
    
      41            echo "Unsupported architecture: $CARCH" >&2
    
      42            return 1
    
      43            ;;
    
      44    esac
    
      45
    
      46    rm -rf "${srcdir}/_deb_extract" "${srcdir}/_deb_root"
    
      47    mkdir -p "${srcdir}/_deb_extract" "${srcdir}/_deb_root"
    
      48
    
      49    bsdtar -xf "${srcdir}/${_deb_source_file}" -C "${srcdir}/_deb_extract"
    
      50
    
      51    local data_archives=("${srcdir}/_deb_extract"/data.tar.*)
    
      52    [ -e "${data_archives[0]}" ] || {
    
      53        echo "Missing data.tar.* inside Debian package" >&2
    
      54        return 1
    
      55    }
    
      56
    
      57    bsdtar -xf "${data_archives[0]}" -C "${srcdir}/_deb_root"
    
      58}
    
      59
    
      60package() {
    
      61    install -d "${pkgdir}"
    
      62    cp -a "${srcdir}/_deb_root/." "${pkgdir}/"
    
      63
    
      64    if [ "${_deb_relocate_usr_local}" = true ] && [ -d "${pkgdir}/usr/local" ]; then
    
      65        install -d "${pkgdir}/usr"
    
      66        cp -a "${pkgdir}/usr/local/." "${pkgdir}/usr/"
    
      67        rm -rf "${pkgdir}/usr/local"
    
      68    fi
    
      69
    
      70    if [ -n "${_install_bin_path}" ] && [ -n "${_binary_source_path}" ]; then
    
      71        install -d "$(dirname "${pkgdir}${_install_bin_path}")"
    
      72        ln -sf "${_binary_source_path}" "${pkgdir}${_install_bin_path}"
    
      73    fi
    
      74
    
      75    local doc_file
    
      76    for doc_file in "${_doc_files[@]}"; do
    
      77        [ -f "${srcdir}/${doc_file}" ] || continue
    
      78        install -Dm644 "${srcdir}/${doc_file}" "${pkgdir}/usr/share/doc/${pkgname}/$(basename "${doc_file}")"
    
      79    done
    
      80
    
      81    local license_file
    
      82    for license_file in "${_license_files[@]}"; do
    
      83        [ -f "${srcdir}/${license_file}" ] || continue
    
      84        install -Dm644 "${srcdir}/${license_file}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${license_file}")"
    
      85    done
    
      86
    
      87    if [ -n "${_service_file}" ] && [ -f "${srcdir}/${_service_file}" ]; then
    
      88        install -Dm644 "${srcdir}/${_service_file}" "${pkgdir}${_service_install_path}"
    
      89    fi
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 03:22:23	Low	3
2026-10-18 03:20:54	Medium	2