codebuddy-cn-ide

LOW
maintainer JipZeonGit 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a DMG from Tencent's official CDN (download.codebuddy.cn), which is plausibly the project's own distribution infrastructure; the source is not executed directly and the build process uses it to extract and repackage legitimate upstream binaries, posing minimal supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a DMG from Tencent's official CDN (download.codebuddy.cn), which is plausibly the project's own distribution infrastructure; the source is not executed directly and the build process uses it to extract and repackage legitimate upstream binaries, posing minimal supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:52 "CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg::https://download.codebuddy.cn/aiide/darwin-x64/CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Zeongit J. <https://github.com/JipZeonGit/codebuddy-ide-cn-linux/issues>
2#
3# This PKGBUILD is licensed under the MIT License.
4# It contains no proprietary code; it only orchestrates the download,
5# extraction, and packaging of upstream binaries that the end user
6# fetches directly from Tencent's official CDN at install time.
7#
8# The packaged software (Tencent CodeBuddy IDE) remains subject to
9# Tencent's proprietary CodeBuddy service license, NOT this MIT notice.
10
11pkgname=codebuddy-cn-ide
12pkgver=4.9.9.27861944
13pkgrel=1
14pkgdesc='腾讯云代码助手CodeBuddy IDE，是一款辅助编码工具。'
15arch=('x86_64')
16url='https://github.com/JipZeonGit/codebuddy-ide-cn-linux'
17license=('LicenseRef-Tencent-CodeBuddy')
18
19depends=(
20 'gtk3' 'nss' 'libxss' 'alsa-lib' 'libsecret' 'libxkbfile'
21 'libnotify' 'libcups'
22)
23
24# These are referenced only by optional bundled extensions / utility
25# scripts; the main IDE process uses the bundled Electron's node.
26optdepends=(
27 'python: required by the genie skill-creator extension scripts'
28 'nodejs: required only when invoking bundled CLI helpers in node_modules'
29)
30
31makedepends=(
32 '7zip' 'curl' 'unzip' 'python' 'nodejs' 'npm'
33 'gcc' 'make' 'pkgconf' 'libicns' 'imagemagick'
34)
35
36# A previous local-build package used the name 'codebuddycn-ide'.
37# Force a clean migration if the user has it installed.
38conflicts=('codebuddycn-ide')
39
40# - !strip: Electron native binaries break under strip.
41# - !debug: prevent a -debug split package when global makepkg.conf
42# has debug enabled (CachyOS turns it on by default).
43options=('!strip' '!debug')
44
45# Helper repository pinned to a specific commit so the conversion
46# logic is reproducible. Bump together with pkgver if needed.
47_helper_commit='cb73459de649fb8781cc55e31d7e3ff8ff21c18f'
48_electron_version='34.5.1'
49_dmg_buildid='19255a94'
50
51source=(
52 "CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg::https://download.codebuddy.cn/aiide/darwin-x64/CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg"
53 "codebuddy-ide-cn-linux-${_helper_commit}.tar.gz::${url}/archive/${_helper_commit}.tar.gz"
54 "electron-v${_electron_version}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electron_version}/electron-v${_electron_version}-linux-x64.zip"
55 'LICENSE.notice'
56)
57
58# DMG is not a format makepkg can extract; leave the Electron zip as-is
59# and let install.sh consume it from a pre-populated cache directory.
60noextract=(
61 "CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg"
62 "electron-v${_electron_version}-linux-x64.zip"
63)
64
65sha256sums=(
66 '397b5719897a6fd0be10b87c61f34cdc0914f2c3d858c6e6c86c0d2ce9134852'
67 '544f332fab062b8a4d0c78eab59c4305eb5240945b6a4c60bf7734bf093ab261'
68 '3ae6f75fa08f5c1bdb7bbcec4dc9cf7d7f53ffcf6a4292e4a482b2ce515505e7'
69 'SKIP'
70)
71
72prepare() {
73 local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
74
75 # GitHub archive tarballs do not preserve the executable bit, so
76 # check for existence rather than -x.
77 [ -f "${helper_dir}/install.sh" ] || {
78 echo "ERROR: helper repo not extracted at ${helper_dir}" >&2
79 return 1
80 }
81
82 # Feed install.sh a pre-populated Electron cache so it skips the
83 # network download step inside build().
84 install -d "${srcdir}/electron-cache"
85 cp -a "${srcdir}/electron-v${_electron_version}-linux-x64.zip" \
86 "${srcdir}/electron-cache/"
87}
88
89build() {
90 local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
91 local dmg_path="${srcdir}/CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg"
92 local out_dir="${srcdir}/build/${pkgname}"
93
94 install -d "${out_dir}"
95
96 # Drive the upstream automated installer. Passing CODEBUDDY_APP_ID
97 # makes its generated start.sh export the matching CHROME_DESKTOP
98 # value at runtime, so window managers attach the right .desktop.
99 CODEBUDDY_INSTALL_DIR="${out_dir}" \
100 CODEBUDDY_APP_ID="${pkgname}" \
101 CODEBUDDY_APP_DISPLAY_NAME='CodeBuddy IDE CN' \
102 CODEBUDDY_ELECTRON_CACHE_DIR="${srcdir}/electron-cache" \
103 ELECTRON_VERSION="${_electron_version}" \
104 bash "${helper_dir}/install.sh" --fresh "${dmg_path}"
105
106 # The desktop entry written by install.sh embeds absolute build-time
107 # paths from ${out_dir}. We ship a clean system-wide entry from
108 # package(); discard the build-time copy so it never lands in /opt.
109 rm -f "${out_dir}/.codebuddycn-linux/${pkgname}.desktop"
110}
111
112package() {
113 local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
114 local out_dir="${srcdir}/build/${pkgname}"
115
116 # 1) App payload under /opt/$pkgname.
117 install -d "${pkgdir}/opt/${pkgname}"
118 cp -a "${out_dir}/." "${pkgdir}/opt/${pkgname}/"
119
120 # 1b) Strip gyp / autotools intermediate build artifacts that the
121 # rebuilt native modules leave behind. Only the final *.node files
122 # in build/Release/ are needed at runtime. Removing these:
123 # - drops ~50 MB of debug junk from the package
124 # - eliminates many namcap warnings (unstripped .o files, missing
125 # PIE/RELRO on intermediate objects)
126 # - resolves cross-directory hardlink errors (gyp writes the
127 # same .node twice and hardlinks them)
128 find "${pkgdir}/opt/${pkgname}/resources/app/node_modules" \
129 \( -name 'obj.target' -o -name 'obj' -o -name '.deps' \) \
130 -type d -prune -exec rm -rf {} + 2>/dev/null || true
131
132 # sqlite3 leaves an unused placeholder static archive that namcap
133 # flags as a cross-directory hardlink. Drop it; nothing links it.
134 rm -f "${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/node-addon-api/nothing.a" \
135 "${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/Release/nothing.a" \
136 "${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/Release/node-addon-api/nothing.o" \
137 2>/dev/null || true
138
139 # Clean up empty directories left by the prune above and by the
140 # earlier removal of macOS/Windows-only platform modules.
141 find "${pkgdir}/opt/${pkgname}/resources/app/node_modules" \
142 -type d -empty -delete 2>/dev/null || true
143
144 # 2) /usr/bin launcher.
145 install -d "${pkgdir}/usr/bin"
146 cat > "${pkgdir}/usr/bin/${pkgname}" <<EOF
147#!/bin/bash
148exec /opt/${pkgname}/start.sh "\$@"
149EOF
150 chmod 0755 "${pkgdir}/usr/bin/${pkgname}"
151
152 # 3) System desktop entry.
153 install -d "${pkgdir}/usr/share/applications"
154 cat > "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
155[Desktop Entry]
156Name=CodeBuddy IDE CN
157Comment=${pkgdesc}
158Exec=/usr/bin/${pkgname} %F
159Icon=${pkgname}
160Type=Application
161Categories=Development;IDE;
162StartupNotify=true
163StartupWMClass=CodeBuddy CN
164MimeType=x-scheme-handler/codebuddycn;
165EOF
166 chmod 0644 "${pkgdir}/usr/share/applications/${pkgname}.desktop"
167
168 # 4) Icon, by hicolor theme name '${pkgname}'.
169 if [ -f "${out_dir}/.codebuddycn-linux/codebuddycn.png" ]; then
170 install -Dm644 "${out_dir}/.codebuddycn-linux/codebuddycn.png" \
171 "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
172 fi
173
174 # 5) Licenses. /usr/share/licenses/$pkgname/ must exist because
175 # license=('custom'). We ship:
176 # - LICENSE.notice : explanation of the layered licensing
177 # - LICENSE.helper-MIT : MIT text covering the recipe + scripts
178 # - upstream/* : any LICENSE/EULA/NOTICE found in .app
179 install -Dm644 "${srcdir}/LICENSE.notice" \
180 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.notice"
181
182 if [ -f "${helper_dir}/LICENSE" ]; then
183 install -Dm644 "${helper_dir}/LICENSE" \
184 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.helper-MIT"
185 fi
186
187 # Only the official upstream LICENSE/EULA/NOTICE files at the root of
188 # the app payload are relevant. Going deeper would scoop up MIT/BSD
189 # notices from third-party node_modules, which are NOT the license
190 # the user is agreeing to when they install this package.
191 local upstream_license
192 while IFS= read -r upstream_license; do
193 [ -f "${upstream_license}" ] || continue
194 install -Dm644 "${upstream_license}" \
195 "${pkgdir}/usr/share/licenses/${pkgname}/upstream/$(basename "${upstream_license}")"
196 done < <(find "${out_dir}/resources/app" \
197 -maxdepth 1 \
198 \( -iname 'LICENSE*' -o -iname 'EULA*' -o -iname 'NOTICE*' \
199 -o -iname 'ThirdPartyNotices*' \) \
200 -type f 2>/dev/null || true)
201}
202

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion