codebuddy-cn-ide
maintainer JipZeonGit
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a DMG from Tencent's official CDN (download.codebuddy.cn), which is plausibly the project's own distribution infrastructure; the source is not executed directly and the build process uses it to extract and repackage legitimate upstream binaries, posing minimal supply-chain risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a DMG from Tencent's official CDN (download.codebuddy.cn), which is plausibly the project's own distribution infrastructure; the source is not executed directly and the build process uses it to extract and repackage legitimate upstream binaries, posing minimal supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:52
"CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg::https://download.codebuddy.cn/aiide/darwin-x64/CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Zeongit J. <https://github.com/JipZeonGit/codebuddy-ide-cn-linux/issues>
2
#
3
# This PKGBUILD is licensed under the MIT License.
4
# It contains no proprietary code; it only orchestrates the download,
5
# extraction, and packaging of upstream binaries that the end user
6
# fetches directly from Tencent's official CDN at install time.
7
#
8
# The packaged software (Tencent CodeBuddy IDE) remains subject to
9
# Tencent's proprietary CodeBuddy service license, NOT this MIT notice.
10
11
pkgname=codebuddy-cn-ide
12
pkgver=4.9.9.27861944
13
pkgrel=1
14
pkgdesc='腾讯云代码助手CodeBuddy IDE，是一款辅助编码工具。'
15
arch=('x86_64')
16
url='https://github.com/JipZeonGit/codebuddy-ide-cn-linux'
17
license=('LicenseRef-Tencent-CodeBuddy')
18
19
depends=(
20
'gtk3' 'nss' 'libxss' 'alsa-lib' 'libsecret' 'libxkbfile'
21
'libnotify' 'libcups'
22
)
23
24
# These are referenced only by optional bundled extensions / utility
25
# scripts; the main IDE process uses the bundled Electron's node.
26
optdepends=(
27
'python: required by the genie skill-creator extension scripts'
28
'nodejs: required only when invoking bundled CLI helpers in node_modules'
29
)
30
31
makedepends=(
32
'7zip' 'curl' 'unzip' 'python' 'nodejs' 'npm'
33
'gcc' 'make' 'pkgconf' 'libicns' 'imagemagick'
34
)
35
36
# A previous local-build package used the name 'codebuddycn-ide'.
37
# Force a clean migration if the user has it installed.
38
conflicts=('codebuddycn-ide')
39
40
# - !strip: Electron native binaries break under strip.
41
# - !debug: prevent a -debug split package when global makepkg.conf
42
# has debug enabled (CachyOS turns it on by default).
43
options=('!strip' '!debug')
44
45
# Helper repository pinned to a specific commit so the conversion
46
# logic is reproducible. Bump together with pkgver if needed.
47
_helper_commit='cb73459de649fb8781cc55e31d7e3ff8ff21c18f'
48
_electron_version='34.5.1'
49
_dmg_buildid='19255a94'
50
51
source=(
52
"CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg::https://download.codebuddy.cn/aiide/darwin-x64/CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg"
53
"codebuddy-ide-cn-linux-${_helper_commit}.tar.gz::${url}/archive/${_helper_commit}.tar.gz"
54
"electron-v${_electron_version}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electron_version}/electron-v${_electron_version}-linux-x64.zip"
55
'LICENSE.notice'
56
)
57
58
# DMG is not a format makepkg can extract; leave the Electron zip as-is
59
# and let install.sh consume it from a pre-populated cache directory.
60
noextract=(
61
"CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg"
62
"electron-v${_electron_version}-linux-x64.zip"
63
)
64
65
sha256sums=(
66
'397b5719897a6fd0be10b87c61f34cdc0914f2c3d858c6e6c86c0d2ce9134852'
67
'544f332fab062b8a4d0c78eab59c4305eb5240945b6a4c60bf7734bf093ab261'
68
'3ae6f75fa08f5c1bdb7bbcec4dc9cf7d7f53ffcf6a4292e4a482b2ce515505e7'
69
'SKIP'
70
)
71
72
prepare() {
73
local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
74
75
# GitHub archive tarballs do not preserve the executable bit, so
76
# check for existence rather than -x.
77
[ -f "${helper_dir}/install.sh" ] || {
78
echo "ERROR: helper repo not extracted at ${helper_dir}" >&2
79
return 1
80
}
81
82
# Feed install.sh a pre-populated Electron cache so it skips the
83
# network download step inside build().
84
install -d "${srcdir}/electron-cache"
85
cp -a "${srcdir}/electron-v${_electron_version}-linux-x64.zip" \
86
"${srcdir}/electron-cache/"
87
}
88
89
build() {
90
local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
91
local dmg_path="${srcdir}/CodeBuddy-darwin-x64-${pkgver}-${_dmg_buildid}-cn.dmg"
92
local out_dir="${srcdir}/build/${pkgname}"
93
94
install -d "${out_dir}"
95
96
# Drive the upstream automated installer. Passing CODEBUDDY_APP_ID
97
# makes its generated start.sh export the matching CHROME_DESKTOP
98
# value at runtime, so window managers attach the right .desktop.
99
CODEBUDDY_INSTALL_DIR="${out_dir}" \
100
CODEBUDDY_APP_ID="${pkgname}" \
101
CODEBUDDY_APP_DISPLAY_NAME='CodeBuddy IDE CN' \
102
CODEBUDDY_ELECTRON_CACHE_DIR="${srcdir}/electron-cache" \
103
ELECTRON_VERSION="${_electron_version}" \
104
bash "${helper_dir}/install.sh" --fresh "${dmg_path}"
105
106
# The desktop entry written by install.sh embeds absolute build-time
107
# paths from ${out_dir}. We ship a clean system-wide entry from
108
# package(); discard the build-time copy so it never lands in /opt.
109
rm -f "${out_dir}/.codebuddycn-linux/${pkgname}.desktop"
110
}
111
112
package() {
113
local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
114
local out_dir="${srcdir}/build/${pkgname}"
115
116
# 1) App payload under /opt/$pkgname.
117
install -d "${pkgdir}/opt/${pkgname}"
118
cp -a "${out_dir}/." "${pkgdir}/opt/${pkgname}/"
119
120
# 1b) Strip gyp / autotools intermediate build artifacts that the
121
# rebuilt native modules leave behind. Only the final *.node files
122
# in build/Release/ are needed at runtime. Removing these:
123
# - drops ~50 MB of debug junk from the package
124
# - eliminates many namcap warnings (unstripped .o files, missing
125
# PIE/RELRO on intermediate objects)
126
# - resolves cross-directory hardlink errors (gyp writes the
127
# same .node twice and hardlinks them)
128
find "${pkgdir}/opt/${pkgname}/resources/app/node_modules" \
129
\( -name 'obj.target' -o -name 'obj' -o -name '.deps' \) \
130
-type d -prune -exec rm -rf {} + 2>/dev/null || true
131
132
# sqlite3 leaves an unused placeholder static archive that namcap
133
# flags as a cross-directory hardlink. Drop it; nothing links it.
134
rm -f "${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/node-addon-api/nothing.a" \
135
"${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/Release/nothing.a" \
136
"${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/Release/node-addon-api/nothing.o" \
137
2>/dev/null || true
138
139
# Clean up empty directories left by the prune above and by the
140
# earlier removal of macOS/Windows-only platform modules.
141
find "${pkgdir}/opt/${pkgname}/resources/app/node_modules" \
142
-type d -empty -delete 2>/dev/null || true
143
144
# 2) /usr/bin launcher.
145
install -d "${pkgdir}/usr/bin"
146
cat > "${pkgdir}/usr/bin/${pkgname}" <<EOF
147
#!/bin/bash
148
exec /opt/${pkgname}/start.sh "\$@"
149
EOF
150
chmod 0755 "${pkgdir}/usr/bin/${pkgname}"
151
152
# 3) System desktop entry.
153
install -d "${pkgdir}/usr/share/applications"
154
cat > "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
155
[Desktop Entry]
156
Name=CodeBuddy IDE CN
157
Comment=${pkgdesc}
158
Exec=/usr/bin/${pkgname} %F
159
Icon=${pkgname}
160
Type=Application
161
Categories=Development;IDE;
162
StartupNotify=true
163
StartupWMClass=CodeBuddy CN
164
MimeType=x-scheme-handler/codebuddycn;
165
EOF
166
chmod 0644 "${pkgdir}/usr/share/applications/${pkgname}.desktop"
167
168
# 4) Icon, by hicolor theme name '${pkgname}'.
169
if [ -f "${out_dir}/.codebuddycn-linux/codebuddycn.png" ]; then
170
install -Dm644 "${out_dir}/.codebuddycn-linux/codebuddycn.png" \
171
"${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
172
fi
173
174
# 5) Licenses. /usr/share/licenses/$pkgname/ must exist because
175
# license=('custom'). We ship:
176
# - LICENSE.notice : explanation of the layered licensing
177
# - LICENSE.helper-MIT : MIT text covering the recipe + scripts
178
# - upstream/* : any LICENSE/EULA/NOTICE found in .app
179
install -Dm644 "${srcdir}/LICENSE.notice" \
180
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.notice"
181
182
if [ -f "${helper_dir}/LICENSE" ]; then
183
install -Dm644 "${helper_dir}/LICENSE" \
184
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.helper-MIT"
185
fi
186
187
# Only the official upstream LICENSE/EULA/NOTICE files at the root of
188
# the app payload are relevant. Going deeper would scoop up MIT/BSD
189
# notices from third-party node_modules, which are NOT the license
190
# the user is agreeing to when they install this package.
191
local upstream_license
192
while IFS= read -r upstream_license; do
193
[ -f "${upstream_license}" ] || continue
194
install -Dm644 "${upstream_license}" \
195
"${pkgdir}/usr/share/licenses/${pkgname}/upstream/$(basename "${upstream_license}")"
196
done < <(find "${out_dir}/resources/app" \
197
-maxdepth 1 \
198
\( -iname 'LICENSE*' -o -iname 'EULA*' -o -iname 'NOTICE*' \
199
-o -iname 'ThirdPartyNotices*' \) \
200
-type f 2>/dev/null || true)
201
}
202
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |