codebuddy-ide-cn
maintainer JipZeonGit
· 1 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb binary from a non-standard host (download.codebuddy.cn), which is not a widely recognized or whitelisted domain, and the checksum, while present, cannot be independently verified against an upstream source, creating a supply-chain risk if the host is compromised or maliciously redirected.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:48
"codebuddy-cn_${pkgver}_amd64.deb::https://download.codebuddy.cn/aiide/linux-x64/CodeBuddy-linux-x64-${pkgver}-${_cb_hash}-cn.deb"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-standard host (download.codebuddy.cn), which is not a widely recognized or whitelisted domain, and the checksum, while present, cannot be independently verified against an upstream source, creating a supply-chain risk if the host is compromised or maliciously redirected.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Zeongit J. <https://github.com/JipZeonGit/codebuddy-ide-cn-linux/issues>
2
#
3
# This PKGBUILD is licensed under the MIT License.
4
# It contains no proprietary code; it only orchestrates the download,
5
# extraction, and packaging of upstream binaries that the end user
6
# fetches directly from Tencent's official CDN at install time.
7
#
8
# The packaged software (Tencent CodeBuddy IDE) remains subject to
9
# Tencent's proprietary CodeBuddy service license, NOT this MIT notice.
10
11
pkgname=codebuddy-ide-cn
12
_cb_ver=4.10.3
13
_cb_build=33770460
14
_cb_hash=427f3937
15
pkgver="${_cb_ver}.${_cb_build}"
16
pkgrel=1
17
pkgdesc='腾讯云代码助手CodeBuddy IDE，是一款辅助编码工具。'
18
arch=('x86_64')
19
url='https://github.com/JipZeonGit/codebuddy-ide-cn-linux'
20
license=('LicenseRef-Tencent-CodeBuddy')
21
22
depends=(
23
'gtk3' 'nss' 'libxss' 'alsa-lib' 'libsecret' 'libxkbfile'
24
'libnotify' 'libcups'
25
)
26
27
# These are referenced only by optional bundled extensions / utility
28
# scripts; the main IDE process uses the bundled Electron's node.
29
optdepends=(
30
'python: required by the genie skill-creator extension scripts'
31
'nodejs: required only when invoking bundled CLI helpers in node_modules'
32
)
33
34
makedepends=(
35
'curl' 'python' 'nodejs' 'npm'
36
'gcc' 'make' 'pkgconf' 'imagemagick' 'binutils'
37
)
38
39
# Conflict with old package names
40
conflicts=('codebuddy-cn-ide' 'codebuddycn-ide')
41
options=('!strip' '!debug')
42
43
# Helper repository pinned to a specific commit so the conversion
44
# logic is reproducible. Bump together with pkgver if needed.
45
_helper_commit='d8d41ad2884234c81a22247b9375ae61394501e0'
46
47
source=(
48
"codebuddy-cn_${pkgver}_amd64.deb::https://download.codebuddy.cn/aiide/linux-x64/CodeBuddy-linux-x64-${pkgver}-${_cb_hash}-cn.deb"
49
"codebuddy-ide-cn-linux-${_helper_commit}.tar.gz::${url}/archive/${_helper_commit}.tar.gz"
50
'LICENSE.notice'
51
)
52
53
# Leave the deb as-is and let install.sh consume it from the srcdir
54
noextract=(
55
"codebuddy-cn_${pkgver}_amd64.deb"
56
)
57
58
sha256sums=('39d3dac13fa4c3d42ea4d77ce2edfd15c20eb8abc4f819ebb009f984e2fae85f'
59
'844a7be205c1541f34ed7b1bcc24cb9f3cb884ea1e462e39a0e8e0d8bd7ffe4a'
60
'b3260549a765c478dc33680c7b9a1a30e5a038456e340d6d25f7748390724241')
61
62
prepare() {
63
local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
64
65
[ -f "${helper_dir}/install.sh" ] || {
66
echo "ERROR: helper repo not extracted at ${helper_dir}" >&2
67
return 1
68
}
69
}
70
71
build() {
72
local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
73
local deb_path="${srcdir}/codebuddy-cn_${pkgver}_amd64.deb"
74
local out_dir="${srcdir}/build/${pkgname}"
75
76
install -d "${out_dir}"
77
78
# Drive the upstream automated installer. Passing CODEBUDDY_APP_ID
79
# makes its generated start.sh export the matching CHROME_DESKTOP
80
# value at runtime, so window managers attach the right .desktop.
81
CODEBUDDY_INSTALL_DIR="${out_dir}" \
82
CODEBUDDY_APP_ID="${pkgname}" \
83
CODEBUDDY_APP_DISPLAY_NAME='CodeBuddy CN' \
84
bash "${helper_dir}/install.sh" --fresh "${deb_path}"
85
86
# Discard build-time desktop file
87
rm -f "${out_dir}/.codebuddycn-linux/${pkgname}.desktop"
88
}
89
90
package() {
91
local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
92
local out_dir="${srcdir}/build/${pkgname}"
93
94
# 1) App payload under /opt/$pkgname.
95
install -d "${pkgdir}/opt/${pkgname}"
96
cp -a "${out_dir}/." "${pkgdir}/opt/${pkgname}/"
97
98
# Strip gyp/autotools build relics
99
find "${pkgdir}/opt/${pkgname}/resources/app/node_modules" \
100
\( -name 'obj.target' -o -name 'obj' -o -name '.deps' \) \
101
-type d -prune -exec rm -rf {} + 2>/dev/null || true
102
103
rm -f "${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/node-addon-api/nothing.a" \
104
"${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/Release/nothing.a" \
105
"${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/Release/node-addon-api/nothing.o" \
106
2>/dev/null || true
107
108
find "${pkgdir}/opt/${pkgname}/resources/app/node_modules" \
109
-type d -empty -delete 2>/dev/null || true
110
111
# 2) /usr/bin launcher.
112
install -d "${pkgdir}/usr/bin"
113
cat > "${pkgdir}/usr/bin/${pkgname}" <<EOF
114
#!/bin/bash
115
exec /opt/${pkgname}/start.sh "\$@"
116
EOF
117
chmod 0755 "${pkgdir}/usr/bin/${pkgname}"
118
119
# 3) System desktop entry.
120
install -d "${pkgdir}/usr/share/applications"
121
cat > "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
122
[Desktop Entry]
123
Name=CodeBuddy CN
124
Comment=${pkgdesc}
125
Exec=/usr/bin/${pkgname} %F
126
Icon=${pkgname}
127
Type=Application
128
Categories=Development;IDE;
129
StartupNotify=true
130
StartupWMClass=CodeBuddy CN
131
MimeType=x-scheme-handler/codebuddycn;
132
EOF
133
chmod 0644 "${pkgdir}/usr/share/applications/${pkgname}.desktop"
134
135
# 4) Icon
136
if [ -f "${out_dir}/.codebuddycn-linux/codebuddycn.png" ]; then
137
install -Dm644 "${out_dir}/.codebuddycn-linux/codebuddycn.png" \
138
"${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
139
fi
140
141
# 5) Licenses.
142
install -Dm644 "${srcdir}/LICENSE.notice" \
143
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.notice"
144
145
if [ -f "${helper_dir}/LICENSE" ]; then
146
install -Dm644 "${helper_dir}/LICENSE" \
147
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.helper-MIT"
148
fi
149
150
# Copy upstream licenses
151
local upstream_license
152
while IFS= read -r upstream_license; do
153
install -Dm644 "${out_dir}/${upstream_license}" \
154
"${pkgdir}/usr/share/licenses/${pkgname}/upstream/${upstream_license}"
155
done < <(find "${out_dir}" -maxdepth 1 \
156
\( -name 'LICENSE*' -o -name 'EULA*' -o -name 'NOTICE*' \) \
157
-type f -exec basename {} \;)
158
}
159
Changes since previous scan
--- PKGBUILD @ 2026-07-25 00:13+++ PKGBUILD @ 2026-08-03 00:08@@ -9,9 +9,9 @@ # Tencent's proprietary CodeBuddy service license, NOT this MIT notice. pkgname=codebuddy-ide-cn-_cb_ver=4.10.1-_cb_build=33158423-_cb_hash=3ad58bcb+_cb_ver=4.10.3+_cb_build=33770460+_cb_hash=427f3937 pkgver="${_cb_ver}.${_cb_build}" pkgrel=1 pkgdesc='腾讯云代码助手CodeBuddy IDE，是一款辅助编码工具。'@@ -42,7 +42,7 @@ # Helper repository pinned to a specific commit so the conversion # logic is reproducible. Bump together with pkgver if needed.-_helper_commit='6928c99f6389087861e6ce43ea6e1ebfc935f536'+_helper_commit='d8d41ad2884234c81a22247b9375ae61394501e0' source=( "codebuddy-cn_${pkgver}_amd64.deb::https://download.codebuddy.cn/aiide/linux-x64/CodeBuddy-linux-x64-${pkgver}-${_cb_hash}-cn.deb"@@ -55,8 +55,8 @@ "codebuddy-cn_${pkgver}_amd64.deb" ) -sha256sums=('838fe89a19f2cac23c02aab67bf5cb34e613323cd47cb811588a3d90d4fe4398'- 'e212427b8b0da1554328203bc0e5ec65e8ef81b3e710a9f20b755f9dec2ead6b'+sha256sums=('39d3dac13fa4c3d42ea4d77ce2edfd15c20eb8abc4f819ebb009f984e2fae85f'+ '844a7be205c1541f34ed7b1bcc24cb9f3cb884ea1e462e39a0e8e0d8bd7ffe4a' 'b3260549a765c478dc33680c7b9a1a30e5a038456e340d6d25f7748390724241') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 05:29:17 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |