codebuddy-ide-cn

LOW
maintainer JipZeonGit 1 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a prebuilt .deb from Tencent's official CDN (download.codebuddy.cn), which is plausibly the project's own infrastructure; the source is not from a swappable host like personal cloud storage, and the checksums are verified, making the risk low despite the non-whitelisted domain.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Tencent's official CDN (download.codebuddy.cn), which is plausibly the project's own infrastructure; the source is not from a swappable host like personal cloud storage, and the checksums are verified, making the risk low despite the non-whitelisted domain.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:48 "codebuddy-cn_${pkgver}_amd64.deb::https://download.codebuddy.cn/aiide/linux-x64/CodeBuddy-linux-x64-${pkgver}-${_cb_hash}-cn.deb"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Zeongit J. <https://github.com/JipZeonGit/codebuddy-ide-cn-linux/issues>
2#
3# This PKGBUILD is licensed under the MIT License.
4# It contains no proprietary code; it only orchestrates the download,
5# extraction, and packaging of upstream binaries that the end user
6# fetches directly from Tencent's official CDN at install time.
7#
8# The packaged software (Tencent CodeBuddy IDE) remains subject to
9# Tencent's proprietary CodeBuddy service license, NOT this MIT notice.
10
11pkgname=codebuddy-ide-cn
12_cb_ver=4.12.0
13_cb_build=37847260
14_cb_hash=b4c35ed0
15pkgver="${_cb_ver}.${_cb_build}"
16pkgrel=1
17pkgdesc='腾讯云代码助手CodeBuddy IDE，是一款辅助编码工具。'
18arch=('x86_64')
19url='https://github.com/JipZeonGit/codebuddy-ide-cn-linux'
20license=('LicenseRef-Tencent-CodeBuddy')
21
22depends=(
23 'gtk3' 'nss' 'libxss' 'alsa-lib' 'libsecret' 'libxkbfile'
24 'libnotify' 'libcups'
25)
26
27# These are referenced only by optional bundled extensions / utility
28# scripts; the main IDE process uses the bundled Electron's node.
29optdepends=(
30 'python: required by the genie skill-creator extension scripts'
31 'nodejs: required only when invoking bundled CLI helpers in node_modules'
32)
33
34makedepends=(
35 'curl' 'python' 'nodejs' 'npm'
36 'gcc' 'make' 'pkgconf' 'imagemagick' 'binutils'
37)
38
39# Conflict with old package names
40conflicts=('codebuddy-cn-ide' 'codebuddycn-ide')
41options=('!strip' '!debug')
42
43# Helper repository pinned to a specific commit so the conversion
44# logic is reproducible. Bump together with pkgver if needed.
45_helper_commit='4b9e6db012bd312c2b233ced9f5d4de8ad341c02'
46
47source=(
48 "codebuddy-cn_${pkgver}_amd64.deb::https://download.codebuddy.cn/aiide/linux-x64/CodeBuddy-linux-x64-${pkgver}-${_cb_hash}-cn.deb"
49 "codebuddy-ide-cn-linux-${_helper_commit}.tar.gz::${url}/archive/${_helper_commit}.tar.gz"
50 'LICENSE.notice'
51)
52
53# Leave the deb as-is and let install.sh consume it from the srcdir
54noextract=(
55 "codebuddy-cn_${pkgver}_amd64.deb"
56)
57
58sha256sums=('1d6d88eb13bb04f4953fc3702130f28cd8bb8b0a5688cd5023230ff2cfcdf7f0'
59 'ce8b6a6d03c60e31470e1d4625416f81f28f5acd2df6b34d7027252080c2c7f1'
60 'b3260549a765c478dc33680c7b9a1a30e5a038456e340d6d25f7748390724241')
61
62prepare() {
63 local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
64
65 [ -f "${helper_dir}/install.sh" ] || {
66 echo "ERROR: helper repo not extracted at ${helper_dir}" >&2
67 return 1
68 }
69}
70
71build() {
72 local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
73 local deb_path="${srcdir}/codebuddy-cn_${pkgver}_amd64.deb"
74 local out_dir="${srcdir}/build/${pkgname}"
75
76 install -d "${out_dir}"
77
78 # Drive the upstream automated installer. Passing CODEBUDDY_APP_ID
79 # makes its generated start.sh export the matching CHROME_DESKTOP
80 # value at runtime, so window managers attach the right .desktop.
81 CODEBUDDY_INSTALL_DIR="${out_dir}" \
82 CODEBUDDY_APP_ID="${pkgname}" \
83 CODEBUDDY_APP_DISPLAY_NAME='CodeBuddy CN' \
84 bash "${helper_dir}/install.sh" --fresh "${deb_path}"
85
86 # Discard build-time desktop file
87 rm -f "${out_dir}/.codebuddycn-linux/${pkgname}.desktop"
88}
89
90package() {
91 local helper_dir="${srcdir}/codebuddy-ide-cn-linux-${_helper_commit}"
92 local out_dir="${srcdir}/build/${pkgname}"
93
94 # 1) App payload under /opt/$pkgname.
95 install -d "${pkgdir}/opt/${pkgname}"
96 cp -a "${out_dir}/." "${pkgdir}/opt/${pkgname}/"
97
98 # Strip gyp/autotools build relics
99 find "${pkgdir}/opt/${pkgname}/resources/app/node_modules" \
100 \( -name 'obj.target' -o -name 'obj' -o -name '.deps' \) \
101 -type d -prune -exec rm -rf {} + 2>/dev/null || true
102
103 rm -f "${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/node-addon-api/nothing.a" \
104 "${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/Release/nothing.a" \
105 "${pkgdir}/opt/${pkgname}/resources/app/node_modules/@vscode/sqlite3/build/Release/node-addon-api/nothing.o" \
106 2>/dev/null || true
107
108 find "${pkgdir}/opt/${pkgname}/resources/app/node_modules" \
109 -type d -empty -delete 2>/dev/null || true
110
111 # 2) /usr/bin launcher.
112 install -d "${pkgdir}/usr/bin"
113 cat > "${pkgdir}/usr/bin/${pkgname}" <<EOF
114#!/bin/bash
115exec /opt/${pkgname}/start.sh "\$@"
116EOF
117 chmod 0755 "${pkgdir}/usr/bin/${pkgname}"
118
119 # 3) System desktop entry.
120 install -d "${pkgdir}/usr/share/applications"
121 cat > "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
122[Desktop Entry]
123Name=CodeBuddy CN
124Comment=${pkgdesc}
125Exec=/usr/bin/${pkgname} %F
126Icon=${pkgname}
127Type=Application
128Categories=Development;IDE;
129StartupNotify=true
130StartupWMClass=CodeBuddy CN
131MimeType=x-scheme-handler/codebuddycn;
132EOF
133 chmod 0644 "${pkgdir}/usr/share/applications/${pkgname}.desktop"
134
135 # 4) Icon
136 if [ -f "${out_dir}/.codebuddycn-linux/codebuddycn.png" ]; then
137 install -Dm644 "${out_dir}/.codebuddycn-linux/codebuddycn.png" \
138 "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
139 fi
140
141 # 5) Licenses.
142 install -Dm644 "${srcdir}/LICENSE.notice" \
143 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.notice"
144
145 if [ -f "${helper_dir}/LICENSE" ]; then
146 install -Dm644 "${helper_dir}/LICENSE" \
147 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.helper-MIT"
148 fi
149
150 # Copy upstream licenses
151 local upstream_license
152 while IFS= read -r upstream_license; do
153 install -Dm644 "${out_dir}/${upstream_license}" \
154 "${pkgdir}/usr/share/licenses/${pkgname}/upstream/${upstream_license}"
155 done < <(find "${out_dir}" -maxdepth 1 \
156 \( -name 'LICENSE*' -o -name 'EULA*' -o -name 'NOTICE*' \) \
157 -type f -exec basename {} \;)
158}
159

Changes since previous scan

--- PKGBUILD @ 2026-09-12 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -9,9 +9,9 @@
# Tencent's proprietary CodeBuddy service license, NOT this MIT notice.
pkgname=codebuddy-ide-cn
-_cb_ver=4.11.3
-_cb_build=37298507
-_cb_hash=2345dde1
+_cb_ver=4.12.0
+_cb_build=37847260
+_cb_hash=b4c35ed0
pkgver="${_cb_ver}.${_cb_build}"
pkgrel=1
pkgdesc='腾讯云代码助手CodeBuddy IDE，是一款辅助编码工具。'
@@ -42,7 +42,7 @@
# Helper repository pinned to a specific commit so the conversion
# logic is reproducible. Bump together with pkgver if needed.
-_helper_commit='604c011605e480ba24d1f095b06418cf1eaf23f1'
+_helper_commit='4b9e6db012bd312c2b233ced9f5d4de8ad341c02'
source=(
"codebuddy-cn_${pkgver}_amd64.deb::https://download.codebuddy.cn/aiide/linux-x64/CodeBuddy-linux-x64-${pkgver}-${_cb_hash}-cn.deb"
@@ -55,8 +55,8 @@
"codebuddy-cn_${pkgver}_amd64.deb"
)
-sha256sums=('d0770a4563535226daace0a57f39812bc8a23aa758073a06fb77857efea888e8'
- 'c03fab55406cbd0a2342b4628a93519a8051d36614e415ebb0fbc94727f218b2'
+sha256sums=('1d6d88eb13bb04f4953fc3702130f28cd8bb8b0a5688cd5023230ff2cfcdf7f0'
+ 'ce8b6a6d03c60e31470e1d4625416f81f28f5acd2df6b34d7027252080c2c7f1'
'b3260549a765c478dc33680c7b9a1a30e5a038456e340d6d25f7748390724241')
prepare() {

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 15:12:25 Medium 1
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 17:46:09 Medium 1
2026-08-31 15:45:42 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion