codemeyo-bin

MEDIUM

maintainer gaougalos 0 votes scanned 2026-10-25 00:20:48.567348

View on AUR

Why flagged

Downloads a prebuilt AppImage binary from the project's own API endpoint (codemeyo.com) with a sha256 checksum, but the download is gated behind a non-standard API path with a numeric file ID rather than a versioned release URL, making it harder to independently verify the artifact matches an official release; the DLAGENTS override with a browser UA to bypass a WAF is unusual but not inherently malicious, and the checksum provides some integrity guarantee.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 source=("CodeMeYo_${pkgver}_amd64.AppImage::https://codemeyo.com/api/v1/updater/files/${_fileid}"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads a prebuilt AppImage binary from the project's own API endpoint (codemeyo.com) with a sha256 checksum, but the download is gated behind a non-standard API path with a numeric file ID rather than a versioned release URL, making it harder to independently verify the artifact matches an official release; the DLAGENTS override with a browser UA to bypass a WAF is unusual but not inherently malicious, and the checksum provides some integrity guarantee.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: gaou-piou <i.am.piou@gmail.com>
    
      2
    
      3pkgname=codemeyo-bin
    
      4pkgver=1.11.7
    
      5pkgrel=1
    
      6pkgdesc='Multi-LLM autonomous coding agent with Claude, GPT, Grok, Gemini, DeepSeek, Mistral, Ollama and Groq support'
    
      7arch=('x86_64')
    
      8url='https://codemeyo.com'
    
      9license=('MIT')
    
      10depends=('fuse2')
    
      11provides=('codemeyo')
    
      12conflicts=('codemeyo')
    
      13options=('!strip' '!debug')
    
      14
    
      15# Upstream gates the Linux installer behind an e-mail form at
    
      16# https://codemeyo.com/download/linux, so no versioned download URL exists.
    
      17# The desktop updater serves the exact same artifact from a public file id;
    
      18# this package tracks that endpoint.
    
      19#
    
      20# To update, download the latest Linux AppImage from the form, then locate the
    
      21# matching public id at https://codemeyo.com/api/v1/updater/files/<id> (its
    
      22# Content-Disposition header carries the file name). Bump pkgver, _fileid and
    
      23# the checksums.
    
      24_fileid=62
    
      25
    
      26# codemeyo.com is fronted by a firewall that answers HTTP 403 to curl's stock
    
      27# User-Agent ("curl/8.x") on a cold connection; any browser-like UA passes and
    
      28# then leaves that IP trusted for a short while. makepkg's default https agent
    
      29# sends the stock UA, which is why a plain `makepkg` dies here. Override it for
    
      30# this package's sources only. DLAGENTS entries are word-split, so the UA is
    
      31# deliberately space-free ("Mozilla/5.0", never "Mozilla/5.0 (X11; ...)").
    
      32DLAGENTS=('http::/usr/bin/curl -fLC - -A Mozilla/5.0 --retry 5 --retry-delay 10 --retry-all-errors --retry-max-time 900 -o %o %u'
    
      33          'https::/usr/bin/curl -fLC - -A Mozilla/5.0 --retry 5 --retry-delay 10 --retry-all-errors --retry-max-time 900 -o %o %u')
    
      34
    
      35source=("CodeMeYo_${pkgver}_amd64.AppImage::https://codemeyo.com/api/v1/updater/files/${_fileid}"
    
      36        'codemeyo.desktop'
    
      37        'codemeyo.png')
    
      38sha256sums=('6adbbcc0786f4c638ea0f16e6b3bf80722309c1390d0f96f58aa27e8063da878'
    
      39            '322b6c50a4e434e57cd88498159573981321c3187039e7dbaf94d6485718d61c'
    
      40            '6c7660390d65217fe8de0892862254f47aee77e0af7096c75b8bfe168c5403f7')
    
      41
    
      42package() {
    
      43  install -Dm755 "${srcdir}/CodeMeYo_${pkgver}_amd64.AppImage" \
    
      44    "${pkgdir}/opt/codemeyo/CodeMeYo.AppImage"
    
      45
    
      46  # The AppImage carries its own libwayland-client.so.0 and libwayland-egl.so.1,
    
      47  # built against an older libwayland than the one in an up-to-date Arch
    
      48  # install. When the bundled copy is picked up, WebKitGTK's web process aborts
    
      49  # before it can render anything:
    
      50  #
    
      51  #   Could not create default EGL display: EGL_BAD_PARAMETER. Aborting...
    
      52  #
    
      53  # and the window stays empty/grey (the app itself keeps running, so nothing
    
      54  # looks crashed). Preloading the distro copy makes the loader satisfy the
    
      55  # NEEDED entry from /usr/lib instead of the bundle and the UI renders fine.
    
      56  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/codemeyo" <<'EOF'
    
      57#!/bin/sh
    
      58# Work around the bundled libwayland breaking EGL/WebKit (see PKGBUILD comment).
    
      59if [ -r /usr/lib/libwayland-client.so.0 ]; then
    
      60  LD_PRELOAD="/usr/lib/libwayland-client.so.0${LD_PRELOAD:+:$LD_PRELOAD}"
    
      61  export LD_PRELOAD
    
      62fi
    
      63exec /opt/codemeyo/CodeMeYo.AppImage "$@"
    
      64EOF
    
      65
    
      66  install -Dm644 "${srcdir}/codemeyo.desktop" \
    
      67    "${pkgdir}/usr/share/applications/codemeyo.desktop"
    
      68  install -Dm644 "${srcdir}/codemeyo.png" \
    
      69    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/codemeyo.png"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 00:20:48	Medium	3
2026-10-24 23:43:00	Medium	3
2026-10-24 23:41:29	Medium	3