colamd-bin

LOW

maintainer zxp19821005 0 votes scanned 2026-08-25 03:25:42.010142

View on AUR

Why flagged

The package installs a prebuilt .deb from GitHub Releases, which is a common and generally safe practice for Electron apps; the build process unpacks and repackages the app with minor patches but does not introduce untrusted remote code execution or data exfiltration risks.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt .deb from GitHub Releases, which is a common and generally safe practice for Electron apps; the build process unpacks and repackages the app with minor patches but does not introduce untrusted remote code execution or data exfiltration risks.

PKGBUILD

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=colamd-bin
    
      3_pkgname=ColaMD
    
      4pkgver=1.9.0
    
      5_electronversion=34
    
      6pkgrel=1
    
      7pkgdesc="A free, elegant Markdown editor for humans and AI agents — with real-time sync for AI-generated changes.(Prebuilt version.Use system-wide electron)"
    
      8arch=('x86_64')
    
      9url="http://colamd.com/"
    
      10_ghurl="https://github.com/marswaveai/ColaMD"
    
      11license=('MIT')
    
      12provides=("${pkgname%-bin}=${pkgver}")
    
      13conflicts=("${pkgname%-bin}")
    
      14depends=(
    
      15    "electron${_electronversion}"
    
      16)
    
      17makedepends=(
    
      18    'asar'
    
      19)
    
      20source=(
    
      21    "${pkgname%-bin}-${pkgver}.deb::${_ghurl}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_amd64.deb"
    
      22    "LICENSE-${pkgver}::https://raw.githubusercontent.com/marswaveai/ColaMD/v${pkgver}/LICENSE"
    
      23    "${pkgname%-bin}.sh"
    
      24)
    
      25sha256sums=('6b88453a1aa07d2ff8a4c1ed5ec4e60e2b5344d929af803afc24bfd08fd45a4e'
    
      26            'b458eb0211ec5df71f8c32cfde43027bd0471337d36f1637fe229b76369fcc45'
    
      27            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      28_get_app_dir() {
    
      29    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      30}
    
      31_check_electron_version() {
    
      32    echo "Verifying Electron version..."
    
      33    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
    
      34    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
    
      35    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
    
      36    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
    
      37    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
    
      38        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
    
      39        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      40}
    
      41prepare() {
    
      42    sed -i -e "
    
      43        s/@electronversion@/${_electronversion}/g
    
      44        s/@appname@/${pkgname%-bin}/g
    
      45        s/@runname@/app.asar/g
    
      46        s/@cfgdirname@/${pkgname%-bin}/g
    
      47    " "${srcdir}/${pkgname%-bin}.sh"
    
      48    bsdtar -xf "${srcdir}/data."*
    
      49    _check_electron_version
    
      50    local _app_dir=$(_get_app_dir)
    
      51    sed -i "s/\/opt\/${_pkgname}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      52    asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked"
    
      53    rm -rf "${_app_dir}/resources/app.asar"
    
      54    find "${srcdir}/app.asar.unpacked/dist" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} +
    
      55    asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
    
      56}
    
      57package() {
    
      58    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      59    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      60    local _app_dir=$(_get_app_dir)
    
      61    cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      62    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      63    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      64        _extension="${_i##*.}"
    
      65        _icon_path="${_i#*share/icons/}"
    
      66        _target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      67        install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      68    done
    
      69    install -Dm644 "${srcdir}/usr/share/mime/packages/${pkgname%-bin}.xml" -t "${pkgdir}/usr/share/mime/packages"
    
      70    install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      71}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-25 03:25:42	Low	2