comate-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt Electron app from Baidu's official CDN (bcebos.com), which is plausibly the project's own infrastructure; the binary is not obfuscated or executed remotely, and the source is verified via sha256sum, making the supply chain risk low despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Electron app from Baidu's official CDN (bcebos.com), which is plausibly the project's own infrastructure; the binary is not obfuscated or executed remotely, and the source is verified via sha256sum, making the supply chain risk low despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:39 "LICENSE-${pkgver}::https://cloud.baidu.com/doc/COMATE/s/glxiygwdx"
PKGBUILD:45 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.tar.gz::https://comate-ide.cdn.bcebos.com/download/stable/${_version}/${_pkgname}-linux-x64.tar.gz")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2#获取版本号及下载地址：
    
      3#https://comate-ide.bj.bcebos.com/updates/stable/linux/arm64/latest.json
    
      4#https://comate-ide.bj.bcebos.com/updates/stable/linux/x64/latest.json
    
      5pkgname=comate-bin
    
      6_pkgname=Comate
    
      7pkgver=3.2.2
    
      8_version=4318e1d3aa81935708fe621c4121287d83f5bd68-262762091
    
      9_electronversion=39
    
      10pkgrel=1
    
      11pkgdesc="Code as you like, one step ahead, and understand your intelligent code assistant better.(Prebuilt version)"
    
      12arch=(
    
      13    'x86_64'
    
      14)
    
      15url="https://comate.baidu.com"
    
      16license=('LicenseRef-custom')
    
      17conflicts=("${pkgname%-bin}")
    
      18provides=("${pkgname%-bin}=${pkgver}")
    
      19depends=(
    
      20    "electron${_electronversion}"
    
      21    'nodejs'
    
      22    'python'
    
      23    'python-fonttools'
    
      24    'perl'
    
      25    'libxkbfile'
    
      26    'libsecret'
    
      27    'webkit2gtk-4.1'
    
      28    'python-yaml'
    
      29)
    
      30optdepends=(
    
      31    'bash'
    
      32    'zsh'
    
      33)
    
      34options=(
    
      35    '!emptydirs'
    
      36    '!strip'
    
      37)
    
      38source=(
    
      39    "LICENSE-${pkgver}::https://cloud.baidu.com/doc/COMATE/s/glxiygwdx"
    
      40    "${pkgname%-bin}.js"
    
      41    "${pkgname%-bin}.desktop"
    
      42    "${pkgname%-bin}-url-handler.desktop"
    
      43    "${pkgname%-bin}.sh"
    
      44)
    
      45source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.tar.gz::https://comate-ide.cdn.bcebos.com/download/stable/${_version}/${_pkgname}-linux-x64.tar.gz")
    
      46sha256sums=('463871c6f4f1ca35328f02d6c81aaeec1d6aa998e4ca5c6c206c39a8f6cf3ae0'
    
      47            'df2535dcf1679b8681a27f35a445c08300d34b0336af0dea07f0fbcd5ef5e946'
    
      48            '0c8fee636da036e57fcde0385bdc698126c4b179de663ad315e8299d483abc9d'
    
      49            '787bf0078b80c66fa5b8191991700afd6e32e9f285cdb32f69791b8894c86fd5'
    
      50            '700067aa4b354a91ab3374b5495af9eb3093855a3d8016a8303e88abf3470599')
    
      51sha256sums_x86_64=('2a3475ab89a8b7415f24da0e5f8dbb8e6b7da0c7e4cae622a521441ab161e562')
    
      52_get_app_dir() {
    
      53    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      54}
    
      55_check_electron_version() {
    
      56    echo "Verifying Electron version..."
    
      57    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
    
      58    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
    
      59    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
    
      60    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
    
      61    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
    
      62        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
    
      63        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      64}
    
      65prepare() {
    
      66    _check_electron_version
    
      67    sed -i -e "
    
      68        s/@electronversion@/${_electronversion}/g
    
      69        s/@appname@/${pkgname%-bin}/g
    
      70        s/@runname@/app/g
    
      71        s/@cfgdirname@/${_pkgname}/g
    
      72    " "${srcdir}/${pkgname%-bin}.sh"
    
      73    sed -i "s/@ELECTRON@/electron${_electronversion}/g" "${srcdir}/${pkgname%-bin}.js"
    
      74    # 删除其他平台的预编译 .node 文件
    
      75    local _app_dir=$(_get_app_dir)
    
      76    find "${_app_dir}/resources/app" -path "*/prebuilds/*" \
    
      77        ! -path "*/linux-x64/*" -name "*.node" -delete
    
      78    rm -rf "${_app_dir}/resources/app/extensions/baiducomate.comate/dist/comate-engine/node_modules/tree-sitter-bash/prebuilds/"{win32-x64,win32-arm64,darwin-x64,darwin-arm64}
    
      79    find "${_app_dir}/resources/app" -name "win32-*" -name "*.node" -delete
    
      80    rm -rf "${_app_dir}/resources/app/extensions/preview-dev-tools"
    
      81}
    
      82package() {
    
      83    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      84    install -Dm755 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      85	local _app_dir=$(_get_app_dir)
    
      86	cp -a "${_app_dir}/resources/app/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      87    install -Dm644 "${srcdir}/${_pkgname}-linux-x64/resources/app/resources/linux/code.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
    
      88    install -Dm644 "${srcdir}/${pkgname%-bin}"*.desktop -t "${pkgdir}/usr/share/applications"
    
      89    if [ -x "/usr/bin/bash" ];then
    
      90        install -Dm644 "${srcdir}/${_pkgname}-linux-x64/resources/completions/bash/${pkgname%-bin}" -t "${pkgdir}/usr/share/bash-completion/completions"
    
      91    fi
    
      92    if [ -x "/usr/bin/zsh" ];then
    
      93        install -Dm644 "${srcdir}/${_pkgname}-linux-x64/resources/completions/zsh/_${pkgname%-bin}" -t "${pkgdir}/usr/share/zsh/site-functions"
    
      94    fi
    
      95    install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      96}
    
      97

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,8 +4,8 @@
 #https://comate-ide.bj.bcebos.com/updates/stable/linux/x64/latest.json
 pkgname=comate-bin
 _pkgname=Comate
-pkgver=2.2.0
-_version=c948bd9dc56221a6f21c345f8c3f77f7574d0cfc-257651054
+pkgver=3.2.2
+_version=4318e1d3aa81935708fe621c4121287d83f5bd68-262762091
 _electronversion=39
 pkgrel=1
 pkgdesc="Code as you like, one step ahead, and understand your intelligent code assistant better.(Prebuilt version)"
@@ -43,34 +43,24 @@
     "${pkgname%-bin}.sh"
 )
 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.tar.gz::https://comate-ide.cdn.bcebos.com/download/stable/${_version}/${_pkgname}-linux-x64.tar.gz")
-sha256sums=('a8bc5fd3f812e99060966d24f38295a1b07874e82bb5f28bfa8633b0f173af39'
+sha256sums=('463871c6f4f1ca35328f02d6c81aaeec1d6aa998e4ca5c6c206c39a8f6cf3ae0'
             'df2535dcf1679b8681a27f35a445c08300d34b0336af0dea07f0fbcd5ef5e946'
             '0c8fee636da036e57fcde0385bdc698126c4b179de663ad315e8299d483abc9d'
             '787bf0078b80c66fa5b8191991700afd6e32e9f285cdb32f69791b8894c86fd5'
             '700067aa4b354a91ab3374b5495af9eb3093855a3d8016a8303e88abf3470599')
-sha256sums_x86_64=('cd58013e25bcd8563947e6b73a29ff762e8316d7d0694e3327fc542ac169ad84')
+sha256sums_x86_64=('2a3475ab89a8b7415f24da0e5f8dbb8e6b7da0c7e4cae622a521441ab161e562')
 _get_app_dir() {
     find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
 }
 _check_electron_version() {
     echo "Verifying Electron version..."
-    local _app_dir=$(_get_app_dir)
-    local _main_exe=""
-    if [[ -n "${_app_dir}" ]]; then
-        _main_exe=$(find "${_app_dir}" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -n 1 | cut -d' ' -f2-)
-    fi
-    if [[ -n "${_main_exe}" ]]; then
-        local _elec_ver=$(strings "${_main_exe}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1 | head -n 1)
-        if [[ -n "${_elec_ver}" ]]; then
-            if [[ "${_elec_ver}" != "${_electronversion}" ]]; then
-                echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m"
-            else
-                echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
-            fi
-        fi
-    else
-        echo -e "\033[1;33mNote: Could not find Electron binary for version verification.\033[0m"
-    fi
+    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
+    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
+    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
+    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
+    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
+        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
+        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
 }
 prepare() {
     _check_electron_version

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 11:38:42	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2