comate-bin

LOW

maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt Electron application from a Baidu-owned CDN domain (bcebos.com), which is plausibly the project's official infrastructure; the source is not executed remotely, and the build process only prepares and installs local files.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Electron application from a Baidu-owned CDN domain (bcebos.com), which is plausibly the project's official infrastructure; the source is not executed remotely, and the build process only prepares and installs local files.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:39 "LICENSE-${pkgver}::https://cloud.baidu.com/doc/COMATE/s/glxiygwdx"
PKGBUILD:45 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.tar.gz::https://comate-ide.cdn.bcebos.com/download/stable/${_version}/${_pkgname}-linux-x64.tar.gz")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2#获取版本号及下载地址：
    
      3#https://comate-ide.bj.bcebos.com/updates/stable/linux/arm64/latest.json
    
      4#https://comate-ide.bj.bcebos.com/updates/stable/linux/x64/latest.json
    
      5pkgname=comate-bin
    
      6_pkgname=Comate
    
      7pkgver=3.7.0
    
      8_version=dbe3bb9d65a13a91ebcb1b9d16d028498c0653e8-267429020
    
      9_electronversion=39
    
      10pkgrel=1
    
      11pkgdesc="Code as you like, one step ahead, and understand your intelligent code assistant better.(Prebuilt version)"
    
      12arch=(
    
      13    'x86_64'
    
      14)
    
      15url="https://comate.baidu.com"
    
      16license=('LicenseRef-custom')
    
      17conflicts=("${pkgname%-bin}")
    
      18provides=("${pkgname%-bin}=${pkgver}")
    
      19depends=(
    
      20    "electron${_electronversion}"
    
      21    'nodejs'
    
      22    'python'
    
      23    'python-fonttools'
    
      24    'perl'
    
      25    'libxkbfile'
    
      26    'libsecret'
    
      27    'webkit2gtk-4.1'
    
      28    'python-yaml'
    
      29)
    
      30optdepends=(
    
      31    'bash'
    
      32    'zsh'
    
      33)
    
      34options=(
    
      35    '!emptydirs'
    
      36    '!strip'
    
      37)
    
      38source=(
    
      39    "LICENSE-${pkgver}::https://cloud.baidu.com/doc/COMATE/s/glxiygwdx"
    
      40    "${pkgname%-bin}.js"
    
      41    "${pkgname%-bin}.desktop"
    
      42    "${pkgname%-bin}-url-handler.desktop"
    
      43    "${pkgname%-bin}.sh"
    
      44)
    
      45source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.tar.gz::https://comate-ide.cdn.bcebos.com/download/stable/${_version}/${_pkgname}-linux-x64.tar.gz")
    
      46sha256sums=('e53c134a53b07446e984cf02440f9496cb95f0094076f1fdce865f9ca15efee4'
    
      47            'df2535dcf1679b8681a27f35a445c08300d34b0336af0dea07f0fbcd5ef5e946'
    
      48            '0c8fee636da036e57fcde0385bdc698126c4b179de663ad315e8299d483abc9d'
    
      49            '787bf0078b80c66fa5b8191991700afd6e32e9f285cdb32f69791b8894c86fd5'
    
      50            '700067aa4b354a91ab3374b5495af9eb3093855a3d8016a8303e88abf3470599')
    
      51sha256sums_x86_64=('0d1d443c24404390be895615e305cc36da478e4414fd9e16a373cdeed66426e5')
    
      52_get_app_dir() {
    
      53    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      54}
    
      55_check_electron_version() {
    
      56    echo "Verifying Electron version..."
    
      57    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
    
      58    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
    
      59    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
    
      60    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
    
      61    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
    
      62        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
    
      63        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      64}
    
      65prepare() {
    
      66    _check_electron_version
    
      67    sed -i -e "
    
      68        s/@electronversion@/${_electronversion}/g
    
      69        s/@appname@/${pkgname%-bin}/g
    
      70        s/@runname@/app/g
    
      71        s/@cfgdirname@/${_pkgname}/g
    
      72    " "${srcdir}/${pkgname%-bin}.sh"
    
      73    sed -i "s/@ELECTRON@/electron${_electronversion}/g" "${srcdir}/${pkgname%-bin}.js"
    
      74    # 删除其他平台的预编译 .node 文件
    
      75    local _app_dir=$(_get_app_dir)
    
      76    find "${_app_dir}/resources/app" -path "*/prebuilds/*" \
    
      77        ! -path "*/linux-x64/*" -name "*.node" -delete
    
      78    rm -rf "${_app_dir}/resources/app/extensions/baiducomate.comate/dist/comate-engine/node_modules/tree-sitter-bash/prebuilds/"{win32-x64,win32-arm64,darwin-x64,darwin-arm64}
    
      79    find "${_app_dir}/resources/app" -name "win32-*" -name "*.node" -delete
    
      80    rm -rf "${_app_dir}/resources/app/extensions/preview-dev-tools"
    
      81}
    
      82package() {
    
      83    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      84    install -Dm755 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      85	local _app_dir=$(_get_app_dir)
    
      86	cp -a "${_app_dir}/resources/app/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      87    install -Dm644 "${srcdir}/${_pkgname}-linux-x64/resources/app/resources/linux/code.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
    
      88    install -Dm644 "${srcdir}/${pkgname%-bin}"*.desktop -t "${pkgdir}/usr/share/applications"
    
      89    if [ -x "/usr/bin/bash" ];then
    
      90        install -Dm644 "${srcdir}/${_pkgname}-linux-x64/resources/completions/bash/${pkgname%-bin}" -t "${pkgdir}/usr/share/bash-completion/completions"
    
      91    fi
    
      92    if [ -x "/usr/bin/zsh" ];then
    
      93        install -Dm644 "${srcdir}/${_pkgname}-linux-x64/resources/completions/zsh/_${pkgname%-bin}" -t "${pkgdir}/usr/share/zsh/site-functions"
    
      94    fi
    
      95    install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      96}
    
      97

Changes since previous scan

--- PKGBUILD @ 2026-09-01 00:11
+++ PKGBUILD @ 2026-09-17 00:27
@@ -4,8 +4,8 @@
 #https://comate-ide.bj.bcebos.com/updates/stable/linux/x64/latest.json
 pkgname=comate-bin
 _pkgname=Comate
-pkgver=3.6.0
-_version=e637b9df58e9775b2edb7e5611d79b6f5e59d835-266458711
+pkgver=3.7.0
+_version=dbe3bb9d65a13a91ebcb1b9d16d028498c0653e8-267429020
 _electronversion=39
 pkgrel=1
 pkgdesc="Code as you like, one step ahead, and understand your intelligent code assistant better.(Prebuilt version)"
@@ -43,12 +43,12 @@
     "${pkgname%-bin}.sh"
 )
 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.tar.gz::https://comate-ide.cdn.bcebos.com/download/stable/${_version}/${_pkgname}-linux-x64.tar.gz")
-sha256sums=('c9bc9010f6936dacbad05f7ef4373ee06dc4f013ad8a99892affc3bf51f381ff'
+sha256sums=('e53c134a53b07446e984cf02440f9496cb95f0094076f1fdce865f9ca15efee4'
             'df2535dcf1679b8681a27f35a445c08300d34b0336af0dea07f0fbcd5ef5e946'
             '0c8fee636da036e57fcde0385bdc698126c4b179de663ad315e8299d483abc9d'
             '787bf0078b80c66fa5b8191991700afd6e32e9f285cdb32f69791b8894c86fd5'
             '700067aa4b354a91ab3374b5495af9eb3093855a3d8016a8303e88abf3470599')
-sha256sums_x86_64=('4e3980007708bf0439c50821d7382d3b775bd25212870dfe6f73a673fe41c104')
+sha256sums_x86_64=('0d1d443c24404390be895615e305cc36da478e4414fd9e16a373cdeed66426e5')
 _get_app_dir() {
     find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 09:47:42	Medium	1
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2