command-code-desktop

LOW

maintainer ismet 1 votes scanned 2026-09-27 17:19:13.301701

View on AUR

Why flagged

The package installs a prebuilt Electron app from GitHub Releases, which is a common and generally acceptable practice; the source is verifiable via checksum, and no remote code execution or obfuscation is present, though the lack of source compilation and low votes slightly increase supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt Electron app from GitHub Releases, which is a common and generally acceptable practice; the source is verifiable via checksum, and no remote code execution or obfuscation is present, though the lack of source compilation and low votes slightly increase supply-chain risk.

PKGBUILD

      1# Maintainer: Fahim Montasir Misbah <fahim@scirex.me>
    
      2# Maintainer: Ismet Togay <ismet.togay at gmail dot com>
    
      3
    
      4pkgname=command-code-desktop
    
      5pkgver=0.1.41
    
      6pkgrel=1
    
      7pkgdesc="Desktop app for Command Code, an AI coding agent that learns your coding taste"
    
      8arch=('x86_64')
    
      9url="https://commandcode.ai/desktop"
    
      10license=('LicenseRef-command-code')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'at-spi2-core'
    
      14  'gtk3'
    
      15  'hicolor-icon-theme'
    
      16  'libnotify'
    
      17  'libsecret'
    
      18  'mesa'
    
      19  'nss'
    
      20  'xdg-utils'
    
      21)
    
      22optdepends=('git: repository status and diffs')
    
      23conflicts=('commandcode-bin')
    
      24replaces=('commandcode-bin')
    
      25options=('!strip')
    
      26install=command-code-desktop.install
    
      27# License = upstream ToS (https://commandcode.ai/terms); none shipped in source
    
      28source=("${pkgname}-${pkgver}.deb::https://github.com/CommandCodeAI/desktop/releases/download/v${pkgver}/CommandCode-${pkgver}-amd64.deb"
    
      29        "LICENSE-command-code")
    
      30sha256sums=('a0c0b3d1dec64943e078ab93b06b10147c7ac5f199f84b1623f447aeea5060ad'
    
      31            '0ecb7f651dd3c281515717e87240db1e417cd846cd521b4661512868d2f03768')
    
      32
    
      33package() {
    
      34  bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}"
    
      35
    
      36  # Disable the Electron updater
    
      37  sed -i 's|"updateFeed": "public"|"updateFeed": "none"|' \
    
      38    "${pkgdir}/opt/Command Code/resources/app/package.json"
    
      39  grep -q '"updateFeed": "none"' "${pkgdir}/opt/Command Code/resources/app/package.json"
    
      40
    
      41  # Wrapper that disables the app's self-updater (updates come from pacman)
    
      42  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/command-code-desktop" <<'EOF'
    
      43#!/bin/sh
    
      44# Self-update disabled; updates via pacman only
    
      45export CMD_DISABLE_AUTO_UPDATE=1
    
      46export COMMANDCODE_SKIP_UPDATES=1
    
      47exec "/opt/Command Code/command-code" "$@"
    
      48EOF
    
      49
    
      50  # Point desktop entry at the wrapper (upstream Exec calls /opt directly)
    
      51  sed -i 's|^Exec="/opt/Command Code/command-code"|Exec=command-code-desktop|' \
    
      52    "${pkgdir}/usr/share/applications/command-code.desktop"
    
      53  grep -qx 'Exec=command-code-desktop %U' \
    
      54    "${pkgdir}/usr/share/applications/command-code.desktop"
    
      55
    
      56  # Install only this package's license; bundled Electron/Chromium licenses stay in /opt
    
      57  install -Dm644 "${srcdir}/LICENSE-command-code" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      58
    
      59  # Drop FPM's stub changelog (rm -rf won't fail if upstream removes it)
    
      60  rm -rf "${pkgdir}/usr/share/doc"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 17:19:13	Low	2