coze

LOW

maintainer duanluan 0 votes scanned 2026-11-06 16:15:00.299476

View on AUR

Why flagged

Downloads an official macOS DMG from ByteDance/TikTok's CDN (lf3-cdn-tos.bytegoofy.com) with a proper sha256 checksum; the bundled helper scripts (coze.sh, coze.desktop, prepare-app.mjs) have SKIP'd checksums but are local files that only repack/patch the Electron app for Linux — no remote code execution, no exfiltration, just a legitimate unofficial Linux repackaging of a proprietary app from its official CDN.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads an official macOS DMG from ByteDance/TikTok's CDN (lf3-cdn-tos.bytegoofy.com) with a proper sha256 checksum; the bundled helper scripts (coze.sh, coze.desktop, prepare-app.mjs) have SKIP'd checksums but are local files that only repack/patch the Electron app for Linux — no remote code execution, no exfiltration, just a legitimate unofficial Linux repackaging of a proprietary app from its official CDN.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "coze-${pkgver}-mac-x64.dmg::https://lf3-cdn-tos.bytegoofy.com/obj/tron-demo/7617773946401724698/${_buildid}/${pkgver}/darwin-x64/扣子-v${pkgver}-darwin-x64.dmg"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=coze
    
      4pkgver=1.1.48
    
      5pkgrel=1
    
      6pkgdesc='Coze desktop app repackaged from the official macOS release'
    
      7arch=('x86_64')
    
      8url='https://www.coze.cn'
    
      9license=('LicenseRef-Proprietary')
    
      10# Upstream publishes Windows and macOS desktop builds only (verified against
    
      11# its update service, which has no linux target). This repacks the official
    
      12# macOS dmg: the app is a plain Electron bundle whose JS and native modules
    
      13# (koffi, tree-sitter) ship linux-x64 prebuilds, so it runs on the distro
    
      14# electron after prepare-app.mjs patches the few mac-only bits.
    
      15depends=(
    
      16  'electron39'
    
      17  'hicolor-icon-theme'
    
      18  'xdg-utils'
    
      19)
    
      20makedepends=(
    
      21  '7zip'
    
      22  'nodejs'
    
      23)
    
      24conflicts=('coze-bin')
    
      25options=('!strip' '!lto')
    
      26# buildId is a per-release CDN path segment maintained by upstream's update
    
      27# service; update.sh rewrites it together with pkgver.
    
      28_buildid=548159352
    
      29source=(
    
      30  "coze-${pkgver}-mac-x64.dmg::https://lf3-cdn-tos.bytegoofy.com/obj/tron-demo/7617773946401724698/${_buildid}/${pkgver}/darwin-x64/扣子-v${pkgver}-darwin-x64.dmg"
    
      31  'coze.sh'
    
      32  'coze.desktop'
    
      33  'prepare-app.mjs'
    
      34)
    
      35sha256sums=(
    
      36  'dfa89116bd05d7c4c378ea708e657b363d4a75f7fd446f34af66f9250f326a9d'
    
      37  'SKIP'
    
      38  'SKIP'
    
      39  'SKIP'
    
      40)
    
      41
    
      42prepare() {
    
      43  cd "${srcdir}"
    
      44  rm -rf dmg resources coze-icon-*.png
    
      45  mkdir dmg resources
    
      46
    
      47  7z x -bd -y "coze-${pkgver}-mac-x64.dmg" -odmg >/dev/null
    
      48
    
      49  local appdir
    
      50  appdir="$(find dmg -maxdepth 4 -type d -name '*.app' ! -path '*/__MACOSX/*' -print -quit)"
    
      51  [[ -n "${appdir}" ]] || {
    
      52    echo "Could not find the app bundle in upstream dmg"
    
      53    return 1
    
      54  }
    
      55  local resdir="${appdir}/Contents/Resources"
    
      56
    
      57  # app.asar -> resources/app（提取 + Linux 运行修补）+ icns -> PNG 图标
    
      58  node "${srcdir}/prepare-app.mjs" \
    
      59    "${resdir}/app.asar" resources/app \
    
      60    "${resdir}/icon.icns" "${srcdir}/coze-icon"
    
      61
    
      62  # 上游入口在打包布局下要读 resources/manifest.json（mac 版放在框架目录里）
    
      63  install -Dm644 \
    
      64    "${appdir}/Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/manifest.json" \
    
      65    resources/manifest.json
    
      66
    
      67  # coze-daemon / coze-drive 是 Mach-O mac 二进制，Linux 上不打包；
    
      68  # 应用运行时会按平台自行安装对应的小助手。
    
      69  rm -rf "${resdir}/coze-daemon" "${resdir}/coze-drive"
    
      70}
    
      71
    
      72package() {
    
      73  cd "${srcdir}"
    
      74
    
      75  install -dm755 \
    
      76    "${pkgdir}/usr/bin" \
    
      77    "${pkgdir}/usr/lib/${pkgname}/resources" \
    
      78    "${pkgdir}/usr/share/applications" \
    
      79    "${pkgdir}/usr/share/doc/${pkgname}" \
    
      80    "${pkgdir}/usr/share/icons/hicolor/256x256/apps" \
    
      81    "${pkgdir}/usr/share/icons/hicolor/512x512/apps" \
    
      82    "${pkgdir}/usr/share/pixmaps"
    
      83
    
      84  install -Dm755 "${srcdir}/coze.sh" "${pkgdir}/usr/bin/coze"
    
      85
    
      86  cp -a resources/. "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      87
    
      88  install -Dm644 resources/app/package.json \
    
      89    "${pkgdir}/usr/share/doc/${pkgname}/package.json"
    
      90  install -Dm644 "${srcdir}/coze.desktop" \
    
      91    "${pkgdir}/usr/share/applications/coze.desktop"
    
      92
    
      93  install -Dm644 "${srcdir}/coze-icon-512.png" \
    
      94    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
    
      95  install -Dm644 "${srcdir}/coze-icon-256.png" \
    
      96    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
    
      97  install -Dm644 "${srcdir}/coze-icon-512.png" \
    
      98    "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      99}
    
      100

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 16:15:00	Low	3
2026-11-06 16:12:45	Medium	3