cursor-cli

LOW

maintainer ismet 5 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt tarball from the official vendor domain downloads.cursor.com, which is plausibly the project's own release infrastructure; despite the non-whitelisted host, the source is verifiable and checksummed, and the worst case of a supply-chain compromise is limited to executing vendor-uploaded code, which is expected in this context.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt tarball from the official vendor domain downloads.cursor.com, which is plausibly the project's own release infrastructure; despite the non-whitelisted host, the source is verifiable and checksummed, and the worst case of a supply-chain compromise is limited to executing vendor-uploaded code, which is expected in this context.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source_x86_64=("cursor-cli-${_upstream_ver}-x86_64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/x64/agent-cli-package.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ismet Togay <ismet.togay at gmail dot com>
    
      2# Contributor: Christopher Cooper <christopher@cg505.com>
    
      3pkgname=cursor-cli
    
      4pkgver=2026.10.19.1.6bbf2c4
    
      5# Upstream is YYYY.MM.DD-<hash>. pkgver cannot contain hyphens, and hashes are
    
      6# not monotonically ordered, so pkgver is YYYY.MM.DD.<n>.<hash>: n resets to 1
    
      7# on a new date and increments when the same date gets a new hash.
    
      8# Derive the upstream version (YYYY.MM.DD-<hash>) from that pkgver.
    
      9_upstream_ver="${pkgver%.*}"
    
      10_upstream_ver="${_upstream_ver%.*}-${pkgver##*.}"
    
      11pkgrel=1
    
      12# epoch=1: bumped when switching from the original `20250808.0.<sha>` scheme
    
      13# to the current `YYYY.MM.DD.<n>.<hash>` scheme (2025-08-09). Never decrease.
    
      14epoch=1
    
      15pkgdesc="CLI tool for Cursor, the AI-first coding agent"
    
      16arch=('x86_64' 'aarch64')
    
      17url="https://cursor.com/cli"
    
      18license=('LicenseRef-Cursor')
    
      19depends=('gcc-libs' 'git' 'zlib')
    
      20options=('!strip')
    
      21install=cursor-cli.install
    
      22source=('Cursor-TOS'
    
      23        'auto-update-block.patch')
    
      24source_x86_64=("cursor-cli-${_upstream_ver}-x86_64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/x64/agent-cli-package.tar.gz")
    
      25source_aarch64=("cursor-cli-${_upstream_ver}-aarch64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/arm64/agent-cli-package.tar.gz")
    
      26b2sums=('f1dbf9263b11fa275baa3e192de3e29855262dd7d538aa3fd73d28a0e1e3c9b917ae1957e4b3a414e7492edc8f645255ad3df1fdbe83ad67a1c0d8913c141690'
    
      27        '1928e04c713e13911ea607f84c3e4a2fed1f76af9795503811078f43d2b53c753e28b2233e553fc17e766831800fb0dbc272aad2a80b387f95ba6071d7d4116a')
    
      28b2sums_x86_64=('60ccdfddb84a3ed54d5eb31dba1d493875e9c00f8274ef478b05cd6f4309683acd7031e478533fbcf47cd14f92174beff6d3b8cdf173e4c6d7509fdc7cdac8ee')
    
      29b2sums_aarch64=('97748f0a5939d684bdae2c2dc8be2b4943a5edbd6c6c053b19732453c6f54ddb5c59cb5616a7097032b1e2efb6d342b2faa916eda2be28bc0866096cc14d3c79')
    
      30
    
      31prepare() {
    
      32    # Block cursor-agent auto-updates by making its versions directory
    
      33    # non-searchable (chmod -x; see auto-update-block.patch).
    
      34    patch -Np1 -d "${srcdir}/dist-package" -i "${srcdir}/auto-update-block.patch"
    
      35}
    
      36
    
      37package() {
    
      38    install -dm755 "${pkgdir}/opt/cursor-agent"
    
      39    install -dm755 "${pkgdir}/usr/bin"
    
      40
    
      41    # Copy all files from the extracted package (including upstream's
    
      42    # bundled node and rg runtimes).
    
      43    cp -r "${srcdir}"/dist-package/* "${pkgdir}/opt/cursor-agent/"
    
      44
    
      45    # Create symlink in /usr/bin
    
      46    ln -s "/opt/cursor-agent/cursor-agent" "${pkgdir}/usr/bin/cursor-agent"
    
      47
    
      48    # Install license
    
      49    # This is downloaded from https://cursor.com/terms-of-service
    
      50    install -Dm644 Cursor-TOS "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Ismet Togay <ismet.togay at gmail dot com>
 # Contributor: Christopher Cooper <christopher@cg505.com>
 pkgname=cursor-cli
-pkgver=2026.10.16.1.e3cb207
+pkgver=2026.10.19.1.6bbf2c4
 # Upstream is YYYY.MM.DD-<hash>. pkgver cannot contain hyphens, and hashes are
 # not monotonically ordered, so pkgver is YYYY.MM.DD.<n>.<hash>: n resets to 1
 # on a new date and increments when the same date gets a new hash.
@@ -23,10 +23,10 @@
         'auto-update-block.patch')
 source_x86_64=("cursor-cli-${_upstream_ver}-x86_64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/x64/agent-cli-package.tar.gz")
 source_aarch64=("cursor-cli-${_upstream_ver}-aarch64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/arm64/agent-cli-package.tar.gz")
-b2sums=('d241ee9895bdb1c17514438fde8528222a8f2326568bd7a033d7a1b11432ce6b4575ff1a50625764bfe6bc6f8a9dc060f7439c3be7e95f8fd02912cdd37a011d'
+b2sums=('f1dbf9263b11fa275baa3e192de3e29855262dd7d538aa3fd73d28a0e1e3c9b917ae1957e4b3a414e7492edc8f645255ad3df1fdbe83ad67a1c0d8913c141690'
         '1928e04c713e13911ea607f84c3e4a2fed1f76af9795503811078f43d2b53c753e28b2233e553fc17e766831800fb0dbc272aad2a80b387f95ba6071d7d4116a')
-b2sums_x86_64=('f931b4bdfc4610bb54c061f0bb56cb2efae5558a75a2ffff8c10e5c5726f4b7011a52402c90246465f120a3f8b721ebde189d3ad54a14f9c6e6a9cd435f84cd8')
-b2sums_aarch64=('eb20029c48d442f3b40f46bded0e3629c6ca262d92c387d95321e26f7b754c8d4565946c0a20109affee9ea78ea2be364eda18df7ba919343cba3685f1a4443e')
+b2sums_x86_64=('60ccdfddb84a3ed54d5eb31dba1d493875e9c00f8274ef478b05cd6f4309683acd7031e478533fbcf47cd14f92174beff6d3b8cdf173e4c6d7509fdc7cdac8ee')
+b2sums_aarch64=('97748f0a5939d684bdae2c2dc8be2b4943a5edbd6c6c053b19732453c6f54ddb5c59cb5616a7097032b1e2efb6d342b2faa916eda2be28bc0866096cc14d3c79')
 
 prepare() {
     # Block cursor-agent auto-updates by making its versions directory

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 19:36:04	Medium	1
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 09:27:54	Medium	1
2026-10-20 00:10:31	Low	2
2026-10-19 19:26:12	Medium	1
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 23:20:05	Medium	1
2026-10-17 00:21:55	Low	2