cursor-cli

LOW

maintainer ismet 5 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt tarball from the official vendor domain downloads.cursor.com, which is plausibly the project's own release infrastructure; despite the non-whitelisted host, this is a normal distribution method for official binaries, and the download is verified with a b2sum, making the risk low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt tarball from the official vendor domain downloads.cursor.com, which is plausibly the project's own release infrastructure; despite the non-whitelisted host, this is a normal distribution method for official binaries, and the download is verified with a b2sum, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source_x86_64=("cursor-cli-${_upstream_ver}-x86_64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/x64/agent-cli-package.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ismet Togay <ismet.togay at gmail dot com>
    
      2# Contributor: Christopher Cooper <christopher@cg505.com>
    
      3pkgname=cursor-cli
    
      4pkgver=2026.09.10.1.fd3934a
    
      5# Upstream is YYYY.MM.DD-<hash>. pkgver cannot contain hyphens, and hashes are
    
      6# not monotonically ordered, so pkgver is YYYY.MM.DD.<n>.<hash>: n resets to 1
    
      7# on a new date and increments when the same date gets a new hash.
    
      8# Derive the upstream version (YYYY.MM.DD-<hash>) from that pkgver.
    
      9_upstream_ver="${pkgver%.*}"
    
      10_upstream_ver="${_upstream_ver%.*}-${pkgver##*.}"
    
      11pkgrel=1
    
      12# epoch=1: bumped when switching from the original `20250808.0.<sha>` scheme
    
      13# to the current `YYYY.MM.DD.<n>.<hash>` scheme (2025-08-09). Never decrease.
    
      14epoch=1
    
      15pkgdesc="CLI tool for Cursor, the AI-first coding agent"
    
      16arch=('x86_64' 'aarch64')
    
      17url="https://cursor.com/cli"
    
      18license=('LicenseRef-Cursor')
    
      19depends=('gcc-libs' 'git' 'zlib')
    
      20options=('!strip')
    
      21install=cursor-cli.install
    
      22source=('Cursor-TOS'
    
      23        'auto-update-block.patch')
    
      24source_x86_64=("cursor-cli-${_upstream_ver}-x86_64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/x64/agent-cli-package.tar.gz")
    
      25source_aarch64=("cursor-cli-${_upstream_ver}-aarch64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/arm64/agent-cli-package.tar.gz")
    
      26b2sums=('d241ee9895bdb1c17514438fde8528222a8f2326568bd7a033d7a1b11432ce6b4575ff1a50625764bfe6bc6f8a9dc060f7439c3be7e95f8fd02912cdd37a011d'
    
      27        '1928e04c713e13911ea607f84c3e4a2fed1f76af9795503811078f43d2b53c753e28b2233e553fc17e766831800fb0dbc272aad2a80b387f95ba6071d7d4116a')
    
      28b2sums_x86_64=('121c0128fd630565c7000b86ae53bf76e73fd72c1ab8ba2509fae7739b1c7f4bed0587a82137340303ac4704f3344cf63a10eab0e8bea262c8e48bbb21bcb742')
    
      29b2sums_aarch64=('bfc0f540190214396df3cbb93c411ab8055677bc1dd0b0e76d1b914d6c6d90af12519434227ba8b38a38249f1bfe0a8848f47e16dc048b4fa005d366815307be')
    
      30
    
      31prepare() {
    
      32    # Block cursor-agent auto-updates by making its versions directory
    
      33    # non-searchable (chmod -x; see auto-update-block.patch).
    
      34    patch -Np1 -d "${srcdir}/dist-package" -i "${srcdir}/auto-update-block.patch"
    
      35}
    
      36
    
      37package() {
    
      38    install -dm755 "${pkgdir}/opt/cursor-agent"
    
      39    install -dm755 "${pkgdir}/usr/bin"
    
      40
    
      41    # Copy all files from the extracted package (including upstream's
    
      42    # bundled node and rg runtimes).
    
      43    cp -r "${srcdir}"/dist-package/* "${pkgdir}/opt/cursor-agent/"
    
      44
    
      45    # Create symlink in /usr/bin
    
      46    ln -s "/opt/cursor-agent/cursor-agent" "${pkgdir}/usr/bin/cursor-agent"
    
      47
    
      48    # Install license
    
      49    # This is downloaded from https://cursor.com/terms-of-service
    
      50    install -Dm644 Cursor-TOS "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-09-16 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer: Ismet Togay <ismet.togay at gmail dot com>
 # Contributor: Christopher Cooper <christopher@cg505.com>
 pkgname=cursor-cli
-pkgver=2026.08.11.1.e8db854
+pkgver=2026.09.10.1.fd3934a
 # Upstream is YYYY.MM.DD-<hash>. pkgver cannot contain hyphens, and hashes are
 # not monotonically ordered, so pkgver is YYYY.MM.DD.<n>.<hash>: n resets to 1
 # on a new date and increments when the same date gets a new hash.
@@ -14,7 +14,7 @@
 epoch=1
 pkgdesc="CLI tool for Cursor, the AI-first coding agent"
 arch=('x86_64' 'aarch64')
-url="https://cursor.com"
+url="https://cursor.com/cli"
 license=('LicenseRef-Cursor')
 depends=('gcc-libs' 'git' 'zlib')
 options=('!strip')
@@ -25,8 +25,8 @@
 source_aarch64=("cursor-cli-${_upstream_ver}-aarch64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/arm64/agent-cli-package.tar.gz")
 b2sums=('d241ee9895bdb1c17514438fde8528222a8f2326568bd7a033d7a1b11432ce6b4575ff1a50625764bfe6bc6f8a9dc060f7439c3be7e95f8fd02912cdd37a011d'
         '1928e04c713e13911ea607f84c3e4a2fed1f76af9795503811078f43d2b53c753e28b2233e553fc17e766831800fb0dbc272aad2a80b387f95ba6071d7d4116a')
-b2sums_x86_64=('4787401fbdf14e72e5f98cce70db932cdc6cc6030d3b5531adce715f95e1ddc5dfce029e0def8da06d676bbe9c5cc9ed94f49270fe107a0e4b17274716f9dead')
-b2sums_aarch64=('c499a9a75d46c6289d9c9011a72eef70964872aca9f7660406e566e11d188a87d194cfe2133a97a3a461d547b94dd4f2280b4ad9e8a1990ddcaddc78d7897ddc')
+b2sums_x86_64=('121c0128fd630565c7000b86ae53bf76e73fd72c1ab8ba2509fae7739b1c7f4bed0587a82137340303ac4704f3344cf63a10eab0e8bea262c8e48bbb21bcb742')
+b2sums_aarch64=('bfc0f540190214396df3cbb93c411ab8055677bc1dd0b0e76d1b914d6c6d90af12519434227ba8b38a38249f1bfe0a8848f47e16dc048b4fa005d366815307be')
 
 prepare() {
     # Block cursor-agent auto-updates by making its versions directory

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 11:22:36	Medium	1
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3