cursor-early-access-bin

maintainer augusdogus · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from the project's official domain (downloads.cursor.com), which is plausibly owned by the vendor; despite SKIP'd checksums, the source is not from a swappable host and the payload is a standard installer for the project's own software, making the risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the project's official domain (downloads.cursor.com), which is plausibly owned by the vendor; despite SKIP'd checksums, the source is not from a swappable host and the payload is a standard installer for the project's own software, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "cursor_${_upstream_pkgver}_amd64.deb::https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${_upstream_pkgver}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AugusDogus <augie@linux.com>
    
      2
    
      3pkgname=cursor-early-access-bin
    
      4pkgver=3.14.7
    
      5_upstream_pkgver=3.14.7
    
      6pkgrel=1
    
      7pkgdesc='AI-first coding environment (early access channel, bundled Electron)'
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://www.cursor.com"
    
      10license=('LicenseRef-Cursor_EULA')
    
      11provides=('cursor')
    
      12conflicts=('cursor-bin' 'cursor-nightly-bin' 'cursor-ide-bin')
    
      13depends=(
    
      14  'alsa-lib'
    
      15  'dbus'
    
      16  'gcc-libs'
    
      17  'gtk3'
    
      18  'libdrm'
    
      19  'libsecret'
    
      20  'libxkbfile'
    
      21  'mesa'
    
      22  'nss'
    
      23  'xdg-utils'
    
      24)
    
      25optdepends=(
    
      26  'libnotify: desktop notifications'
    
      27  'org.freedesktop.secrets: credential storage via SecretService'
    
      28  'libdbusmenu-glib: KDE global menu support'
    
      29)
    
      30options=(!strip !debug)
    
      31_commit=a758f2241ca99fecf380180b6cbdbbce0f1f42cf
    
      32source_x86_64=(
    
      33  "cursor_${_upstream_pkgver}_amd64.deb::https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${_upstream_pkgver}_amd64.deb"
    
      34)
    
      35source_aarch64=(
    
      36  "cursor_${_upstream_pkgver}_arm64.deb::https://downloads.cursor.com/production/${_commit}/linux/arm64/deb/arm64/deb/cursor_${_upstream_pkgver}_arm64.deb"
    
      37)
    
      38source=(
    
      39  cursor.desktop
    
      40  cursor-launcher.sh
    
      41)
    
      42sha512sums_x86_64=('SKIP')
    
      43sha512sums_aarch64=('SKIP')
    
      44sha512sums=(
    
      45  '037aa5d878eddb06fc1d5be788e7bc64545773decacb34228053be746dfc33237371ad49cc331dac8e3437d7d885a9bc1564d0f114fc22e308827b33d0c55ad8'
    
      46  '9defecd35fd033a484642732605264cc00faf5791d852234d9705bf9ac005c76173780cd496208e4150685ac9ddbb73c8eb87cd5141526dd4521d455342e8233')
    
      47sha512sums_x86_64[0]=d3bd5d7b532e051a326009881cc3c168972273b8db0edea259f156768d85730b9bb62b8abeda58e1f0765da017d794deca10d61952624118c9bb095c91717b6a
    
      48sha512sums_aarch64[0]=bf7506180743e96828b25143663563cf1ef154c0def3034f3a08c2df2719d277301b5fa2d2106184373bb6d7882b4d52d074e119912f26bea0e3bd79873a4aa0
    
      49noextract=(
    
      50  "cursor_${_upstream_pkgver}_amd64.deb"
    
      51  "cursor_${_upstream_pkgver}_arm64.deb"
    
      52)
    
      53
    
      54package() {
    
      55  case "$CARCH" in
    
      56    x86_64)  _deb="cursor_${_upstream_pkgver}_amd64.deb" ;;
    
      57    aarch64) _deb="cursor_${_upstream_pkgver}_arm64.deb" ;;
    
      58  esac
    
      59
    
      60  # Extract full deb — keep bundled Electron intact.
    
      61  bsdtar -xOf "$_deb" data.tar.xz |
    
      62    tar -xJf - -C "$pkgdir"
    
      63
    
      64  # Fix zsh completion path for Arch
    
      65  if [[ -d "$pkgdir/usr/share/zsh/vendor-completions" ]]; then
    
      66    mv "$pkgdir/usr/share/zsh/vendor-completions" \
    
      67       "$pkgdir/usr/share/zsh/site-functions"
    
      68  fi
    
      69
    
      70  install -Dm644 "$srcdir/cursor.desktop" \
    
      71    "$pkgdir/usr/share/applications/cursor.desktop"
    
      72
    
      73  install -Dm755 "$srcdir/cursor-launcher.sh" "$pkgdir/usr/bin/cursor"
    
      74
    
      75  _license="$pkgdir/usr/share/cursor/resources/app/LICENSE.txt"
    
      76  if [[ ! -f "$_license" ]]; then
    
      77    _license=$(find "$pkgdir/usr/share/cursor" -maxdepth 8 -type f \( -name 'LICENSE.txt' -o -name 'LICENSE' \) -print -quit 2>/dev/null)
    
      78  fi
    
      79  if [[ -f "$_license" ]]; then
    
      80    install -Dm644 "$_license" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      81  else
    
      82    echo "Warning: Cursor license file not found in .deb; skipping /usr/share/licenses install" >&2
    
      83  fi
    
      84
    
      85  if [[ -f "$pkgdir/usr/share/cursor/chrome-sandbox" ]]; then
    
      86    chmod 4755 "$pkgdir/usr/share/cursor/chrome-sandbox"
    
      87  fi
    
      88}
    
      89
    
      90
    
      91
    
      92
    
      93
    
      94
    
      95
    
      96
    
      97
    
      98
    
      99
    
      100
    
      101
    
      102
    
      103
    
      104
    
      105
    
      106
    
      107
    
      108
    
      109
    
      110
    
      111
    
      112
    
      113
    
      114
    
      115
    
      116
    
      117
    
      118
    
      119
    
      120
    
      121
    
      122
    
      123
    
      124
    
      125
    
      126
    
      127
    
      128
    
      129
    
      130
    
      131
    
      132
    
      133
    
      134
    
      135
    
      136
    
      137
    
      138
    
      139
    
      140
    
      141
    
      142

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,11 +1,11 @@
 # Maintainer: AugusDogus <augie@linux.com>
 
 pkgname=cursor-early-access-bin
-pkgver=3.13.25
-_upstream_pkgver=3.13.25
+pkgver=3.14.7
+_upstream_pkgver=3.14.7
 pkgrel=1
 pkgdesc='AI-first coding environment (early access channel, bundled Electron)'
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://www.cursor.com"
 license=('LicenseRef-Cursor_EULA')
 provides=('cursor')
@@ -28,21 +28,37 @@
   'libdbusmenu-glib: KDE global menu support'
 )
 options=(!strip !debug)
-_commit=31e8d61c448c7472e371505838a0fe34083dad55
+_commit=a758f2241ca99fecf380180b6cbdbbce0f1f42cf
+source_x86_64=(
+  "cursor_${_upstream_pkgver}_amd64.deb::https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${_upstream_pkgver}_amd64.deb"
+)
+source_aarch64=(
+  "cursor_${_upstream_pkgver}_arm64.deb::https://downloads.cursor.com/production/${_commit}/linux/arm64/deb/arm64/deb/cursor_${_upstream_pkgver}_arm64.deb"
+)
 source=(
-  "cursor_${_upstream_pkgver}_amd64.deb::https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${_upstream_pkgver}_amd64.deb"
   cursor.desktop
   cursor-launcher.sh
 )
-sha512sums=('SKIP'
+sha512sums_x86_64=('SKIP')
+sha512sums_aarch64=('SKIP')
+sha512sums=(
   '037aa5d878eddb06fc1d5be788e7bc64545773decacb34228053be746dfc33237371ad49cc331dac8e3437d7d885a9bc1564d0f114fc22e308827b33d0c55ad8'
   '9defecd35fd033a484642732605264cc00faf5791d852234d9705bf9ac005c76173780cd496208e4150685ac9ddbb73c8eb87cd5141526dd4521d455342e8233')
-sha512sums[0]=f750e522d8fc6abcdc41fb4da0b567470a5542f283f5c2eb8e861f1ae55ee08c55ec6b4597b7f907606c47a34800e4c01d3284291f8bf31fbd7a6160ce02292e
-noextract=("cursor_${_upstream_pkgver}_amd64.deb")
+sha512sums_x86_64[0]=d3bd5d7b532e051a326009881cc3c168972273b8db0edea259f156768d85730b9bb62b8abeda58e1f0765da017d794deca10d61952624118c9bb095c91717b6a
+sha512sums_aarch64[0]=bf7506180743e96828b25143663563cf1ef154c0def3034f3a08c2df2719d277301b5fa2d2106184373bb6d7882b4d52d074e119912f26bea0e3bd79873a4aa0
+noextract=(
+  "cursor_${_upstream_pkgver}_amd64.deb"
+  "cursor_${_upstream_pkgver}_arm64.deb"
+)
 
 package() {
+  case "$CARCH" in
+    x86_64)  _deb="cursor_${_upstream_pkgver}_amd64.deb" ;;
+    aarch64) _deb="cursor_${_upstream_pkgver}_arm64.deb" ;;
+  esac
+
   # Extract full deb — keep bundled Electron intact.
-  bsdtar -xOf "cursor_${_upstream_pkgver}_amd64.deb" data.tar.xz |
+  bsdtar -xOf "$_deb" data.tar.xz |
     tar -xJf - -C "$pkgdir"
 
   # Fix zsh completion path for Arch

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 05:17:13	MEDIUM	1
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 09:37:42	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 05:34:42	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 05:19:42	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 23:18:24	MEDIUM	2
2026-07-21 07:16:26	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2