kimi-bin
maintainer AsukaMinato
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a proprietary Windows installer from the official Kimi/Moonshot CDN (kimi-img.moonshot.cn) and a GitHub release asset for better-sqlite3, both with explicit SHA256 checksums; it repackages the app for the system Electron runtime with no obfuscated payloads, no exfiltration, and no redirection of upstream endpoints — the only mild concern is the non-whitelisted but plausibly official CDN host and the bundled local files (LICENSE, daimon, kimi.sh, kimi.desktop) whose contents cannot be verified from the PKGBUILD alone.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package downloads a proprietary Windows installer from the official Kimi/Moonshot CDN (kimi-img.moonshot.cn) and a GitHub release asset for better-sqlite3, both with explicit SHA256 checksums; it repackages the app for the system Electron runtime with no obfuscated payloads, no exfiltration, and no redirection of upstream endpoints — the only mild concern is the non-whitelisted but plausibly official CDN host and the bundled local files (LICENSE, daimon, kimi.sh, kimi.desktop) whose contents cannot be verified from the PKGBUILD alone.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
"kimi_${pkgver}.exe::https://kimi-img.moonshot.cn/app/upgrade/Kimi-Setup-${pkgver}.exe"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AUR package maintainer
2
3
pkgname=kimi-bin
4
pkgver=3.0.18
5
pkgrel=1
6
pkgdesc='Kimi desktop client, repackaged for the system Electron runtime'
7
arch=('x86_64')
8
url='https://www.kimi.com/'
9
license=('LicenseRef-proprietary')
10
depends=('electron41' 'git' 'python' 'uv')
11
makedepends=('7zip' 'asar')
12
provides=('kimi')
13
conflicts=('kimi')
14
options=('!strip')
15
source=(
16
'LICENSE'
17
'daimon'
18
'kimi.desktop'
19
'kimi.sh'
20
)
21
source_x86_64=(
22
"kimi_${pkgver}.exe::https://kimi-img.moonshot.cn/app/upgrade/Kimi-Setup-${pkgver}.exe"
23
'better-sqlite3-v12.8.0-electron-v145-linux-x64.tar.gz::https://github.com/WiseLibs/better-sqlite3/releases/download/v12.8.0/better-sqlite3-v12.8.0-electron-v145-linux-x64.tar.gz'
24
)
25
noextract=("kimi_${pkgver}.exe")
26
sha256sums=('3d0ecc0dd3c31a9aaa58f4be041e10c9850e85505975642a40be1aea39ed9587'
27
'a50cb2d9d215fa61a62daa55ba4f555a3b12330b1f35d70327855d11f1360544'
28
'256891c355a265625e641c637d611ad401d3714f0e46b063346caafd802949e7'
29
'7d85bbea6f043c28474aaa6a33b5a9acb2c0ca3c5bdc1b74977cce9394579a50')
30
sha256sums_x86_64=('82deb1db0a21b540af236632c04aad50d71f982b3b768d6c0418fb0d271e0128'
31
'6a818b219018175261e1c0e9cd8f7de52d89ed9b4d2f97173e1b255b30a1db88')
32
33
prepare() {
34
rm -rf "${srcdir}/nsis" "${srcdir}/payload" "${srcdir}/app" \
35
"${srcdir}/daimon-bundle"
36
mkdir -p "${srcdir}/nsis" "${srcdir}/payload" \
37
"${srcdir}/daimon-bundle"
38
39
7z x -y "${srcdir}/kimi_${pkgver}.exe" -o"${srcdir}/nsis"
40
7z x -y "${srcdir}/nsis/\$PLUGINSDIR/app-64.7z" -o"${srcdir}/payload"
41
asar extract "${srcdir}/payload/resources/app.asar" "${srcdir}/app"
42
tar -xzf "${srcdir}/payload/resources/resources/daimon-bundle.tar.gz" \
43
-C "${srcdir}/daimon-bundle" \
44
./app/daimon \
45
./release \
46
./bundle.json \
47
./.daimon-bundle-stamp
48
49
install -Dm755 "${srcdir}/daimon" \
50
"${srcdir}/daimon-bundle/bin/daimon"
51
tar -xzf \
52
"${srcdir}/better-sqlite3-v12.8.0-electron-v145-linux-x64.tar.gz" \
53
-C "${srcdir}/daimon-bundle/app/daimon/node_modules/better-sqlite3"
54
55
local renderer="${srcdir}/app/out/renderer/assets/common-CEwlbJLP.js"
56
local main="${srcdir}/app/out/main/index.js"
57
58
# Updates for an AUR package must be handled by pacman, not electron-updater.
59
sed -i 's/^ setupAutoUpdater();$/ \/\* Updates are managed by pacman. \*\//' "${main}"
60
61
# Windows executables cannot run under the system Linux Electron runtime.
62
find "${srcdir}/app" "${srcdir}/daimon-bundle" \
63
-type f -iname '*.exe' -delete
64
find "${srcdir}/app" "${srcdir}/daimon-bundle" -type f \( \
65
-iname '*.ts' -o \
66
-iname '*.mts' -o \
67
-iname '*.cts' -o \
68
-iname '*.tsx' \
69
\) -delete
70
71
# Remove direct development-only packages. The desktop manifest incorrectly
72
# places its build tooling in dependencies; none of these are referenced by
73
# the compiled main/renderer output. Daimon's actual devDependencies are
74
# listed explicitly as well, even though the upstream production bundle
75
# currently omits most of them.
76
rm -rf \
77
"${srcdir}/app/node_modules/@sentry/vite-plugin" \
78
"${srcdir}/app/node_modules/@types/js-yaml" \
79
"${srcdir}/app/node_modules/ts-expect" \
80
"${srcdir}/app/node_modules/tsx" \
81
"${srcdir}/app/node_modules/@sentry/babel-plugin-component-annotate" \
82
"${srcdir}/app/node_modules/@sentry/bundler-plugin-core" \
83
"${srcdir}/app/node_modules/@sentry/cli" \
84
"${srcdir}/app/node_modules/@sentry/rollup-plugin" \
85
"${srcdir}/app/node_modules/@rollup" \
86
"${srcdir}/app/node_modules/@esbuild" \
87
"${srcdir}/app/node_modules/esbuild" \
88
"${srcdir}/app/node_modules/get-tsconfig" \
89
"${srcdir}/app/node_modules/resolve-pkg-maps" \
90
"${srcdir}/app/node_modules/rollup" \
91
"${srcdir}/daimon-bundle/app/daimon/node_modules/@types/better-sqlite3" \
92
"${srcdir}/daimon-bundle/app/daimon/node_modules/@types/node" \
93
"${srcdir}/daimon-bundle/app/daimon/node_modules/@types/proper-lockfile" \
94
"${srcdir}/daimon-bundle/app/daimon/node_modules/@types/react" \
95
"${srcdir}/daimon-bundle/app/daimon/node_modules/javascript-obfuscator" \
96
"${srcdir}/daimon-bundle/app/daimon/node_modules/terser"
97
find "${srcdir}/app/node_modules/@babel" \
98
-mindepth 1 -maxdepth 1 -type d ! -name runtime \
99
-exec rm -rf {} +
100
sed -i \
101
-e '/ "@sentry\/vite-plugin":/d' \
102
-e '/ "@types\/js-yaml":/d' \
103
-e '/ "ts-expect":/d' \
104
-e '/ "tsx":/d' \
105
"${srcdir}/app/package.json"
106
sed -i \
107
'/^ "devDependencies": {$/,/^ },$/d' \
108
"${srcdir}/daimon-bundle/app/daimon/package.json"
109
110
# These two ZipApps contain identical files; only their ZIP timestamps differ.
111
# Store one inode while keeping both paths expected by the two PPTX skills.
112
local pptx_pyz="${srcdir}/daimon-bundle/app/daimon/assets/builtin-skills/pptx/scripts/kimi_ppt_dsl.pyz"
113
local swarm_pyz="${srcdir}/daimon-bundle/app/daimon/assets/builtin-skills/pptx-swarm/scripts/kimi_ppt_dsl.pyz"
114
rm -f "${swarm_pyz}"
115
ln "${pptx_pyz}" "${swarm_pyz}"
116
117
asar pack "${srcdir}/app" "${srcdir}/kimi.asar"
118
}
119
120
package() {
121
install -Dm644 "${srcdir}/kimi.asar" \
122
"${pkgdir}/usr/lib/kimi/app.asar"
123
install -d "${pkgdir}/usr/lib/kimi/daimon-bundle"
124
cp -a "${srcdir}/daimon-bundle/." \
125
"${pkgdir}/usr/lib/kimi/daimon-bundle/"
126
install -Dm755 "${srcdir}/kimi.sh" \
127
"${pkgdir}/usr/bin/kimi"
128
install -Dm644 "${srcdir}/kimi.desktop" \
129
"${pkgdir}/usr/share/applications/kimi.desktop"
130
install -Dm644 "${srcdir}/app/assets/icon.png" \
131
"${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/kimi.png"
132
install -Dm644 "${srcdir}/LICENSE" \
133
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
134
}
135
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 07:26:02 | LOW | 3 |
| 2026-07-23 07:22:42 | MEDIUM | 3 |