kimi-code-desktop-bin

MEDIUM

maintainer colegeming 0 votes scanned 2026-10-24 15:43:26.569175

View on AUR

Why flagged

Prebuilt proprietary Electron binary downloaded from 'code.kimi.com' — a non-standard vendor subdomain that cannot be independently verified as official Kimi/Moonshot infrastructure — with a checksum provided but no way to confirm the binary's authenticity or integrity beyond that hash; the realistic worst case is a silently swapped executable running with setuid chrome-sandbox permissions, though the domain is plausibly the vendor's own release CDN.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_x86_64=("KimiCode-${pkgver}-linux-amd64.deb::https://code.kimi.com/kimi-code/desktop/binaries/1.1.2/KimiCode-1.1.2-linux-amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 65%): Prebuilt proprietary Electron binary downloaded from 'code.kimi.com' — a non-standard vendor subdomain that cannot be independently verified as official Kimi/Moonshot infrastructure — with a checksum provided but no way to confirm the binary's authenticity or integrity beyond that hash; the realistic worst case is a silently swapped executable running with setuid chrome-sandbox permissions, though the domain is plausibly the vendor's own release CDN.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: colegeming <collegeming@outlook.com>
    
      2
    
      3pkgname=kimi-code-desktop-bin
    
      4pkgver=1.1.2
    
      5pkgrel=1
    
      6pkgdesc='Kimi Code Desktop - GUI client for the Kimi Code agent (prebuilt binary)'
    
      7arch=('x86_64')
    
      8url='https://kimi.com/code'
    
      9license=('LicenseRef-proprietary')
    
      10# The vendor's Debian Depends/Recommends, translated to Arch names. libuuid1
    
      11# maps to util-linux, which is in base, so it is left out.
    
      12depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'libsecret'
    
      13         'at-spi2-core' 'xdg-utils')
    
      14optdepends=('libappindicator-gtk3: tray icon')
    
      15options=('!strip')
    
      16# Repackaged, not rebuilt: packaging the app is the vendor's job, and it loads
    
      17# its bundled Electron runtime from this exact /opt path. The local filename is
    
      18# version-tagged so makepkg's SRCDEST cannot hand back the previous version's
    
      19# .deb under a version-independent vendor name.
    
      20source_x86_64=("KimiCode-${pkgver}-linux-amd64.deb::https://code.kimi.com/kimi-code/desktop/binaries/1.1.2/KimiCode-1.1.2-linux-amd64.deb")
    
      21sha512sums_x86_64=('90374e5d2acdc47e35eadbd1167794e36477b125fbe0c56b62e76163bee2dd0d3c5c6867634f6563abdca91ea3515a146014ccce6ac52a4001949416e4cd6947')
    
      22# Keep makepkg from unpacking the .deb itself (bsdtar would scatter its ar
    
      23# members across $srcdir); package() unpacks data.tar deliberately.
    
      24noextract=("KimiCode-${pkgver}-linux-amd64.deb")
    
      25# The .deb also carries an AppArmor profile that exists to re-enable user
    
      26# namespaces under Ubuntu's restriction; Arch has no such restriction, so
    
      27# shipping it would only confuse apparmor_parser.
    
      28
    
      29package() {
    
      30    install -d "${srcdir}/deb"
    
      31    bsdtar -xf "${srcdir}/KimiCode-${pkgver}-linux-amd64.deb" -C "${srcdir}/deb"
    
      32    bsdtar -xf "${srcdir}/deb/"data.tar.* -C "${pkgdir}"
    
      33
    
      34    # `/opt/Kimi Code` (space included) is where the bundled Electron looks for
    
      35    # its resources. Electron refuses to start unless the sandbox helper is
    
      36    # root-owned setuid when user namespaces are unavailable -- the vendor's
    
      37    # postinst sets 4755 for exactly that case, and the bit is simply unused
    
      38    # where namespaces do work.
    
      39    install -d "${pkgdir}/usr/bin"
    
      40    ln -s "/opt/Kimi Code/kimi-code" "${pkgdir}/usr/bin/kimi-code"
    
      41    chmod 4755 "${pkgdir}/opt/Kimi Code/chrome-sandbox"
    
      42
    
      43    # The Electron/Chromium notices ship inside the app directory; link them
    
      44    # rather than duplicating 20 MB under /usr/share/licenses.
    
      45    install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      46    ln -s "/opt/Kimi Code/LICENSE.electron.txt" \
    
      47        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      48    ln -s "/opt/Kimi Code/LICENSES.chromium.html" \
    
      49        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 15:43:26	Medium	3
2026-10-24 15:40:54	Medium	3