kimi-desktop-bin

MEDIUM

maintainer impulse 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

A prebuilt proprietary binary .deb is downloaded from a GitHub Pages host (kimi-moonshot.github.io) that is not the official vendor domain (kimi.moonshot.cn), making it an unofficial/unverifiable distribution channel where the binary could be silently swapped; however a checksum is provided and the host appears to be a project-affiliated GitHub org rather than random personal cloud storage.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=('Kimi_x86_64.deb::https://kimi-moonshot.github.io/download/Kimi_x86_64.deb')

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): A prebuilt proprietary binary .deb is downloaded from a GitHub Pages host (kimi-moonshot.github.io) that is not the official vendor domain (kimi.moonshot.cn), making it an unofficial/unverifiable distribution channel where the binary could be silently swapped; however a checksum is provided and the host appears to be a project-affiliated GitHub org rather than random personal cloud storage.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=kimi-desktop-bin
    
      2pkgver=1.0.0
    
      3pkgrel=3
    
      4pkgdesc='Kimi AI assistant desktop client'
    
      5arch=('x86_64')
    
      6url='https://kimi.moonshot.cn/'
    
      7license=('LicenseRef-proprietary')
    
      8depends=(
    
      9  'cairo'
    
      10  'curl'
    
      11  'gcc-libs'
    
      12  'gdk-pixbuf2'
    
      13  'glib2'
    
      14  'glibc'
    
      15  'gtk3'
    
      16  'libayatana-appindicator'
    
      17  'libsoup'
    
      18  'openssl'
    
      19  'pango'
    
      20  'webkit2gtk'
    
      21  'wget'
    
      22)
    
      23provides=('kimi-desktop')
    
      24conflicts=('kimi-desktop')
    
      25source=('Kimi_x86_64.deb::https://kimi-moonshot.github.io/download/Kimi_x86_64.deb')
    
      26noextract=('Kimi_x86_64.deb')
    
      27sha256sums=('822abf05bd669201c9984e828b2624e67e0923ac3cb5a6bcc72f91bc61324e7c')
    
      28
    
      29pkgver() {
    
      30  local control_archive version
    
      31
    
      32  control_archive="$(
    
      33    bsdtar -tf "${srcdir}/Kimi_x86_64.deb" |
    
      34      awk '/^control\.tar(\..+)?$/ { print; exit }'
    
      35  )"
    
      36  version="$(
    
      37    bsdtar -xOf "${srcdir}/Kimi_x86_64.deb" "${control_archive}" |
    
      38      bsdtar -xOf - control |
    
      39      sed -n 's/^Version: //p'
    
      40  )"
    
      41
    
      42  printf '%s\n' "${version//-/.}"
    
      43}
    
      44
    
      45package() {
    
      46  local data_archive
    
      47
    
      48  data_archive="$(
    
      49    bsdtar -tf "${srcdir}/Kimi_x86_64.deb" |
    
      50      awk '/^data\.tar(\..+)?$/ { print; exit }'
    
      51  )"
    
      52  bsdtar -xOf "${srcdir}/Kimi_x86_64.deb" "${data_archive}" |
    
      53    bsdtar -xf - --no-same-owner -C "${pkgdir}"
    
      54
    
      55  # Upstream also ships a stale launcher for a nonexistent executable.
    
      56  rm -f "${pkgdir}/usr/share/applications/com-pake-kimi.desktop"
    
      57
    
      58  # The upstream 400x400 directory is not part of the hicolor theme index.
    
      59  # Install the icon in the unthemed fallback so launchers can find it.
    
      60  install -d "${pkgdir}/usr/share/pixmaps"
    
      61  mv "${pkgdir}/usr/share/icons/hicolor/400x400/apps/kimi.png" \
    
      62    "${pkgdir}/usr/share/pixmaps/kimi.png"
    
      63  rmdir \
    
      64    "${pkgdir}/usr/share/icons/hicolor/400x400/apps" \
    
      65    "${pkgdir}/usr/share/icons/hicolor/400x400" \
    
      66    "${pkgdir}/usr/share/icons/hicolor" \
    
      67    "${pkgdir}/usr/share/icons"
    
      68
    
      69  # Avoid conflicting with the /usr/bin/kimi executable provided by kimi-code.
    
      70  mv "${pkgdir}/usr/bin/kimi" "${pkgdir}/usr/bin/kimi-desktop"
    
      71  sed -i 's/^Exec=kimi\([[:space:]]\|$\)/Exec=kimi-desktop\1/' \
    
      72    "${pkgdir}/usr/share/applications/kimi.desktop"
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2