kimi-desktop-bin

maintainer impulse · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt proprietary binary .deb is downloaded from a GitHub Pages host (kimi-moonshot.github.io) that is not the official vendor domain (kimi.moonshot.cn), making it an unofficial/unverifiable distribution channel where the binary could be silently swapped; however a checksum is provided and the host appears to be a project-affiliated GitHub org rather than random personal cloud storage.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=('Kimi_x86_64.deb::https://kimi-moonshot.github.io/download/Kimi_x86_64.deb')

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): A prebuilt proprietary binary .deb is downloaded from a GitHub Pages host (kimi-moonshot.github.io) that is not the official vendor domain (kimi.moonshot.cn), making it an unofficial/unverifiable distribution channel where the binary could be silently swapped; however a checksum is provided and the host appears to be a project-affiliated GitHub org rather than random personal cloud storage.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=kimi-desktop-bin
    
      2pkgver=1.0.0
    
      3pkgrel=3
    
      4pkgdesc='Kimi AI assistant desktop client'
    
      5arch=('x86_64')
    
      6url='https://kimi.moonshot.cn/'
    
      7license=('LicenseRef-proprietary')
    
      8depends=(
    
      9  'cairo'
    
      10  'curl'
    
      11  'gcc-libs'
    
      12  'gdk-pixbuf2'
    
      13  'glib2'
    
      14  'glibc'
    
      15  'gtk3'
    
      16  'libayatana-appindicator'
    
      17  'libsoup'
    
      18  'openssl'
    
      19  'pango'
    
      20  'webkit2gtk'
    
      21  'wget'
    
      22)
    
      23provides=('kimi-desktop')
    
      24conflicts=('kimi-desktop')
    
      25source=('Kimi_x86_64.deb::https://kimi-moonshot.github.io/download/Kimi_x86_64.deb')
    
      26noextract=('Kimi_x86_64.deb')
    
      27sha256sums=('822abf05bd669201c9984e828b2624e67e0923ac3cb5a6bcc72f91bc61324e7c')
    
      28
    
      29pkgver() {
    
      30  local control_archive version
    
      31
    
      32  control_archive="$(
    
      33    bsdtar -tf "${srcdir}/Kimi_x86_64.deb" |
    
      34      awk '/^control\.tar(\..+)?$/ { print; exit }'
    
      35  )"
    
      36  version="$(
    
      37    bsdtar -xOf "${srcdir}/Kimi_x86_64.deb" "${control_archive}" |
    
      38      bsdtar -xOf - control |
    
      39      sed -n 's/^Version: //p'
    
      40  )"
    
      41
    
      42  printf '%s\n' "${version//-/.}"
    
      43}
    
      44
    
      45package() {
    
      46  local data_archive
    
      47
    
      48  data_archive="$(
    
      49    bsdtar -tf "${srcdir}/Kimi_x86_64.deb" |
    
      50      awk '/^data\.tar(\..+)?$/ { print; exit }'
    
      51  )"
    
      52  bsdtar -xOf "${srcdir}/Kimi_x86_64.deb" "${data_archive}" |
    
      53    bsdtar -xf - --no-same-owner -C "${pkgdir}"
    
      54
    
      55  # Upstream also ships a stale launcher for a nonexistent executable.
    
      56  rm -f "${pkgdir}/usr/share/applications/com-pake-kimi.desktop"
    
      57
    
      58  # The upstream 400x400 directory is not part of the hicolor theme index.
    
      59  # Install the icon in the unthemed fallback so launchers can find it.
    
      60  install -d "${pkgdir}/usr/share/pixmaps"
    
      61  mv "${pkgdir}/usr/share/icons/hicolor/400x400/apps/kimi.png" \
    
      62    "${pkgdir}/usr/share/pixmaps/kimi.png"
    
      63  rmdir \
    
      64    "${pkgdir}/usr/share/icons/hicolor/400x400/apps" \
    
      65    "${pkgdir}/usr/share/icons/hicolor/400x400" \
    
      66    "${pkgdir}/usr/share/icons/hicolor" \
    
      67    "${pkgdir}/usr/share/icons"
    
      68
    
      69  # Avoid conflicting with the /usr/bin/kimi executable provided by kimi-code.
    
      70  mv "${pkgdir}/usr/bin/kimi" "${pkgdir}/usr/bin/kimi-desktop"
    
      71  sed -i 's/^Exec=kimi\([[:space:]]\|$\)/Exec=kimi-desktop\1/' \
    
      72    "${pkgdir}/usr/share/applications/kimi.desktop"
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 05:31:37	MEDIUM	3
2026-07-25 05:29:17	MEDIUM	3