mastergo

MEDIUM

maintainer duanluan 0 votes scanned 2026-08-21 21:19:14.007822

View on AUR

Why flagged

Downloads a prebuilt macOS DMG from static.mastergo.com (a CDN/static host, not the main project domain), extracts and repackages proprietary binary app code, then runs a bundled Node.js patch script (patch-linux-runtime.mjs) against it at build time; the DMG is an unofficial repackaging of a macOS release for Linux with no Linux-official equivalent, making the supply chain unverifiable, though checksums are provided and the host is plausibly project-affiliated.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "MasterGo-${pkgver}-mac-arm64.dmg::https://static.mastergo.com/plugins/desktop/macos-arm/MasterGo-${pkgver}.dmg"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads a prebuilt macOS DMG from static.mastergo.com (a CDN/static host, not the main project domain), extracts and repackages proprietary binary app code, then runs a bundled Node.js patch script (patch-linux-runtime.mjs) against it at build time; the DMG is an unofficial repackaging of a macOS release for Linux with no Linux-official equivalent, making the supply chain unverifiable, though checksums are provided and the host is plausibly project-affiliated.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=mastergo
    
      4_pkgname=mastergo
    
      5pkgver=1.11.5
    
      6pkgrel=1
    
      7pkgdesc='MasterGo desktop app repackaged from the official macOS release'
    
      8arch=('x86_64')
    
      9url='https://mastergo.com/resource'
    
      10license=('LicenseRef-Proprietary')
    
      11depends=(
    
      12  'electron31'
    
      13  'hicolor-icon-theme'
    
      14  'xdg-utils'
    
      15)
    
      16makedepends=(
    
      17  '7zip'
    
      18  'nodejs'
    
      19)
    
      20provides=("mastergo-desktop-bin=${pkgver}")
    
      21conflicts=('mastergo-uos')
    
      22options=('!strip' '!lto')
    
      23source=(
    
      24  "MasterGo-${pkgver}-mac-arm64.dmg::https://static.mastergo.com/plugins/desktop/macos-arm/MasterGo-${pkgver}.dmg"
    
      25  'mastergo.sh'
    
      26  'mastergo.desktop'
    
      27  'patch-linux-runtime.mjs'
    
      28)
    
      29noextract=("MasterGo-${pkgver}-mac-arm64.dmg")
    
      30sha256sums=(
    
      31  '43d3e85bfcdc3edfdd6a38086ad60705f38307f999667989897be1dd2bee1af4'
    
      32  '44fd0d776dc07cbe67827f1725447b7dbbd5b736baa649293a8ec5a6a2e000b4'
    
      33  '63d97f33c9c1f42c921f748c1567d08402618fbfce6f054fc8e4d307455376b0'
    
      34  '2e8b31a2ce5d52bafc22d01195d62cb8dd72f8d0e7bf23c638583b46cdcd26ec'
    
      35)
    
      36
    
      37prepare() {
    
      38  cd "${srcdir}"
    
      39  rm -rf dmg app app-update.yml icon.icns
    
      40  mkdir dmg
    
      41
    
      42  7z x -bd -y "MasterGo-${pkgver}-mac-arm64.dmg" -odmg >/dev/null
    
      43
    
      44  local appdir
    
      45  appdir="$(find dmg -maxdepth 4 -type d -name 'MasterGo.app' ! -path '*/__MACOSX/*' -print -quit)"
    
      46  [[ -n "${appdir}" ]] || {
    
      47    echo "Could not find MasterGo.app in upstream dmg"
    
      48    return 1
    
      49  }
    
      50
    
      51  cp -a "${appdir}/Contents/Resources/app" .
    
      52  cp -a "${appdir}/Contents/Resources/app-update.yml" .
    
      53  cp -a "${appdir}/Contents/Resources/icon.icns" .
    
      54
    
      55  find app \
    
      56    \( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) \
    
      57    -delete
    
      58
    
      59  node "${srcdir}/patch-linux-runtime.mjs" app
    
      60}
    
      61
    
      62package() {
    
      63  cd "${srcdir}"
    
      64
    
      65  install -dm755 \
    
      66    "${pkgdir}/usr/bin" \
    
      67    "${pkgdir}/usr/lib/${pkgname}/resources" \
    
      68    "${pkgdir}/usr/share/applications" \
    
      69    "${pkgdir}/usr/share/doc/${pkgname}" \
    
      70    "${pkgdir}/usr/share/icons/hicolor/32x32/apps" \
    
      71    "${pkgdir}/usr/share/icons/hicolor/512x512/apps" \
    
      72    "${pkgdir}/usr/share/pixmaps"
    
      73
    
      74  install -Dm755 "${srcdir}/mastergo.sh" \
    
      75    "${pkgdir}/usr/bin/mastergo"
    
      76
    
      77  cp -a app \
    
      78    "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      79  install -Dm644 app-update.yml \
    
      80    "${pkgdir}/usr/lib/${pkgname}/resources/app-update.yml"
    
      81
    
      82  install -Dm644 app/package.json \
    
      83    "${pkgdir}/usr/share/doc/${pkgname}/package.json"
    
      84  install -Dm644 "${srcdir}/mastergo.desktop" \
    
      85    "${pkgdir}/usr/share/applications/mastergo.desktop"
    
      86
    
      87  install -Dm644 app/icons/logo.png \
    
      88    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/mastergo.png"
    
      89  install -Dm644 app/img/icons/favicon-32x32.png \
    
      90    "${pkgdir}/usr/share/icons/hicolor/32x32/apps/mastergo.png"
    
      91  install -Dm644 app/icons/logo.png \
    
      92    "${pkgdir}/usr/share/pixmaps/mastergo.png"
    
      93
    
      94  if [[ -d "${pkgdir}/usr/lib/${pkgname}/resources/app/local-mcp" ]]; then
    
      95    find "${pkgdir}/usr/lib/${pkgname}/resources/app/local-mcp" \
    
      96      -type f -name 'mgmcp*' -delete
    
      97  fi
    
      98}
    
      99

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 21:19:14	Medium	3
2026-08-21 21:15:20	Medium	3