mastergo

LOW

maintainer duanluan 0 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package downloads a prebuilt DMG from the official vendor's static domain (static.mastergo.com), which is plausibly part of their release infrastructure; despite the non-whitelisted host, it is repackaging official binaries for Linux, a common and legitimate AUR practice with low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt DMG from the official vendor's static domain (static.mastergo.com), which is plausibly part of their release infrastructure; despite the non-whitelisted host, it is repackaging official binaries for Linux, a common and legitimate AUR practice with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "MasterGo-${pkgver}-mac-arm64.dmg::https://static.mastergo.com/plugins/desktop/macos-arm/MasterGo-${pkgver}.dmg"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=mastergo
    
      4_pkgname=mastergo
    
      5pkgver=1.11.7
    
      6pkgrel=1
    
      7pkgdesc='MasterGo desktop app repackaged from the official macOS release'
    
      8arch=('x86_64')
    
      9url='https://mastergo.com/resource'
    
      10license=('LicenseRef-Proprietary')
    
      11depends=(
    
      12  'electron31'
    
      13  'hicolor-icon-theme'
    
      14  'xdg-utils'
    
      15)
    
      16makedepends=(
    
      17  '7zip'
    
      18  'nodejs'
    
      19)
    
      20provides=("mastergo-desktop-bin=${pkgver}")
    
      21conflicts=('mastergo-uos')
    
      22options=('!strip' '!lto')
    
      23source=(
    
      24  "MasterGo-${pkgver}-mac-arm64.dmg::https://static.mastergo.com/plugins/desktop/macos-arm/MasterGo-${pkgver}.dmg"
    
      25  'mastergo.sh'
    
      26  'mastergo.desktop'
    
      27  'patch-linux-runtime.mjs'
    
      28)
    
      29noextract=("MasterGo-${pkgver}-mac-arm64.dmg")
    
      30sha256sums=(
    
      31  'e856ef5f6fd876a089f79f96d545f0a8a9070aeb8c7c2fbf26d0c969c460da01'
    
      32  '44fd0d776dc07cbe67827f1725447b7dbbd5b736baa649293a8ec5a6a2e000b4'
    
      33  '63d97f33c9c1f42c921f748c1567d08402618fbfce6f054fc8e4d307455376b0'
    
      34  '2e8b31a2ce5d52bafc22d01195d62cb8dd72f8d0e7bf23c638583b46cdcd26ec'
    
      35)
    
      36
    
      37prepare() {
    
      38  cd "${srcdir}"
    
      39  rm -rf dmg app app-update.yml icon.icns
    
      40  mkdir dmg
    
      41
    
      42  7z x -bd -y "MasterGo-${pkgver}-mac-arm64.dmg" -odmg >/dev/null
    
      43
    
      44  local appdir
    
      45  appdir="$(find dmg -maxdepth 4 -type d -name 'MasterGo.app' ! -path '*/__MACOSX/*' -print -quit)"
    
      46  [[ -n "${appdir}" ]] || {
    
      47    echo "Could not find MasterGo.app in upstream dmg"
    
      48    return 1
    
      49  }
    
      50
    
      51  cp -a "${appdir}/Contents/Resources/app" .
    
      52  cp -a "${appdir}/Contents/Resources/app-update.yml" .
    
      53  cp -a "${appdir}/Contents/Resources/icon.icns" .
    
      54
    
      55  find app \
    
      56    \( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) \
    
      57    -delete
    
      58
    
      59  node "${srcdir}/patch-linux-runtime.mjs" app
    
      60}
    
      61
    
      62package() {
    
      63  cd "${srcdir}"
    
      64
    
      65  install -dm755 \
    
      66    "${pkgdir}/usr/bin" \
    
      67    "${pkgdir}/usr/lib/${pkgname}/resources" \
    
      68    "${pkgdir}/usr/share/applications" \
    
      69    "${pkgdir}/usr/share/doc/${pkgname}" \
    
      70    "${pkgdir}/usr/share/icons/hicolor/32x32/apps" \
    
      71    "${pkgdir}/usr/share/icons/hicolor/512x512/apps" \
    
      72    "${pkgdir}/usr/share/pixmaps"
    
      73
    
      74  install -Dm755 "${srcdir}/mastergo.sh" \
    
      75    "${pkgdir}/usr/bin/mastergo"
    
      76
    
      77  cp -a app \
    
      78    "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      79  install -Dm644 app-update.yml \
    
      80    "${pkgdir}/usr/lib/${pkgname}/resources/app-update.yml"
    
      81
    
      82  install -Dm644 app/package.json \
    
      83    "${pkgdir}/usr/share/doc/${pkgname}/package.json"
    
      84  install -Dm644 "${srcdir}/mastergo.desktop" \
    
      85    "${pkgdir}/usr/share/applications/mastergo.desktop"
    
      86
    
      87  install -Dm644 app/icons/logo.png \
    
      88    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/mastergo.png"
    
      89  install -Dm644 app/img/icons/favicon-32x32.png \
    
      90    "${pkgdir}/usr/share/icons/hicolor/32x32/apps/mastergo.png"
    
      91  install -Dm644 app/icons/logo.png \
    
      92    "${pkgdir}/usr/share/pixmaps/mastergo.png"
    
      93
    
      94  if [[ -d "${pkgdir}/usr/lib/${pkgname}/resources/app/local-mcp" ]]; then
    
      95    find "${pkgdir}/usr/lib/${pkgname}/resources/app/local-mcp" \
    
      96      -type f -name 'mgmcp*' -delete
    
      97  fi
    
      98}
    
      99

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2