mastergo-desktop-bin
maintainer duanluan
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt macOS .dmg from a non-whitelisted host (static.mastergo.com), which is then repackaged for Linux; this creates a supply-chain risk as the binary artifact is not built from source and could contain unverified code.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
"MasterGo-${pkgver}-mac-arm64.dmg::https://static.mastergo.com/plugins/desktop/macos-arm/MasterGo-${pkgver}.dmg"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt macOS .dmg from a non-whitelisted host (static.mastergo.com), which is then repackaged for Linux; this creates a supply-chain risk as the binary artifact is not built from source and could contain unverified code.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: duanluan <duanluan@outlook.com>
2
3
pkgname=mastergo-desktop-bin
4
_pkgname=mastergo
5
pkgver=1.11.5
6
pkgrel=1
7
pkgdesc='MasterGo desktop app repackaged from the official macOS release'
8
arch=('x86_64')
9
url='https://mastergo.com/resource'
10
license=('custom')
11
depends=(
12
'electron31'
13
'hicolor-icon-theme'
14
'xdg-utils'
15
)
16
makedepends=(
17
'7zip'
18
'nodejs'
19
)
20
provides=('mastergo')
21
conflicts=('mastergo' 'mastergo-uos')
22
options=('!strip' '!lto')
23
source=(
24
"MasterGo-${pkgver}-mac-arm64.dmg::https://static.mastergo.com/plugins/desktop/macos-arm/MasterGo-${pkgver}.dmg"
25
'mastergo.sh'
26
'mastergo.desktop'
27
'patch-linux-runtime.mjs'
28
)
29
noextract=("MasterGo-${pkgver}-mac-arm64.dmg")
30
sha256sums=(
31
'8632932972f3606783b89361a0ffe31952e5e102b627c79a29bf1fde96a30e71'
32
'44fd0d776dc07cbe67827f1725447b7dbbd5b736baa649293a8ec5a6a2e000b4'
33
'63d97f33c9c1f42c921f748c1567d08402618fbfce6f054fc8e4d307455376b0'
34
'2e8b31a2ce5d52bafc22d01195d62cb8dd72f8d0e7bf23c638583b46cdcd26ec'
35
)
36
37
prepare() {
38
cd "${srcdir}"
39
rm -rf dmg app app-update.yml icon.icns
40
mkdir dmg
41
42
7z x -bd -y "MasterGo-${pkgver}-mac-arm64.dmg" -odmg >/dev/null
43
44
local appdir
45
appdir="$(find dmg -maxdepth 4 -type d -name 'MasterGo.app' ! -path '*/__MACOSX/*' -print -quit)"
46
[[ -n "${appdir}" ]] || {
47
echo "Could not find MasterGo.app in upstream dmg"
48
return 1
49
}
50
51
cp -a "${appdir}/Contents/Resources/app" .
52
cp -a "${appdir}/Contents/Resources/app-update.yml" .
53
cp -a "${appdir}/Contents/Resources/icon.icns" .
54
55
find app \
56
\( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) \
57
-delete
58
59
node "${srcdir}/patch-linux-runtime.mjs" app
60
}
61
62
package() {
63
cd "${srcdir}"
64
65
install -dm755 \
66
"${pkgdir}/usr/bin" \
67
"${pkgdir}/usr/lib/${pkgname}/resources" \
68
"${pkgdir}/usr/share/applications" \
69
"${pkgdir}/usr/share/doc/${pkgname}" \
70
"${pkgdir}/usr/share/icons/hicolor/32x32/apps" \
71
"${pkgdir}/usr/share/icons/hicolor/512x512/apps" \
72
"${pkgdir}/usr/share/pixmaps"
73
74
install -Dm755 "${srcdir}/mastergo.sh" \
75
"${pkgdir}/usr/bin/mastergo"
76
77
cp -a app \
78
"${pkgdir}/usr/lib/${pkgname}/resources/"
79
install -Dm644 app-update.yml \
80
"${pkgdir}/usr/lib/${pkgname}/resources/app-update.yml"
81
82
install -Dm644 app/package.json \
83
"${pkgdir}/usr/share/doc/${pkgname}/package.json"
84
install -Dm644 "${srcdir}/mastergo.desktop" \
85
"${pkgdir}/usr/share/applications/mastergo.desktop"
86
87
install -Dm644 app/icons/logo.png \
88
"${pkgdir}/usr/share/icons/hicolor/512x512/apps/mastergo.png"
89
install -Dm644 app/img/icons/favicon-32x32.png \
90
"${pkgdir}/usr/share/icons/hicolor/32x32/apps/mastergo.png"
91
install -Dm644 app/icons/logo.png \
92
"${pkgdir}/usr/share/pixmaps/mastergo.png"
93
94
if [[ -d "${pkgdir}/usr/lib/${pkgname}/resources/app/local-mcp" ]]; then
95
find "${pkgdir}/usr/lib/${pkgname}/resources/app/local-mcp" \
96
-type f -name 'mgmcp*' -delete
97
fi
98
}
99
Changes since previous scan
--- PKGBUILD @ 2026-07-27 00:24+++ PKGBUILD @ 2026-08-03 00:08@@ -2,7 +2,7 @@ pkgname=mastergo-desktop-bin _pkgname=mastergo-pkgver=1.10.11+pkgver=1.11.5 pkgrel=1 pkgdesc='MasterGo desktop app repackaged from the official macOS release' arch=('x86_64')@@ -28,7 +28,7 @@ ) noextract=("MasterGo-${pkgver}-mac-arm64.dmg") sha256sums=(- '59cde0b88c0e73ca8a3c31f4270ae578e8a8b013944df82c2185bac0f55bcb15'+ '8632932972f3606783b89361a0ffe31952e5e102b627c79a29bf1fde96a30e71' '44fd0d776dc07cbe67827f1725447b7dbbd5b736baa649293a8ec5a6a2e000b4' '63d97f33c9c1f42c921f748c1567d08402618fbfce6f054fc8e4d307455376b0' '2e8b31a2ce5d52bafc22d01195d62cb8dd72f8d0e7bf23c638583b46cdcd26ec'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 05:34:42 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 09:27:42 | MEDIUM | 1 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |