mimo-desktop

LOW

maintainer duanluan 0 votes scanned 2026-09-23 11:42:33.790858

View on AUR

Why flagged

Downloads a prebuilt .deb from Xiaomi's own CDN domain (mimocode-cdn.xiaomimimo.com) with a pinned SHA-256 checksum; this is the project's official release infrastructure, so the risk is low despite being a proprietary binary from a non-whitelisted host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads a prebuilt .deb from Xiaomi's own CDN domain (mimocode-cdn.xiaomimimo.com) with a pinned SHA-256 checksum; this is the project's official release infrastructure, so the risk is low despite being a proprietary binary from a non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source_x86_64=("XiaomiMiMo-${pkgver}-x64.deb::https://mimocode-cdn.xiaomimimo.com/mimocode/mimodesktop/XiaomiMiMo-${pkgver}-x64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=mimo-desktop
    
      4_pkgname=mimo-desktop
    
      5_appdir='Xiaomi MiMo'
    
      6pkgver=26.909.91205
    
      7pkgrel=1
    
      8pkgdesc='Xiaomi MiMo desktop client with the built-in AI coding assistant (official Linux release)'
    
      9arch=('x86_64')
    
      10url='https://mimo.xiaomimimo.com/desktop/'
    
      11license=('LicenseRef-Proprietary')
    
      12depends=(
    
      13  'alsa-lib'
    
      14  'at-spi2-core'
    
      15  'gtk3'
    
      16  'hicolor-icon-theme'
    
      17  'libnotify'
    
      18  'libsecret'
    
      19  'libxss'
    
      20  'libxtst'
    
      21  'nss'
    
      22  'util-linux-libs'
    
      23  'xdg-utils'
    
      24)
    
      25makedepends=('libarchive')
    
      26options=('!strip' '!lto')
    
      27source_x86_64=("XiaomiMiMo-${pkgver}-x64.deb::https://mimocode-cdn.xiaomimimo.com/mimocode/mimodesktop/XiaomiMiMo-${pkgver}-x64.deb")
    
      28noextract=("XiaomiMiMo-${pkgver}-x64.deb")
    
      29sha256sums_x86_64=('00ad0c37f83dbe4118bf2b8f4c3fa9208b1b3af9519bf7b21bab053088058ff7')
    
      30
    
      31package() {
    
      32  local _extractdir
    
      33  _extractdir="$(mktemp -d)"
    
      34  trap 'rm -rf "${_extractdir}"' EXIT
    
      35
    
      36  bsdtar -C "${_extractdir}" -xf "${srcdir}/XiaomiMiMo-${pkgver}-x64.deb"
    
      37  bsdtar -C "${_extractdir}" -xf "${_extractdir}/data.tar.xz"
    
      38
    
      39  install -dm755 \
    
      40    "${pkgdir}/opt" \
    
      41    "${pkgdir}/usr/bin" \
    
      42    "${pkgdir}/usr/share"
    
      43
    
      44  cp -a "${_extractdir}/opt/${_appdir}" "${pkgdir}/opt/"
    
      45  cp -a "${_extractdir}/usr/share/icons" "${pkgdir}/usr/share/"
    
      46
    
      47  install -Dm644 "${_extractdir}/usr/share/applications/xiaomi-mimo.desktop" \
    
      48    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      49  sed -i 's|^Exec=.*|Exec=mimo-desktop %U|' \
    
      50    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      51
    
      52  ln -s "/opt/${_appdir}/xiaomi-mimo-desktop" "${pkgdir}/usr/bin/${_pkgname}"
    
      53  chmod 0755 "${pkgdir}/opt/${_appdir}/chrome-sandbox"
    
      54
    
      55  install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSE.electron.txt" \
    
      56    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      57  install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSES.chromium.html" \
    
      58    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      59
    
      60  if [[ -f "${_extractdir}/usr/share/doc/xiaomi-mimo-desktop/changelog.gz" ]]; then
    
      61    install -Dm644 "${_extractdir}/usr/share/doc/xiaomi-mimo-desktop/changelog.gz" \
    
      62      "${pkgdir}/usr/share/doc/${pkgname}/changelog.gz"
    
      63  fi
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-23 11:42:33	Low	3
2026-09-23 11:40:33	Medium	2