mimo-desktop-bin
LOW
maintainer lzsnyy
0 votes
scanned 2026-11-06 00:13:25.067023
Why flagged
The .deb is downloaded from Xiaomi's own CDN (mimocode-cdn.xiaomimimo.com) with a pinned SHA-256 checksum, matching the app's own update infrastructure; the bundled envguard.c is a local file compiled at build time to work around a known Linux env-size limit, not an obfuscated payload; overall this is a legitimate repackaging of a proprietary app from its official distribution host, with the only mild concern being the non-whitelisted CDN host and low AUR vote count.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The .deb is downloaded from Xiaomi's own CDN (mimocode-cdn.xiaomimimo.com) with a pinned SHA-256 checksum, matching the app's own update infrastructure; the bundled envguard.c is a local file compiled at build time to work around a known Linux env-size limit, not an obfuscated payload; overall this is a legitimate repackaging of a proprietary app from its official distribution host, with the only mild concern being the non-whitelisted CDN host and low AUR vote count.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:42
source_x86_64=("XiaomiMiMo-${_srcver}-x64.deb::https://mimocode-cdn.xiaomimimo.com/mimocode/mimodesktop/XiaomiMiMo-${_srcver}-x64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: lzsnyy <710080675@qq.com>
2
#
3
# Repack of the official Linux build published on the MiMo CDN. The download
4
# page currently exposes only Windows and macOS, and the CDN object used here
5
# is the one the app's resources/app-update.yml points at; the versioned file
6
# and the versionless "latest" file are byte-identical (same ETag), so pinning
7
# the version keeps builds reproducible. Upstream only ships x86_64 for Linux.
8
9
pkgname=mimo-desktop-bin
10
# Full version from the deb control archive ("26.1105.50703-202"): the Debian
11
# revision is part of the upstream release, so keep it (Arch spells "-" as "_").
12
pkgver=26.1105.50703_202
13
pkgrel=2
14
# CDN file names omit the Debian revision.
15
_srcver=26.1105.50703
16
_appdir='Xiaomi MiMo'
17
pkgdesc='Xiaomi MiMo desktop client with built-in AI assistant (official Linux build)'
18
arch=('x86_64')
19
url='https://mimo.xiaomimimo.com/desktop/'
20
license=('LicenseRef-Proprietary')
21
depends=(
22
'alsa-lib'
23
'at-spi2-core'
24
'gtk3'
25
'hicolor-icon-theme'
26
'libnotify'
27
'libsecret'
28
'libxss'
29
'libxtst'
30
'nss'
31
'systemd-libs'
32
'util-linux-libs'
33
'xdg-utils'
34
)
35
optdepends=('libappindicator-gtk3: tray icon support')
36
makedepends=('gcc' 'imagemagick' 'libarchive')
37
install="${pkgname}.install"
38
conflicts=('mimo-desktop')
39
provides=("mimo-desktop=${pkgver}")
40
options=('!strip')
41
source=('envguard.c' 'mimo-desktop-bin.sh')
42
source_x86_64=("XiaomiMiMo-${_srcver}-x64.deb::https://mimocode-cdn.xiaomimimo.com/mimocode/mimodesktop/XiaomiMiMo-${_srcver}-x64.deb")
43
noextract=("XiaomiMiMo-${_srcver}-x64.deb")
44
sha256sums=('f5bd330f1ba5e2f17c2a1a0cbaeff95e9b279b92a0b0b55013b1e4290b5294d4'
45
'e05c5d8eb276bb322f6134699c5c6eb5f43f2156953d1f9c704a109cd1c366a6')
46
sha256sums_x86_64=('6b864de176673691d1eab4542c5ddc098f5b07f33530e30c05780affe3b60f96')
47
48
build() {
49
# Upstream serialises its built-in agent prompts (four ~37 KiB copies) plus
50
# provider settings into MIMOCODE_CONFIG_CONTENT, ~155 KiB in total. Linux
51
# caps a single environment string at MAX_ARG_STRLEN (128 KiB), so every
52
# execve() after that variable is set fails with E2BIG: renderers die with
53
# exit 127 (render-process-gone abnormal-exit 32512) and the app reports the
54
# sign-in page as a network failure. envguard.so drops any oversized string
55
# from child-process environments; the browser process keeps the value it
56
# reads in-process, exactly as the app's own child-environment helper does.
57
"${CC:-cc}" ${CFLAGS} -fPIC ${LDFLAGS} -shared -o "${srcdir}/envguard.so" \
58
"${srcdir}/envguard.c"
59
}
60
61
package() {
62
local _extractdir _icon _size
63
_extractdir="$(mktemp -d)"
64
65
bsdtar -C "${_extractdir}" -xf "${srcdir}/XiaomiMiMo-${_srcver}-x64.deb"
66
bsdtar -C "${_extractdir}" -xf "${_extractdir}/data.tar.xz"
67
68
install -dm755 \
69
"${pkgdir}/opt" \
70
"${pkgdir}/usr/bin" \
71
"${pkgdir}/usr/lib/${pkgname}" \
72
"${pkgdir}/usr/share/applications" \
73
"${pkgdir}/usr/share/icons/hicolor"
74
75
cp -a "${_extractdir}/opt/${_appdir}" "${pkgdir}/opt/"
76
77
# Upstream ships a single 1024x1024 PNG, but hicolor-icon-theme's index.theme
78
# only lists directories up to 512x512, so a launcher asking for any of the
79
# usual sizes finds nothing and falls back to a missing icon. Derive the
80
# indexed sizes from the source image and keep the original as well.
81
_icon="${_extractdir}/usr/share/icons/hicolor/1024x1024/apps/xiaomi-mimo-desktop.png"
82
install -Dm644 "${_icon}" \
83
"${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/${pkgname}.png"
84
for _size in 512 256 128 64 48 32 24 16; do
85
magick "${_icon}" -strip -resize "${_size}x${_size}" \
86
"${_extractdir}/icon-${_size}.png"
87
install -Dm644 "${_extractdir}/icon-${_size}.png" \
88
"${pkgdir}/usr/share/icons/hicolor/${_size}x${_size}/apps/${pkgname}.png"
89
done
90
91
# Keep upstream's desktop file name: it is what the app declares as
92
# "desktopName" in app.asar and what Wayland uses as the app id.
93
install -Dm644 "${_extractdir}/usr/share/applications/xiaomi-mimo.desktop" \
94
"${pkgdir}/usr/share/applications/xiaomi-mimo.desktop"
95
sed -i \
96
-e 's|^Exec=.*|Exec=/usr/bin/mimo-desktop-bin %U|' \
97
-e "s|^Icon=.*|Icon=${pkgname}|" \
98
"${pkgdir}/usr/share/applications/xiaomi-mimo.desktop"
99
100
install -Dm755 "${srcdir}/envguard.so" "${pkgdir}/usr/lib/${pkgname}/envguard.so"
101
install -Dm755 "${srcdir}/mimo-desktop-bin.sh" "${pkgdir}/usr/bin/${pkgname}"
102
chmod 0755 "${pkgdir}/opt/${_appdir}/chrome-sandbox"
103
104
install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSE.electron.txt" \
105
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
106
install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSES.chromium.html" \
107
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
108
109
if [[ -f "${_extractdir}/usr/share/doc/xiaomi-mimo-desktop/changelog.gz" ]]; then
110
install -Dm644 "${_extractdir}/usr/share/doc/xiaomi-mimo-desktop/changelog.gz" \
111
"${pkgdir}/usr/share/doc/${pkgname}/changelog.gz"
112
fi
113
114
rm -rf "${_extractdir}"
115
}
116
Changes since previous scan
--- PKGBUILD @ 2026-11-05 22:13+++ PKGBUILD @ 2026-11-06 00:13@@ -10,7 +10,7 @@ # Full version from the deb control archive ("26.1105.50703-202"): the Debian # revision is part of the upstream release, so keep it (Arch spells "-" as "_"). pkgver=26.1105.50703_202-pkgrel=1+pkgrel=2 # CDN file names omit the Debian revision. _srcver=26.1105.50703 _appdir='Xiaomi MiMo'@@ -33,14 +33,30 @@ 'xdg-utils' ) optdepends=('libappindicator-gtk3: tray icon support')-makedepends=('imagemagick' 'libarchive')+makedepends=('gcc' 'imagemagick' 'libarchive') install="${pkgname}.install" conflicts=('mimo-desktop') provides=("mimo-desktop=${pkgver}") options=('!strip')+source=('envguard.c' 'mimo-desktop-bin.sh') source_x86_64=("XiaomiMiMo-${_srcver}-x64.deb::https://mimocode-cdn.xiaomimimo.com/mimocode/mimodesktop/XiaomiMiMo-${_srcver}-x64.deb") noextract=("XiaomiMiMo-${_srcver}-x64.deb")+sha256sums=('f5bd330f1ba5e2f17c2a1a0cbaeff95e9b279b92a0b0b55013b1e4290b5294d4'+ 'e05c5d8eb276bb322f6134699c5c6eb5f43f2156953d1f9c704a109cd1c366a6') sha256sums_x86_64=('6b864de176673691d1eab4542c5ddc098f5b07f33530e30c05780affe3b60f96')++build() {+ # Upstream serialises its built-in agent prompts (four ~37 KiB copies) plus+ # provider settings into MIMOCODE_CONFIG_CONTENT, ~155 KiB in total. Linux+ # caps a single environment string at MAX_ARG_STRLEN (128 KiB), so every+ # execve() after that variable is set fails with E2BIG: renderers die with+ # exit 127 (render-process-gone abnormal-exit 32512) and the app reports the+ # sign-in page as a network failure. envguard.so drops any oversized string+ # from child-process environments; the browser process keeps the value it+ # reads in-process, exactly as the app's own child-environment helper does.+ "${CC:-cc}" ${CFLAGS} -fPIC ${LDFLAGS} -shared -o "${srcdir}/envguard.so" \+ "${srcdir}/envguard.c"+} package() { local _extractdir _icon _size@@ -52,6 +68,7 @@ install -dm755 \ "${pkgdir}/opt" \ "${pkgdir}/usr/bin" \+ "${pkgdir}/usr/lib/${pkgname}" \ "${pkgdir}/usr/share/applications" \ "${pkgdir}/usr/share/icons/hicolor" @@ -80,7 +97,8 @@ -e "s|^Icon=.*|Icon=${pkgname}|" \ "${pkgdir}/usr/share/applications/xiaomi-mimo.desktop" - ln -s "/opt/${_appdir}/xiaomi-mimo-desktop" "${pkgdir}/usr/bin/${pkgname}"+ install -Dm755 "${srcdir}/envguard.so" "${pkgdir}/usr/lib/${pkgname}/envguard.so"+ install -Dm755 "${srcdir}/mimo-desktop-bin.sh" "${pkgdir}/usr/bin/${pkgname}" chmod 0755 "${pkgdir}/opt/${_appdir}/chrome-sandbox" install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSE.electron.txt" \Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-06 00:13:25 | Low | 3 |
| 2026-11-06 00:11:05 | Medium | 2 |
| 2026-11-05 22:13:23 | Low | 3 |
| 2026-11-05 22:10:45 | Medium | 2 |