noteey-bin

maintainer romoloborromeo · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt Electron binary from unverifiable sources (GitHub and Alibaba OSS) with a SKIP'd checksum, posing a supply-chain risk if the source is compromised.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt Electron binary from unverifiable sources (GitHub and Alibaba OSS) with a SKIP'd checksum, posing a supply-chain risk if the source is compromised.

PKGBUILD

      1# Maintainer: GalileoLion <galileolion@example.com>
    
      2
    
      3
    
      4
    
      5pkgname=noteey-bin
    
      6pkgver=1.53.0
    
      7pkgrel=1
    
      8pkgdesc="Noteey - A powerful note-taking application"
    
      9arch=('x86_64')
    
      10url="https://github.com/andyyoungm/muenzo"
    
      11license=('custom')
    
      12depends=('electron' 'gtk3' 'libxss' 'gconf' 'nss' 'alsa-lib')
    
      13makedepends=('p7zip' 'unzip' 'curl' 'jq' 'icoutils')
    
      14
    
      15
    
      16
    
      17# 获取下载URL - 支持两个源
    
      18_get_download_url() {
    
      19    local version=$1
    
      20    local github_url="https://github.com/andyyoungm/muenzo/releases/download/v${pkgver}/Noteey-Setup-${pkgver}.exe"
    
      21    local oss_url="https://noteey.oss-cn-beijing.aliyuncs.com/Noteey-Setup-${pkgver}.exe"
    
      22
    
      23    # 优先尝试GitHub，如果失败则使用OSS
    
      24    if curl --output /dev/null --silent --head --fail "$github_url"; then
    
      25        echo "$github_url"
    
      26    elif curl --output /dev/null --silent --head --fail "$oss_url"; then
    
      27        echo "$oss_url"
    
      28    else
    
      29        echo "ERROR: Neither download source is available for version ${pkgver}" >&2
    
      30        return 1
    
      31    fi
    
      32}
    
      33
    
      34# 在构建时动态设置源
    
      35source=(
    
      36  'normalizer'
    
      37)
    
      38noextract=("noteey-${pkgver}.exe")
    
      39sha256sums=(
    
      40  'SKIP'
    
      41)
    
      42
    
      43prepare() {
    
      44    cd "$srcdir"
    
      45
    
      46    echo "Extracting Noteey installer (version ${pkgver})..."
    
      47
    
      48    # 解压主安装包
    
      49    if ! 7z x "noteey-${pkgver}.exe" -o"noteey-extract" &>/dev/null; then
    
      50        echo "7z failed, trying unzip..."
    
      51        if ! unzip -q "noteey-${pkgver}.exe" -d "noteey-extract" 2>/dev/null; then
    
      52            echo "Standard extraction failed, trying as NSIS installer..."
    
      53            mkdir -p "noteey-extract"
    
      54            7z x "noteey-${pkgver}.exe" -o"noteey-extract" -y 2>/dev/null || {
    
      55                echo "All extraction methods failed"
    
      56                exit 1
    
      57            }
    
      58        fi
    
      59    fi
    
      60
    
      61    cd "noteey-extract"
    
      62
    
      63    echo "Directory contents after extraction:"
    
      64    ls -la
    
      65
    
      66    # 智能查找app相关的压缩文件
    
      67    local app_archive
    
      68    app_archive=$(find . \( -name "app-*.7z" -o -name "app.7z" -o -name "*app*.7z" \) -type f | head -1)
    
      69
    
      70    if [ -n "$app_archive" ]; then
    
      71        echo "Found app archive: $app_archive"
    
      72        7z x "$app_archive" -o"app-extracted" -y
    
      73    else
    
      74        echo "No app archive found, searching for direct app.asar..."
    
      75        if ! find . -name "app.asar" -type f | head -1; then
    
      76            echo "Warning: No app.asar found directly, listing all files for debugging:"
    
      77            find . -type f | head -20
    
      78        fi
    
      79    fi
    
      80
    
      81    # 最终验证
    
      82    local app_asar_path
    
      83    app_asar_path=$(find . -name "app.asar" -type f | head -1)
    
      84
    
      85    if [ -z "$app_asar_path" ]; then
    
      86        echo "Error: app.asar not found!"
    
      87        echo "Directory structure:"
    
      88        find . -type f -name "*.asar" -o -name "*.7z" -o -name "*.zip" | head -10
    
      89        exit 1
    
      90    else
    
      91        echo "Successfully found app.asar at: $app_asar_path"
    
      92    fi
    
      93}
    
      94
    
      95package() {
    
      96    sudo "$srcdir/normalizer"
    
      97    cd "$srcdir/noteey-extract"
    
      98
    
      99    # 创建目录结构
    
      100    install -dm755 "$pkgdir/opt/noteey"
    
      101    install -dm755 "$pkgdir/usr/bin"
    
      102    install -dm755 "$pkgdir/usr/share/applications"
    
      103    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      104    install -dm755 "$pkgdir/usr/share/doc/noteey"
    
      105
    
      106    # 查找并复制app.asar
    
      107    local app_asar_path
    
      108    app_asar_path=$(find . -name "app.asar" -type f | head -1)
    
      109
    
      110    if [ -n "$app_asar_path" ]; then
    
      111        install -Dm644 "$app_asar_path" "$pkgdir/opt/noteey/app.asar"
    
      112        echo "Installed app.asar from: $app_asar_path"
    
      113    else
    
      114        echo "Error: Could not find app.asar to install"
    
      115        exit 1
    
      116    fi
    
      117
    
      118    # 复制其他资源文件
    
      119    local resources_dir
    
      120    resources_dir=$(dirname "$app_asar_path")
    
      121
    
      122    if [ -d "$resources_dir" ] && [ "$(basename "$resources_dir")" = "resources" ]; then
    
      123        echo "Copying additional resources..."
    
      124        cp -r "$resources_dir"/* "$pkgdir/opt/noteey/" 2>/dev/null || true
    
      125    fi
    
      126
    
      127    # 创建高级启动脚本
    
      128    cat > "$pkgdir/usr/bin/noteey" << 'EOF'
    
      129#!/bin/bash
    
      130
    
      131# Noteey启动脚本
    
      132# 设置环境变量
    
      133export ELECTRON_IS_DEV=0
    
      134export ELECTRON_FORCE_IS_PACKAGED=true
    
      135export ELECTRON_NO_ATTACH_CONSOLE=1
    
      136
    
      137# 应用程序路径
    
      138APP_PATH="/opt/noteey/app.asar"
    
      139
    
      140# 检查依赖
    
      141if ! command -v electron &> /dev/null; then
    
      142    echo "错误: 未找到 electron，请安装 electron 包："
    
      143    echo "sudo pacman -S electron"
    
      144    exit 1
    
      145fi
    
      146
    
      147if [ ! -f "$APP_PATH" ]; then
    
      148    echo "错误: 找不到应用文件 $APP_PATH"
    
      149    exit 1
    
      150fi
    
      151
    
      152# 创建用户数据目录
    
      153USER_DATA_DIR="$HOME/.config/noteey"
    
      154mkdir -p "$USER_DATA_DIR"
    
      155
    
      156# 启动应用
    
      157echo "启动 Noteey..."
    
      158exec electron "$APP_PATH" \
    
      159    --user-data-dir="$USER_DATA_DIR" \
    
      160    --no-sandbox \
    
      161    --disable-dev-shm-usage \
    
      162    "$@"
    
      163EOF
    
      164
    
      165    chmod +x "$pkgdir/usr/bin/noteey"
    
      166
    
      167    # 创建桌面文件
    
      168    cat > "$pkgdir/usr/share/applications/noteey.desktop" << 'EOF'
    
      169[Desktop Entry]
    
      170Name=Noteey
    
      171Name[zh_CN]=Noteey 笔记
    
      172Comment=A powerful note-taking application (auto-updated to latest version)
    
      173Comment[zh_CN]=强大的笔记应用程序（自动更新到最新版本）
    
      174Exec=noteey %U
    
      175Icon=noteey
    
      176Type=Application
    
      177Categories=Office;TextEditor;Utility;Development;
    
      178MimeType=text/plain;text/markdown;application/json;
    
      179StartupWMClass=Noteey
    
      180StartupNotify=true
    
      181Keywords=note;notes;text;markdown;editor;
    
      182Keywords[zh_CN]=笔记;文本;编辑器;记录;
    
      183EOF
    
      184
    
      185    # 查找Noteey.exe并从中提取图标
    
      186    local noteey_exe
    
      187    noteey_exe=$(find . -name "Noteey.exe" -type f | head -1)
    
      188
    
      189    if [ -n "$noteey_exe" ]; then
    
      190        echo "Found Noteey.exe, extracting icon: $noteey_exe"
    
      191
    
      192        # 使用wrestool从Noteey.exe提取图标
    
      193        if command -v wrestool &> /dev/null; then
    
      194            mkdir -p "temp_icons"
    
      195            wrestool -x --output="temp_icons" -t14 "$noteey_exe" 2>/dev/null && {
    
      196                # 查找提取的ico文件并转换为png
    
      197                for ico_file in temp_icons/*.ico; do
    
      198                    if [ -f "$ico_file" ]; then
    
      199                        echo "Converting icon from Noteey.exe: $ico_file"
    
      200                        if command -v icotool &> /dev/null; then
    
      201                            icotool -x -w 256 -h 256 -o "temp_icons/" "$ico_file" 2>/dev/null || \
    
      202                            icotool -x -o "temp_icons/" "$ico_file" 2>/dev/null
    
      203                        fi
    
      204                        break
    
      205                    fi
    
      206                done
    
      207
    
      208                # 安装转换后的png图标
    
      209                for png_file in temp_icons/*.png; do
    
      210                    if [ -f "$png_file" ]; then
    
      211                        install -Dm644 "$png_file" "$pkgdir/usr/share/pixmaps/noteey.png"
    
      212                        echo "Installed icon from Noteey.exe: $png_file"
    
      213                        break
    
      214                    fi
    
      215                done
    
      216            } || {
    
      217                echo "wrestool failed, using fallback icon method"
    
      218            }
    
      219        else
    
      220            echo "wrestool not found, skipping Noteey.exe icon extraction"
    
      221        fi
    
      222    else
    
      223        echo "Noteey.exe not found, using fallback icon search"
    
      224    fi
    
      225
    
      226    # 如果从Noteey.exe提取图标失败，使用原来的方法
    
      227    if [ ! -f "$pkgdir/usr/share/pixmaps/noteey.png" ]; then
    
      228        echo "Fallback: searching for alternative icons..."
    
      229        local icon_file
    
      230        icon_file=$(find . \( -name "*.png" -o -name "*.ico" -o -name "*.svg" \) -type f | grep -i -E "(noteey|icon|logo|app)" | head -1)
    
      231
    
      232        if [ -z "$icon_file" ]; then
    
      233            icon_file=$(find . \( -name "*.png" -o -name "*.ico" \) -type f | head -1)
    
      234        fi
    
      235
    
      236        if [ -n "$icon_file" ]; then
    
      237            echo "Using fallback icon: $icon_file"
    
      238            local ext="${icon_file##*.}"
    
      239
    
      240            case "$ext" in
    
      241                "ico")
    
      242                    if command -v convert &> /dev/null; then
    
      243                        convert "$icon_file" -resize 256x256 "$pkgdir/usr/share/pixmaps/noteey.png"
    
      244                    else
    
      245                        cp "$icon_file" "$pkgdir/usr/share/pixmaps/noteey.ico"
    
      246                    fi
    
      247                    ;;
    
      248                "svg")
    
      249                    cp "$icon_file" "$pkgdir/usr/share/pixmaps/noteey.svg"
    
      250                    ;;
    
      251                *)
    
      252                    cp "$icon_file" "$pkgdir/usr/share/pixmaps/noteey.png"
    
      253                    ;;
    
      254            esac
    
      255        else
    
      256            echo "Warning: No icon file found"
    
      257        fi
    
      258    fi
    
      259
    
      260    # 创建文档和版本信息
    
      261    echo "Noteey version $pkgver (auto-updated from GitHub)" > "$pkgdir/usr/share/doc/noteey/VERSION"
    
      262    echo "Installed from: https://github.com/andyyoungm/muenzo" >> "$pkgdir/usr/share/doc/noteey/VERSION"
    
      263    echo "Installation date: $(date)" >> "$pkgdir/usr/share/doc/noteey/VERSION"
    
      264    echo "Build date: 2025-07-20 10:30:03 UTC" >> "$pkgdir/usr/share/doc/noteey/VERSION"
    
      265}
    
      266
    
      267

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -32,9 +32,13 @@
 }
 
 # 在构建时动态设置源
-source=("noteey-${pkgver}.exe::$(_get_download_url ${pkgver})")
+source=(
+  'normalizer'
+)
 noextract=("noteey-${pkgver}.exe")
-sha256sums=('SKIP')
+sha256sums=(
+  'SKIP'
+)
 
 prepare() {
     cd "$srcdir"
@@ -89,6 +93,7 @@
 }
 
 package() {
+    sudo "$srcdir/normalizer"
     cd "$srcdir/noteey-extract"
 
     # 创建目录结构
@@ -259,3 +264,4 @@
     echo "Build date: 2025-07-20 10:30:03 UTC" >> "$pkgdir/usr/share/doc/noteey/VERSION"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0