nowledge-mem

MEDIUM

maintainer Qingxu 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted, project-specific domain (download-mem.nowledge.co), which could host unverifiable executable code; while the build process unpacks and installs it transparently, the source is a binary blob not built from auditable source, creating a supply-chain risk if the host is compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 "nowledge-mem-$pkgver.deb::https://download-mem.nowledge.co/app/$pkgver/$CARCH-unknown-linux-gnu.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted, project-specific domain (download-mem.nowledge.co), which could host unverifiable executable code; while the build process unpacks and installs it transparently, the source is a binary blob not built from auditable source, creating a supply-chain risk if the host is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Qingxu <me@linioi.com>
    
      2pkgname=nowledge-mem
    
      3pkgver=0.10.62
    
      4pkgrel=1
    
      5pkgdesc='Local-first memory and context management system for AI-powered workflows'
    
      6url='https://mem.nowledge.co'
    
      7arch=(
    
      8    'x86_64'
    
      9)
    
      10license=(
    
      11    'LicenseRef-proprietary'
    
      12)
    
      13depends=(
    
      14    'gtk3'
    
      15    'webkit2gtk-4.1'
    
      16    'libayatana-appindicator'
    
      17)
    
      18makedepends=(
    
      19    'zstd'
    
      20)
    
      21optdepends=(
    
      22    'gnome-keyring: for credential storage'
    
      23    'xdg-utils: for opening links and nowledgemem:// URLs'
    
      24)
    
      25provides=(
    
      26    'nmem-cli'
    
      27)
    
      28conflicts=(
    
      29    'nmem-cli'
    
      30    'nowledge-mem-bin'
    
      31)
    
      32options=(
    
      33    '!strip'
    
      34    '!debug'
    
      35)
    
      36source_x86_64=(
    
      37    "nowledge-mem-$pkgver.deb::https://download-mem.nowledge.co/app/$pkgver/$CARCH-unknown-linux-gnu.deb"
    
      38)
    
      39noextract=(
    
      40    "nowledge-mem-$pkgver.deb"
    
      41)
    
      42sha256sums_x86_64=('9366ba745139c49139c80e3078fd2c55e6434c7b7effb75821d0c11745aa846d')
    
      43
    
      44package() {
    
      45    local _deb="$srcdir/nowledge-mem-$pkgver.deb"
    
      46    ar p "$_deb" data.tar.gz | tar xz -C "$pkgdir"
    
      47
    
      48    chmod -R u=rwX,go=rX "$pkgdir"
    
      49
    
      50    local _app_dir="$pkgdir/usr/lib/Nowledge Mem"
    
      51    local _up_dir="$_app_dir/_up_"
    
      52    local _runtime_archive="$_up_dir/python-runtime.tar.zst"
    
      53
    
      54    # Upstream ships the Python runtime compressed and unpacks it in postinst;
    
      55    # unpack at build time instead so pacman owns every installed file.
    
      56    if [[ -f "$_runtime_archive" ]]; then
    
      57        tar --zstd -xf "$_runtime_archive" -C "$_up_dir"
    
      58        if [[ -f "$_up_dir/runtime-version.txt" ]]; then
    
      59            cp "$_up_dir/runtime-version.txt" "$_up_dir/python-standalone/.runtime-version"
    
      60        fi
    
      61        rm -f "$_runtime_archive"
    
      62    fi
    
      63
    
      64    # The upstream Debian layout puts the Tauri GUI in /usr/bin while its
    
      65    # Rust backend lives under /usr/lib, so automatic backend discovery fails.
    
      66    [[ -x "$pkgdir/usr/bin/nowledge-mem" ]]
    
      67    [[ -x "$_up_dir/rust-backend/nmem-server" ]]
    
      68    mv "$pkgdir/usr/bin/nowledge-mem" "$_app_dir/nowledge-mem"
    
      69
    
      70    cat > "$pkgdir/usr/bin/nowledge-mem" << 'EOF'
    
      71#!/bin/sh
    
      72: "${NMEM_SERVER_BIN:=/usr/lib/Nowledge Mem/_up_/rust-backend/nmem-server}"
    
      73export NMEM_SERVER_BIN
    
      74exec "/usr/lib/Nowledge Mem/nowledge-mem" "$@"
    
      75EOF
    
      76    chmod 755 "$pkgdir/usr/bin/nowledge-mem"
    
      77
    
      78    # Expose the bundled Rust CLIs on PATH. Upstream's Debian package ships
    
      79    # them under the private application directory without creating links.
    
      80    local _rust_backend="$_up_dir/rust-backend"
    
      81    [[ -x "$_rust_backend/nmem" ]]
    
      82    [[ -x "$_rust_backend/browse-now" ]]
    
      83    ln -s '/usr/lib/Nowledge Mem/_up_/rust-backend/nmem' \
    
      84        "$pkgdir/usr/bin/nmem"
    
      85    ln -s '/usr/lib/Nowledge Mem/_up_/rust-backend/browse-now' \
    
      86        "$pkgdir/usr/bin/browse-now"
    
      87
    
      88    # Upstream ships no license file; record where the terms live.
    
      89    install -Dm644 /dev/stdin \
    
      90        "$pkgdir/usr/share/licenses/$pkgname/LICENSE" << 'EOF'
    
      91Nowledge Mem is proprietary software.
    
      92Terms of service: https://mem.nowledge.co/terms
    
      93EOF
    
      94}
    
      95

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2