nowledge-mem
maintainer Qingxu
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (download-mem.nowledge.co), which could be swapped with a malicious payload; while the source is hashed, the host's trustworthiness is unclear, posing a supply-chain risk.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:37
"nowledge-mem-$pkgver.deb::https://download-mem.nowledge.co/app/$pkgver/$CARCH-unknown-linux-gnu.deb"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (download-mem.nowledge.co), which could be swapped with a malicious payload; while the source is hashed, the host's trustworthiness is unclear, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Qingxu <me@linioi.com>
2
pkgname=nowledge-mem
3
pkgver=0.10.46
4
pkgrel=1
5
pkgdesc='Local-first memory and context management system for AI-powered workflows'
6
url='https://mem.nowledge.co'
7
arch=(
8
'x86_64'
9
)
10
license=(
11
'LicenseRef-proprietary'
12
)
13
depends=(
14
'gtk3'
15
'webkit2gtk-4.1'
16
'libayatana-appindicator'
17
)
18
makedepends=(
19
'zstd'
20
)
21
optdepends=(
22
'gnome-keyring: for credential storage'
23
'xdg-utils: for opening links and nowledgemem:// URLs'
24
)
25
provides=(
26
'nmem-cli'
27
)
28
conflicts=(
29
'nmem-cli'
30
'nowledge-mem-bin'
31
)
32
options=(
33
'!strip'
34
'!debug'
35
)
36
source_x86_64=(
37
"nowledge-mem-$pkgver.deb::https://download-mem.nowledge.co/app/$pkgver/$CARCH-unknown-linux-gnu.deb"
38
)
39
noextract=(
40
"nowledge-mem-$pkgver.deb"
41
)
42
sha256sums_x86_64=('ced2b3d8d00fae7922c7b3070606717e703b81f5b077695c6351009a756e255b')
43
44
package() {
45
local _deb="$srcdir/nowledge-mem-$pkgver.deb"
46
ar p "$_deb" data.tar.gz | tar xz -C "$pkgdir"
47
48
chmod -R u=rwX,go=rX "$pkgdir"
49
50
local _app_dir="$pkgdir/usr/lib/Nowledge Mem"
51
local _up_dir="$_app_dir/_up_"
52
local _runtime_archive="$_up_dir/python-runtime.tar.zst"
53
54
# Upstream ships the Python runtime compressed and unpacks it in postinst;
55
# unpack at build time instead so pacman owns every installed file.
56
if [[ -f "$_runtime_archive" ]]; then
57
tar --zstd -xf "$_runtime_archive" -C "$_up_dir"
58
if [[ -f "$_up_dir/runtime-version.txt" ]]; then
59
cp "$_up_dir/runtime-version.txt" "$_up_dir/python-standalone/.runtime-version"
60
fi
61
rm -f "$_runtime_archive"
62
fi
63
64
# The upstream Debian layout puts the Tauri GUI in /usr/bin while its
65
# Rust backend lives under /usr/lib, so automatic backend discovery fails.
66
[[ -x "$pkgdir/usr/bin/nowledge-mem" ]]
67
[[ -x "$_up_dir/rust-backend/nmem-server" ]]
68
mv "$pkgdir/usr/bin/nowledge-mem" "$_app_dir/nowledge-mem"
69
70
cat > "$pkgdir/usr/bin/nowledge-mem" << 'EOF'
71
#!/bin/sh
72
: "${NMEM_SERVER_BIN:=/usr/lib/Nowledge Mem/_up_/rust-backend/nmem-server}"
73
export NMEM_SERVER_BIN
74
exec "/usr/lib/Nowledge Mem/nowledge-mem" "$@"
75
EOF
76
chmod 755 "$pkgdir/usr/bin/nowledge-mem"
77
78
# Expose the bundled Rust CLIs on PATH. Upstream's Debian package ships
79
# them under the private application directory without creating links.
80
local _rust_backend="$_up_dir/rust-backend"
81
[[ -x "$_rust_backend/nmem" ]]
82
[[ -x "$_rust_backend/browse-now" ]]
83
ln -s '/usr/lib/Nowledge Mem/_up_/rust-backend/nmem' \
84
"$pkgdir/usr/bin/nmem"
85
ln -s '/usr/lib/Nowledge Mem/_up_/rust-backend/browse-now' \
86
"$pkgdir/usr/bin/browse-now"
87
88
# Upstream ships no license file; record where the terms live.
89
install -Dm644 /dev/stdin \
90
"$pkgdir/usr/share/licenses/$pkgname/LICENSE" << 'EOF'
91
Nowledge Mem is proprietary software.
92
Terms of service: https://mem.nowledge.co/terms
93
EOF
94
}
95
Changes since previous scan
--- PKGBUILD @ 2026-07-31 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -1,6 +1,6 @@ # Maintainer: Qingxu <me@linioi.com> pkgname=nowledge-mem-pkgver=0.10.45+pkgver=0.10.46 pkgrel=1 pkgdesc='Local-first memory and context management system for AI-powered workflows' url='https://mem.nowledge.co'@@ -39,7 +39,7 @@ noextract=( "nowledge-mem-$pkgver.deb" )-sha256sums_x86_64=('77ff7422638861e5192417e6e93e9450f33051ccc95f17c9b6c0b45a4a9888fe')+sha256sums_x86_64=('ced2b3d8d00fae7922c7b3070606717e703b81f5b077695c6351009a756e255b') package() { local _deb="$srcdir/nowledge-mem-$pkgver.deb"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 05:17:13 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 07:10:52 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 07:37:32 | MEDIUM | 1 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 11:35:00 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 15:32:35 | MEDIUM | 1 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 05:29:17 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 07:22:42 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 05:19:42 | MEDIUM | 3 |