nowledge-mem
MEDIUM
maintainer Qingxu
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from a non-whitelisted, project-owned host (download-mem.nowledge.co); while likely legitimate, the binary package is unverifiable and could be silently replaced, posing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:37
"nowledge-mem-$pkgver.deb::https://download-mem.nowledge.co/app/$pkgver/$CARCH-unknown-linux-gnu.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted, project-owned host (download-mem.nowledge.co); while likely legitimate, the binary package is unverifiable and could be silently replaced, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Qingxu <me@linioi.com>
2
pkgname=nowledge-mem
3
pkgver=0.10.101
4
pkgrel=1
5
pkgdesc='Local-first memory and context management system for AI-powered workflows'
6
url='https://mem.nowledge.co'
7
arch=(
8
'x86_64'
9
)
10
license=(
11
'LicenseRef-proprietary'
12
)
13
depends=(
14
'gtk3'
15
'webkit2gtk-4.1'
16
'libayatana-appindicator'
17
)
18
makedepends=(
19
'zstd'
20
)
21
optdepends=(
22
'gnome-keyring: for credential storage'
23
'xdg-utils: for opening links and nowledgemem:// URLs'
24
)
25
provides=(
26
'nmem-cli'
27
)
28
conflicts=(
29
'nmem-cli'
30
'nowledge-mem-bin'
31
)
32
options=(
33
'!strip'
34
'!debug'
35
)
36
source_x86_64=(
37
"nowledge-mem-$pkgver.deb::https://download-mem.nowledge.co/app/$pkgver/$CARCH-unknown-linux-gnu.deb"
38
)
39
noextract=(
40
"nowledge-mem-$pkgver.deb"
41
)
42
sha256sums_x86_64=('306d03d28867f9cba3292ab632924b48d85d1d9cc263fe49b707d581c7dfc684')
43
44
package() {
45
local _deb="$srcdir/nowledge-mem-$pkgver.deb"
46
ar p "$_deb" data.tar.gz | tar xz -C "$pkgdir"
47
48
chmod -R u=rwX,go=rX "$pkgdir"
49
50
local _app_dir="$pkgdir/usr/lib/Nowledge Mem"
51
local _up_dir="$_app_dir/_up_"
52
local _runtime_archive="$_up_dir/python-runtime.tar.zst"
53
54
# Upstream ships the Python runtime compressed and unpacks it in postinst;
55
# unpack at build time instead so pacman owns every installed file.
56
if [[ -f "$_runtime_archive" ]]; then
57
tar --zstd -xf "$_runtime_archive" -C "$_up_dir"
58
if [[ -f "$_up_dir/runtime-version.txt" ]]; then
59
cp "$_up_dir/runtime-version.txt" "$_up_dir/python-standalone/.runtime-version"
60
fi
61
rm -f "$_runtime_archive"
62
fi
63
64
# The upstream Debian layout puts the Tauri GUI in /usr/bin while its
65
# Rust backend lives under /usr/lib, so automatic backend discovery fails.
66
[[ -x "$pkgdir/usr/bin/nowledge-mem" ]]
67
[[ -x "$_up_dir/rust-backend/nmem-server" ]]
68
mv "$pkgdir/usr/bin/nowledge-mem" "$_app_dir/nowledge-mem"
69
70
cat > "$pkgdir/usr/bin/nowledge-mem" << 'EOF'
71
#!/bin/sh
72
: "${NMEM_SERVER_BIN:=/usr/lib/Nowledge Mem/_up_/rust-backend/nmem-server}"
73
export NMEM_SERVER_BIN
74
exec "/usr/lib/Nowledge Mem/nowledge-mem" "$@"
75
EOF
76
chmod 755 "$pkgdir/usr/bin/nowledge-mem"
77
78
# Expose the bundled Rust CLIs on PATH. Upstream's Debian package ships
79
# them under the private application directory without creating links.
80
local _rust_backend="$_up_dir/rust-backend"
81
[[ -x "$_rust_backend/nmem" ]]
82
[[ -x "$_rust_backend/browse-now" ]]
83
ln -s '/usr/lib/Nowledge Mem/_up_/rust-backend/nmem' \
84
"$pkgdir/usr/bin/nmem"
85
ln -s '/usr/lib/Nowledge Mem/_up_/rust-backend/browse-now' \
86
"$pkgdir/usr/bin/browse-now"
87
88
# Upstream ships no license file; record where the terms live.
89
install -Dm644 /dev/stdin \
90
"$pkgdir/usr/share/licenses/$pkgname/LICENSE" << 'EOF'
91
Nowledge Mem is proprietary software.
92
Terms of service: https://mem.nowledge.co/terms
93
EOF
94
}
95
Changes since previous scan
--- PKGBUILD @ 2026-10-27 00:23+++ PKGBUILD @ 2026-11-01 00:21@@ -1,6 +1,6 @@ # Maintainer: Qingxu <me@linioi.com> pkgname=nowledge-mem-pkgver=0.10.100+pkgver=0.10.101 pkgrel=1 pkgdesc='Local-first memory and context management system for AI-powered workflows' url='https://mem.nowledge.co'@@ -39,7 +39,7 @@ noextract=( "nowledge-mem-$pkgver.deb" )-sha256sums_x86_64=('18a35cee3c1dcadc824d8a392d2a8bd23a68982eef747afe0a874bd8d063ecf1')+sha256sums_x86_64=('306d03d28867f9cba3292ab632924b48d85d1d9cc263fe49b707d581c7dfc684') package() { local _deb="$srcdir/nowledge-mem-$pkgver.deb"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 07:47:02 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |