nowledge-mem-bin

maintainer czyt · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-whitelisted, project-specific domain (download-mem.nowledge.co), which could be swapped by an unrelated party; it contains bundled Python code and runtime, posing a supply-chain risk if the source were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted, project-specific domain (download-mem.nowledge.co), which could be swapped by an unrelated party; it contains bundled Python code and runtime, posing a supply-chain risk if the source were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=nowledge-mem-bin
    
      3pkgver=0.10.47
    
      4pkgrel=1
    
      5pkgdesc="你的智能体、AI 助手、代码工具，共享一套记忆"
    
      6arch=('x86_64')
    
      7url="https://mem.nowledge.co"
    
      8license=('Proprietary')
    
      9options=(!debug !strip)
    
      10depends=('gtk3' 'webkit2gtk-4.1' 'libayatana-appindicator')
    
      11makedepends=('zstd')
    
      12optdepends=('gnome-keyring: for credential storage'
    
      13            'xdg-utils: for opening links and nowledgemem:// URLs')
    
      14provides=("nowledge-mem=${pkgver}" "nmem-cli=${pkgver}")
    
      15conflicts=('nowledge-mem' 'nmem-cli')
    
      16source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")
    
      17sha256sums_x86_64=('e04bc5b03ef5c4d1e490b8ce81100e82cc68b842da67eb9e9b70d78be483e2cc')
    
      18
    
      19package() {
    
      20    # Extract deb package
    
      21    local _debfile="nowledge-mem-${pkgver}.deb"
    
      22    ar p "${srcdir}/${_debfile}" data.tar.gz | tar xz -C "${pkgdir}"
    
      23
    
      24    # Fix permissions
    
      25    chmod -R u=rwX,go=rX "${pkgdir}"
    
      26
    
      27    # Extract bundled Python runtime (required for backend and CLI)
    
      28    local _up_dir="${pkgdir}/usr/lib/Nowledge Mem/_up_"
    
      29    local _runtime_archive="${_up_dir}/python-runtime.tar.zst"
    
      30    if [ -f "${_runtime_archive}" ]; then
    
      31        tar --zstd -xf "${_runtime_archive}" -C "${_up_dir}"
    
      32        if [ -f "${_up_dir}/runtime-version.txt" ]; then
    
      33            cp "${_up_dir}/runtime-version.txt" "${_up_dir}/python-standalone/.runtime-version"
    
      34        fi
    
      35        rm -f "${_runtime_archive}"
    
      36    fi
    
      37
    
      38    # Install CLI wrappers exposed by the upstream Linux package.
    
      39    local _install_path="${_up_dir}/python-standalone"
    
      40    if [ -d "${_install_path}/python" ] && [ -f "${_install_path}/app/src/nowledge_graph_server/ncli.py" ]; then
    
      41        install -dm755 "${pkgdir}/usr/bin"
    
      42
    
      43        cat > "${pkgdir}/usr/bin/nmem" << 'EOF'
    
      44#!/bin/bash
    
      45PYTHON_STANDALONE="/usr/lib/Nowledge Mem/_up_/python-standalone"
    
      46PYTHON="$PYTHON_STANDALONE/python/bin/python3"
    
      47NCLI="$PYTHON_STANDALONE/app/src/nowledge_graph_server/ncli.py"
    
      48export PYTHONPATH="$PYTHON_STANDALONE/app/src:$PYTHONPATH"
    
      49exec "$PYTHON" -m nowledge_graph_server.ncli "$@"
    
      50EOF
    
      51        chmod 755 "${pkgdir}/usr/bin/nmem"
    
      52
    
      53        if compgen -G "${_install_path}/python/lib/python*/site-packages/browse_now/cli.py" > /dev/null; then
    
      54            cat > "${pkgdir}/usr/bin/browse-now" << 'EOF'
    
      55#!/bin/bash
    
      56PYTHON_STANDALONE="/usr/lib/Nowledge Mem/_up_/python-standalone"
    
      57PYTHON="$PYTHON_STANDALONE/python/bin/python3"
    
      58export PYTHONPATH="$PYTHON_STANDALONE/app/src:$PYTHONPATH"
    
      59exec "$PYTHON" -c "from browse_now.cli import main; main()" "$@"
    
      60EOF
    
      61            chmod 755 "${pkgdir}/usr/bin/browse-now"
    
      62        fi
    
      63    fi
    
      64}
    
      65

Changes since previous scan

--- PKGBUILD @ 2026-07-30 03:13
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=nowledge-mem-bin
-pkgver=0.10.46
+pkgver=0.10.47
 pkgrel=1
 pkgdesc="你的智能体、AI 助手、代码工具，共享一套记忆"
 arch=('x86_64')
@@ -14,7 +14,7 @@
 provides=("nowledge-mem=${pkgver}" "nmem-cli=${pkgver}")
 conflicts=('nowledge-mem' 'nmem-cli')
 source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")
-sha256sums_x86_64=('ced2b3d8d00fae7922c7b3070606717e703b81f5b077695c6351009a756e255b')
+sha256sums_x86_64=('e04bc5b03ef5c4d1e490b8ce81100e82cc68b842da67eb9e9b70d78be483e2cc')
 
 package() {
     # Extract deb package

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 03:17:12	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 15:15:12	MEDIUM	2
2026-07-30 03:13:55	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 03:10:20	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 03:37:00	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 15:35:03	MEDIUM	2
2026-07-27 03:34:02	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 03:31:41	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 03:28:44	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 03:27:03	MEDIUM	2