nowledge-mem-bin

MEDIUM

maintainer czyt 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted host (download-mem.nowledge.co), which is not a standard code hosting platform, posing a supply-chain risk if the host is compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted host (download-mem.nowledge.co), which is not a standard code hosting platform, posing a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=nowledge-mem-bin
    
      3pkgver=0.10.111
    
      4pkgrel=1
    
      5pkgdesc="你的智能体、AI 助手、代码工具，共享一套记忆"
    
      6arch=('x86_64')
    
      7url="https://mem.nowledge.co"
    
      8license=('Proprietary')
    
      9options=(!debug !strip)
    
      10depends=('gtk3' 'webkit2gtk-4.1' 'libayatana-appindicator')
    
      11optdepends=('gnome-keyring: for credential storage'
    
      12            'xdg-utils: for opening links and nowledgemem:// URLs')
    
      13provides=("nowledge-mem=${pkgver}" "nmem-cli=${pkgver}")
    
      14conflicts=('nowledge-mem' 'nmem-cli')
    
      15source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")
    
      16sha256sums_x86_64=('ac3799051ee703213dca22e83706a339953ece74ea923df1c9fa3382f91e3f97')
    
      17
    
      18package() {
    
      19    local _debfile="nowledge-mem-${pkgver}.deb"
    
      20    ar p "${srcdir}/${_debfile}" data.tar.gz | tar xz -C "${pkgdir}"
    
      21
    
      22    chmod -R u=rwX,go=rX "${pkgdir}"
    
      23
    
      24    # The Rust backend is bundled beside the GUI resources. Keep the real GUI
    
      25    # there and use a launcher to tell Tauri exactly where nmem-server lives.
    
      26    mv "${pkgdir}/usr/bin/nowledge-mem" \
    
      27       "${pkgdir}/usr/lib/Nowledge Mem/nowledge-mem"
    
      28    cat > "${pkgdir}/usr/bin/nowledge-mem" << 'EOF'
    
      29#!/bin/sh
    
      30export NMEM_SERVER_BIN="/usr/lib/Nowledge Mem/_up_/rust-backend/nmem-server"
    
      31exec "/usr/lib/Nowledge Mem/nowledge-mem" "$@"
    
      32EOF
    
      33    chmod 755 "${pkgdir}/usr/bin/nowledge-mem"
    
      34
    
      35    # Expose the native Rust CLIs shipped by upstream.
    
      36    ln -s "/usr/lib/Nowledge Mem/_up_/rust-backend/nmem" \
    
      37          "${pkgdir}/usr/bin/nmem"
    
      38    ln -s "/usr/lib/Nowledge Mem/_up_/rust-backend/browse-now" \
    
      39          "${pkgdir}/usr/bin/browse-now"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=nowledge-mem-bin
-pkgver=0.10.109
+pkgver=0.10.111
 pkgrel=1
 pkgdesc="你的智能体、AI 助手、代码工具，共享一套记忆"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 provides=("nowledge-mem=${pkgver}" "nmem-cli=${pkgver}")
 conflicts=('nowledge-mem' 'nmem-cli')
 source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")
-sha256sums_x86_64=('10174a648ba69918b274d912472c12fe42df1d32cd734714b1c5beee176ab5c9')
+sha256sums_x86_64=('ac3799051ee703213dca22e83706a339953ece74ea923df1c9fa3382f91e3f97')
 
 package() {
     local _debfile="nowledge-mem-${pkgver}.deb"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 17:56:37	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 17:50:30	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 17:48:24	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 03:43:44	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 03:41:34	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 03:39:05	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 17:32:44	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2