nowledge-mem-bin

MEDIUM

maintainer czyt 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb binary from a non-standard, non-whitelisted host (download-mem.nowledge.co), which is not the project's primary domain, creating a supply-chain risk if the host is compromised or swappable.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-standard, non-whitelisted host (download-mem.nowledge.co), which is not the project's primary domain, creating a supply-chain risk if the host is compromised or swappable.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=nowledge-mem-bin
    
      3pkgver=0.10.82
    
      4pkgrel=1
    
      5pkgdesc="你的智能体、AI 助手、代码工具，共享一套记忆"
    
      6arch=('x86_64')
    
      7url="https://mem.nowledge.co"
    
      8license=('Proprietary')
    
      9options=(!debug !strip)
    
      10depends=('gtk3' 'webkit2gtk-4.1' 'libayatana-appindicator')
    
      11optdepends=('gnome-keyring: for credential storage'
    
      12            'xdg-utils: for opening links and nowledgemem:// URLs')
    
      13provides=("nowledge-mem=${pkgver}" "nmem-cli=${pkgver}")
    
      14conflicts=('nowledge-mem' 'nmem-cli')
    
      15source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")
    
      16sha256sums_x86_64=('94cb033ddb7ff66dd13b7c0cc1adc5dcaa29ff1544a8a08a7555dcce02ea07c9')
    
      17
    
      18package() {
    
      19    local _debfile="nowledge-mem-${pkgver}.deb"
    
      20    ar p "${srcdir}/${_debfile}" data.tar.gz | tar xz -C "${pkgdir}"
    
      21
    
      22    chmod -R u=rwX,go=rX "${pkgdir}"
    
      23
    
      24    # The Rust backend is bundled beside the GUI resources. Keep the real GUI
    
      25    # there and use a launcher to tell Tauri exactly where nmem-server lives.
    
      26    mv "${pkgdir}/usr/bin/nowledge-mem" \
    
      27       "${pkgdir}/usr/lib/Nowledge Mem/nowledge-mem"
    
      28    cat > "${pkgdir}/usr/bin/nowledge-mem" << 'EOF'
    
      29#!/bin/sh
    
      30export NMEM_SERVER_BIN="/usr/lib/Nowledge Mem/_up_/rust-backend/nmem-server"
    
      31exec "/usr/lib/Nowledge Mem/nowledge-mem" "$@"
    
      32EOF
    
      33    chmod 755 "${pkgdir}/usr/bin/nowledge-mem"
    
      34
    
      35    # Expose the native Rust CLIs shipped by upstream.
    
      36    ln -s "/usr/lib/Nowledge Mem/_up_/rust-backend/nmem" \
    
      37          "${pkgdir}/usr/bin/nmem"
    
      38    ln -s "/usr/lib/Nowledge Mem/_up_/rust-backend/browse-now" \
    
      39          "${pkgdir}/usr/bin/browse-now"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-09-15 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,6 +1,6 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=nowledge-mem-bin
-pkgver=0.10.81
+pkgver=0.10.82
 pkgrel=1
 pkgdesc="你的智能体、AI 助手、代码工具，共享一套记忆"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 provides=("nowledge-mem=${pkgver}" "nmem-cli=${pkgver}")
 conflicts=('nowledge-mem' 'nmem-cli')
 source_x86_64=("nowledge-mem-${pkgver}.deb::https://download-mem.nowledge.co/app/${pkgver}/x86_64-unknown-linux-gnu.deb")
-sha256sums_x86_64=('2937845ab4ece68e7c555055750ad65f7b969c48354d20398b74779f8666182c')
+sha256sums_x86_64=('94cb033ddb7ff66dd13b7c0cc1adc5dcaa29ff1544a8a08a7555dcce02ea07c9')
 
 package() {
     local _debfile="nowledge-mem-${pkgver}.deb"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 17:20:16	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 03:10:21	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 03:18:52	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 03:59:20	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 03:56:15	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2