qoder-bin

MEDIUM

maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt RPM from a non-whitelisted host (download.qoder.com) which is not a standard code hosting platform, posing a supply-chain risk if the host is compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "${pkgname%-bin}-${pkgver}.rpm::https://download.qoder.com/qoder-app/releases/latest/${_pkgname}-linux-${CARCH}.rpm"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from a non-whitelisted host (download.qoder.com) which is not a standard code hosting platform, posing a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=qoder-bin
    
      3_pkgname=Qoder
    
      4pkgver=0.2.1
    
      5_electronversion=43
    
      6pkgrel=1
    
      7pkgdesc="Agent Programming Platform for Real Software.(Prebuilt version.Use system-wide electron)"
    
      8arch=('x86_64')
    
      9url="https://qoder.com/"
    
      10_ghurl="https://github.com/QoderAI/changelog-zh_CN"
    
      11license=('LicenseRef-custom')
    
      12conflicts=("${pkgname%-bin}")
    
      13provides=("${pkgname%-bin}=${pkgver}")
    
      14depends=(
    
      15    "electron${_electronversion}"
    
      16    'libsecret'
    
      17    'nodejs'
    
      18)
    
      19makedepends=(
    
      20    'asar'
    
      21)
    
      22optdepends=(
    
      23    'bash'
    
      24    'zsh'
    
      25)
    
      26options=(
    
      27    '!emptydirs'
    
      28    '!strip'
    
      29)
    
      30source=(
    
      31    "${pkgname%-bin}-${pkgver}.rpm::https://download.qoder.com/qoder-app/releases/latest/${_pkgname}-linux-${CARCH}.rpm"
    
      32    "LICENSE.html"
    
      33    "${pkgname%-bin}.sh"
    
      34)
    
      35sha256sums=('505b16066d1c0093b627b93658b81688906edd15ec769f5b70768508cd7657fa'
    
      36            'd93359b3ca57aec94960975eec23b6412dc8fc0c5b5fcbce57bee0931e01ec61'
    
      37            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      38pkgver() {
    
      39    cd "${srcdir}/app.asar.unpacked"
    
      40    grep '"version":' package.json | awk -F'"version": "' '{print $2}' | awk -F',' '{print $1}' | tr -d '"'
    
      41}
    
      42_get_app_dir() {
    
      43    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      44}
    
      45_check_electron_version() {
    
      46    echo "Verifying Electron version..."
    
      47    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
    
      48    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
    
      49    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
    
      50    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
    
      51    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
    
      52        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
    
      53        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      54}
    
      55prepare() {
    
      56    _check_electron_version
    
      57    sed -i -e "
    
      58        s/@electronversion@/${_electronversion}/g
    
      59        s/@appname@/${pkgname%-bin}/g
    
      60        s/@runname@/app.asar/g
    
      61        s/@cfgdirname@/${_pkgname}/g
    
      62    " "${srcdir}/${pkgname%-bin}.sh"
    
      63    sed -i "s/\/opt\/${_pkgname}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      64    local _app_dir=$(_get_app_dir)
    
      65    asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked" || true
    
      66    rm -rf "${_app_dir}/resources/app.asar"
    
      67    find "${srcdir}/app.asar.unpacked/out" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} +
    
      68    asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
    
      69}
    
      70package() {
    
      71    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      72    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
    
      73	local _app_dir=$(_get_app_dir)
    
      74	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      75    ln -sf "/usr/lib/${pkgname%-bin}/app.asar.unpacked/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3" \
    
      76        "${pkgdir}/usr/lib/${pkgname%-bin}/lib/libvips-cpp.so.8.17.3"
    
      77    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      78    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      79		_extension="${_i##*.}"
    
      80		_icon_path="${_i#*share/icons/}"
    
      81		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      82		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      83	done
    
      84    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      85}
    
      86

Changes since previous scan

--- PKGBUILD @ 2026-09-08 00:18
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,8 +1,8 @@
 # Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
 pkgname=qoder-bin
 _pkgname=Qoder
-pkgver=1.24.1
-_electronversion=42
+pkgver=0.2.1
+_electronversion=43
 pkgrel=1
 pkgdesc="Agent Programming Platform for Real Software.(Prebuilt version.Use system-wide electron)"
 arch=('x86_64')
@@ -13,9 +13,11 @@
 provides=("${pkgname%-bin}=${pkgver}")
 depends=(
     "electron${_electronversion}"
-    'libxkbfile'
+    'libsecret'
     'nodejs'
-    'python'
+)
+makedepends=(
+    'asar'
 )
 optdepends=(
     'bash'
@@ -26,18 +28,16 @@
     '!strip'
 )
 source=(
-    "${pkgname%-bin}-${pkgver}.rpm::https://download.qoder.com/release/latest/${pkgname%-bin}_${CARCH}.rpm"
+    "${pkgname%-bin}-${pkgver}.rpm::https://download.qoder.com/qoder-app/releases/latest/${_pkgname}-linux-${CARCH}.rpm"
     "LICENSE.html"
-    "${pkgname%-bin}.js"
     "${pkgname%-bin}.sh"
 )
-sha256sums=('1523ac51f6872b54aeb9b9c22c3bc9d0e15a248420d59f7f7518a45c5d8f6421'
+sha256sums=('505b16066d1c0093b627b93658b81688906edd15ec769f5b70768508cd7657fa'
             'd93359b3ca57aec94960975eec23b6412dc8fc0c5b5fcbce57bee0931e01ec61'
-            '3e78d843645c4cc5709698e0717785acdef5f36e60e3e220801bdf3b8effd799'
-            '700067aa4b354a91ab3374b5495af9eb3093855a3d8016a8303e88abf3470599')
+            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
 pkgver() {
-    cd "${srcdir}/usr/share/${pkgname%-bin}/resources/app"
-    grep '"version":' featureFlags.json | awk -F'"version": "' '{print $2}' | awk -F',' '{print $1}' | tr -d '"'
+    cd "${srcdir}/app.asar.unpacked"
+    grep '"version":' package.json | awk -F'"version": "' '{print $2}' | awk -F',' '{print $1}' | tr -d '"'
 }
 _get_app_dir() {
     find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
@@ -57,36 +57,30 @@
     sed -i -e "
         s/@electronversion@/${_electronversion}/g
         s/@appname@/${pkgname%-bin}/g
-        s/@runname@/app/g
+        s/@runname@/app.asar/g
         s/@cfgdirname@/${_pkgname}/g
     " "${srcdir}/${pkgname%-bin}.sh"
-    sed -i "s/@ELECTRON@/electron${_electronversion}/g" "${srcdir}/${pkgname%-bin}.js"
-    sed -i -e "
-        s/\/usr\/share\/${pkgname%-bin}\///g
-        s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
-    " "${srcdir}/usr/share/applications/${pkgname%-bin}"*.desktop
+    sed -i "s/\/opt\/${_pkgname}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
     local _app_dir=$(_get_app_dir)
-    find "${_app_dir}/resources/app" -name "win32-*" -name "*.node" -delete
-    rm -rf \
-        "${_app_dir}/resources/app/node_modules/windows-foreground-love" \
-        "${_app_dir}/resources/app/node_modules/native-is-elevated" \
-        "${_app_dir}/resources/app/extensions/ms-vscode.js-debug/src/win32-app-container-tokens."*".node"
+    asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked" || true
+    rm -rf "${_app_dir}/resources/app.asar"
+    find "${srcdir}/app.asar.unpacked/out" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} +
+    asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
 }
 package() {
     install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
-    install -Dm755 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
-    local _app_dir=$(_get_app_dir)
-	cp -a "${_app_dir}/resources/app/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
-    install -Dm644 "${srcdir}/usr/share/pixmaps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
-    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}"* -t "${pkgdir}/usr/share/applications"
-    install -Dm644 "${srcdir}/usr/share/appdata/${pkgname%-bin}.appdata.xml" -t "${pkgdir}/usr/share/appdata"
-    install -Dm644 "${srcdir}/usr/share/mime/packages/${pkgname%-bin}-workspace.xml" -t "${pkgdir}/usr/share/mime/packages"
-    if [ -x "/usr/bin/zsh" ];then
-        install -Dm644 "${srcdir}/usr/share/bash-completion/completions/${pkgname%-bin}" -t "${pkgdir}/usr/share/bash-completion/completions"
-    fi
-    if [ -x "/usr/bin/zsh" ];then
-        install -Dm644 "${srcdir}/usr/share/zsh/site-functions/_${pkgname%-bin}" -t "${pkgdir}/usr/share/zsh/site-functions"
-    fi
+    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
+	local _app_dir=$(_get_app_dir)
+	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
+    ln -sf "/usr/lib/${pkgname%-bin}/app.asar.unpacked/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3" \
+        "${pkgdir}/usr/lib/${pkgname%-bin}/lib/libvips-cpp.so.8.17.3"
+    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
+    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
+		_extension="${_i##*.}"
+		_icon_path="${_i#*share/icons/}"
+		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
+		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
+	done
     install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	3
2026-09-16 00:03:17	Medium	3
2026-09-15 00:25:31	Medium	3
2026-09-14 00:27:57	Medium	3
2026-09-13 00:19:54	Medium	3
2026-09-12 00:25:17	Medium	3
2026-09-11 00:19:22	Medium	3
2026-09-10 00:22:44	Medium	3
2026-09-09 00:04:09	Medium	3
2026-09-08 11:17:13	Medium	3
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2