qoder-cn

MEDIUM

maintainer duanluan 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Installs a prebuilt proprietary .deb binary from an Alibaba OSS bucket (qoder-app.oss-cn-beijing.aliyuncs.com), which is plausibly the project's own official distribution channel but is an unverifiable object storage host where the artifact could be silently swapped; the SHA256 checksum provides some integrity guarantee, mitigating the risk somewhat.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "Qoder-CN-linux-${pkgver}-amd64.deb::https://qoder-app.oss-cn-beijing.aliyuncs.com/qoder-app/releases/${pkgver}/Qoder-CN-linux-amd64.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary .deb binary from an Alibaba OSS bucket (qoder-app.oss-cn-beijing.aliyuncs.com), which is plausibly the project's own official distribution channel but is an unverifiable object storage host where the artifact could be silently swapped; the SHA256 checksum provides some integrity guarantee, mitigating the risk somewhat.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=qoder-cn
    
      4pkgver=0.4.4
    
      5pkgrel=1
    
      6pkgdesc='Qoder CN desktop app, an agentic coding workbench from Alibaba'
    
      7arch=('x86_64')
    
      8url='https://qoder.cn/'
    
      9license=('LicenseRef-Proprietary')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'gtk3'
    
      14  'hicolor-icon-theme'
    
      15  'libnotify'
    
      16  'libsecret'
    
      17  'libxss'
    
      18  'libxtst'
    
      19  'nss'
    
      20  'util-linux-libs'
    
      21  'xdg-utils'
    
      22)
    
      23optdepends=(
    
      24  'libappindicator-gtk3: system tray icon support'
    
      25)
    
      26conflicts=('qoder-cn-bin')
    
      27options=('!strip')
    
      28source_x86_64=(
    
      29  "Qoder-CN-linux-${pkgver}-amd64.deb::https://qoder-app.oss-cn-beijing.aliyuncs.com/qoder-app/releases/${pkgver}/Qoder-CN-linux-amd64.deb"
    
      30)
    
      31noextract=("Qoder-CN-linux-${pkgver}-amd64.deb")
    
      32sha256sums_x86_64=(
    
      33  'f173172ec619ed46f1926b3715647bc54df6a2d4c152243c489566c90ea85335'
    
      34)
    
      35
    
      36package() {
    
      37  cd "${srcdir}"
    
      38
    
      39  bsdtar -xf "Qoder-CN-linux-${pkgver}-amd64.deb" data.tar.xz
    
      40  bsdtar -xf data.tar.xz -C "${pkgdir}"
    
      41
    
      42  # Electron's sandbox helper must retain its setuid bit for sandboxed renderers.
    
      43  chmod 4755 "${pkgdir}/opt/Qoder CN/chrome-sandbox"
    
      44
    
      45  install -dm755 "${pkgdir}/usr/bin"
    
      46  ln -s "/opt/Qoder CN/qoder-cn" "${pkgdir}/usr/bin/qoder-cn"
    
      47
    
      48  install -Dm644 "${pkgdir}/opt/Qoder CN/LICENSE.electron.txt" \
    
      49    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      50  install -Dm644 "${pkgdir}/opt/Qoder CN/LICENSES.chromium.html" \
    
      51    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 07:10:53	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 09:33:59	Medium	3
2026-10-14 09:19:50	Medium	3