qoder-cn-bin

MEDIUM
maintainer zxp19821005 5 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package downloads a prebuilt RPM from an Alibaba Cloud OSS bucket (non-standard, non-project-owned host) with a SKIP'd checksum, posing a supply-chain risk if the source were tampered with, as it is an unverifiable executable payload.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:30 "${pkgname%-bin}-${pkgver}.rpm::https://qoder-app.oss-cn-beijing.aliyuncs.com/qoder-app/releases/latest/${_pkgname}-linux-${CARCH}.rpm"
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from an Alibaba Cloud OSS bucket (non-standard, non-project-owned host) with a SKIP'd checksum, posing a supply-chain risk if the source were tampered with, as it is an unverifiable executable payload.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=qoder-cn-bin
3_pkgname=Qoder-CN
4pkgver=0.4.8
5_electronversion=43
6pkgrel=1
7pkgdesc="Qoder 全新形态，以编程智能体为核心引擎，从想法到实现，轻松搞定。"
8arch=('x86_64')
9url="https://qoder.cn"
10license=('LicenseRef-custom')
11conflicts=("${pkgname%-bin}")
12provides=("${pkgname%-bin}=${pkgver}")
13depends=(
14 "electron${_electronversion}"
15 'libsecret'
16 'nodejs'
17)
18makedepends=(
19 'asar'
20)
21optdepends=(
22 'bash'
23 'zsh'
24)
25options=(
26 '!emptydirs'
27 '!strip'
28)
29source=(
30 "${pkgname%-bin}-${pkgver}.rpm::https://qoder-app.oss-cn-beijing.aliyuncs.com/qoder-app/releases/latest/${_pkgname}-linux-${CARCH}.rpm"
31 "LICENSE.html"
32 "resources-path-override.js"
33 "${pkgname%-bin}.sh"
34)
35sha256sums=('SKIP'
36 '64a79bddff14167a290d3547d7b4bd00cf693be6d11fb6b7018bca9d9d778ab4'
37 '7860b52642f7f9cac7341253149e5ac9b75deb338c2cf507c90e49a05d3adeb8'
38 '523a9e7294fb8d0611611db823288e3dc38ae021eceb3067791dc0c4ff3b0d15')
39pkgver() {
40 cat "${srcdir}/.pkgver" 2>/dev/null || echo "${pkgver}"
41}
42_get_app_dir() {
43 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
44 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
45}
46_check_electron_version() {
47 local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
48 -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
49 | grep -oP 'Electron/\K[0-9]+' | head -1)
50 [[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
51 (( _v == _electronversion )) && c=32 || c=31
52 echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
53}
54prepare() {
55 _check_electron_version
56 sed -i -e "
57 s/@electronversion@/${_electronversion}/g
58 s/@appname@/${pkgname%-bin}/g
59 " "${srcdir}/${pkgname%-bin}.sh" "${srcdir}/resources-path-override.js"
60 sed -i "s/\/opt\/${_pkgname}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
61 ( cd "${srcdir}" && asar ef "$(_get_app_dir)/resources/app.asar" package.json )
62 grep -oP '"version":\s*"\K[^"]+' "${srcdir}/package.json" > "${srcdir}/.pkgver"
63}
64package() {
65 install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
66 install -Dm644 "${srcdir}/resources-path-override.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
67 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
68 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
69 ln -sf "/usr/lib/${pkgname%-bin}/app.asar.unpacked/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3" \
70 "${pkgdir}/usr/lib/${pkgname%-bin}/lib/libvips-cpp.so.8.17.3"
71 install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
72 find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
73 _extension="${_i##*.}"
74 _icon_path="${_i#*share/icons/}"
75 _target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
76 install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
77 done
78 install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
79}
80

Changes since previous scan

--- PKGBUILD @ 2026-10-21 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,9 +1,9 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=qoder-cn-bin
_pkgname=Qoder-CN
-pkgver=0.4.3
+pkgver=0.4.8
_electronversion=43
-pkgrel=2
+pkgrel=1
pkgdesc="Qoder 全新形态，以编程智能体为核心引擎，从想法到实现，轻松搞定。"
arch=('x86_64')
url="https://qoder.cn"
@@ -29,49 +29,43 @@
source=(
"${pkgname%-bin}-${pkgver}.rpm::https://qoder-app.oss-cn-beijing.aliyuncs.com/qoder-app/releases/latest/${_pkgname}-linux-${CARCH}.rpm"
"LICENSE.html"
+ "resources-path-override.js"
"${pkgname%-bin}.sh"
)
sha256sums=('SKIP'
'64a79bddff14167a290d3547d7b4bd00cf693be6d11fb6b7018bca9d9d778ab4'
- 'cebedc3391cbab6d43f37fbf3a87ddaad16597cb5ea487a4d55b1f478d810082')
+ '7860b52642f7f9cac7341253149e5ac9b75deb338c2cf507c90e49a05d3adeb8'
+ '523a9e7294fb8d0611611db823288e3dc38ae021eceb3067791dc0c4ff3b0d15')
pkgver() {
- cd "${srcdir}/app.asar.unpacked"
- grep '"version":' package.json | awk -F'"version": "' '{print $2}' | awk -F',' '{print $1}' | tr -d '"'
+ cat "${srcdir}/.pkgver" 2>/dev/null || echo "${pkgver}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_check_electron_version() {
- echo "Verifying Electron version..."
- local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
- [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
- local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
- [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
- [[ "${_elec_ver}" != "${_electronversion}" ]] &&
- echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
- echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
+ local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
+ -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
+ | grep -oP 'Electron/\K[0-9]+' | head -1)
+ [[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
+ (( _v == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
}
prepare() {
_check_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-bin}/g
- s/@runname@/app.asar/g
- " "${srcdir}/${pkgname%-bin}.sh"
- sed -i "s/\"\/opt\/${_pkgname//-/ }\/${pkgname%-bin}\"/${pkgname%-bin}/g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
- local _app_dir="$(_get_app_dir)"
- asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked" || true
- find "${srcdir}/app.asar.unpacked/out" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} +
- find "${srcdir}/" \
- \( -name "*win32*" -o -name "*darwin*" -o -name "*arm*" \) \
- -exec rm -rf {} +
- asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
+ " "${srcdir}/${pkgname%-bin}.sh" "${srcdir}/resources-path-override.js"
+ sed -i "s/\/opt\/${_pkgname}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
+ ( cd "${srcdir}" && asar ef "$(_get_app_dir)/resources/app.asar" package.json )
+ grep -oP '"version":\s*"\K[^"]+' "${srcdir}/package.json" > "${srcdir}/.pkgver"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
+ install -Dm644 "${srcdir}/resources-path-override.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
- local _app_dir="$(_get_app_dir)"
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
ln -sf "/usr/lib/${pkgname%-bin}/app.asar.unpacked/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3" \
"${pkgdir}/usr/lib/${pkgname%-bin}/lib/libvips-cpp.so.8.17.3"
install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Medium 2
2026-10-31 00:07:41 Medium 2
2026-10-30 00:29:30 Medium 2
2026-10-29 00:13:55 Medium 2
2026-10-28 00:06:54 Medium 2
2026-10-27 00:23:28 Medium 2
2026-10-26 03:43:44 Medium 2
2026-10-26 00:12:40 Medium 2
2026-10-25 00:20:48 Medium 2
2026-10-24 00:14:55 Medium 2
2026-10-23 00:02:19 Medium 2
2026-10-22 00:13:10 Medium 2
2026-10-21 03:30:06 Medium 2
2026-10-21 00:12:50 Medium 2
2026-10-20 00:10:31 Medium 2
2026-10-19 00:03:55 Medium 2
2026-10-18 00:06:55 Medium 2
2026-10-17 00:21:55 Medium 2
2026-10-16 00:12:47 Medium 2
2026-10-15 00:28:05 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion