qoder-cn-bin
MEDIUM
maintainer zxp19821005
3 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt RPM from a non-standard, non-whitelisted host (ide.qoder.com.cn) with a SKIP'd checksum, posing a supply-chain risk if the binary artifact were tampered with.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
"${pkgname%-bin}-${pkgver}.rpm::https://ide.qoder.com.cn/qoder/release/lastest/${pkgname%-bin}_${CARCH}.rpm"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from a non-standard, non-whitelisted host (ide.qoder.com.cn) with a SKIP'd checksum, posing a supply-chain risk if the binary artifact were tampered with.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=qoder-cn-bin
3
_pkgname=QoderCN
4
pkgver=1.25.1
5
_electronversion=42
6
pkgrel=1
7
pkgdesc="Agent Programming Platform for Real Software.(Prebuilt version.Use system-wide electron)"
8
arch=('x86_64')
9
url="https://qoder.com.cn"
10
license=('LicenseRef-custom')
11
conflicts=("${pkgname%-bin}")
12
provides=("${pkgname%-bin}=${pkgver}")
13
depends=(
14
"electron${_electronversion}"
15
'libxkbfile'
16
'nodejs'
17
'python'
18
)
19
optdepends=(
20
'bash'
21
'zsh'
22
)
23
options=(
24
'!emptydirs'
25
'!strip'
26
)
27
source=(
28
"${pkgname%-bin}-${pkgver}.rpm::https://ide.qoder.com.cn/qoder/release/lastest/${pkgname%-bin}_${CARCH}.rpm"
29
"LICENSE.html"
30
"${pkgname%-bin}.js"
31
"${pkgname%-bin}.sh"
32
)
33
sha256sums=('SKIP'
34
'64a79bddff14167a290d3547d7b4bd00cf693be6d11fb6b7018bca9d9d778ab4'
35
'5956a85ba4da0a580d2e93197fd5de03eee3be3d541aab68562435a09a3e94fe'
36
'700067aa4b354a91ab3374b5495af9eb3093855a3d8016a8303e88abf3470599')
37
pkgver() {
38
cd "${srcdir}/usr/share/${pkgname%-bin}/resources/app"
39
grep '"version":' featureFlags.json | awk -F'"version": "' '{print $2}' | awk -F',' '{print $1}' | tr -d '"'
40
}
41
_get_app_dir() {
42
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
43
}
44
_check_electron_version() {
45
echo "Verifying Electron version..."
46
local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
47
[[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
48
local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
49
[[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
50
[[ "${_elec_ver}" != "${_electronversion}" ]] &&
51
echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
52
echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
53
}
54
prepare() {
55
_check_electron_version
56
sed -i -e "
57
s/@electronversion@/${_electronversion}/g
58
s/@appname@/${pkgname%-bin}/g
59
s/@runname@/app/g
60
s/@cfgdirname@/${_pkgname}/g
61
" "${srcdir}/${pkgname%-bin}.sh"
62
sed -i "s/@ELECTRON@/electron${_electronversion}/g" "${srcdir}/${pkgname%-bin}.js"
63
sed -i -e "
64
s/\/usr\/share\/${pkgname%-bin}\///g
65
s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
66
s/StartupWMClass=${_pkgname}/StartupWMClass=${pkgname%-bin}/g
67
" "${srcdir}/usr/share/applications/${pkgname%-bin}"*.desktop
68
local _app_dir=$(_get_app_dir)
69
find "${_app_dir}/resources/app" -name "win32-*" -name "*.node" -delete
70
}
71
package() {
72
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
73
install -Dm755 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
74
local _app_dir=$(_get_app_dir)
75
cp -a "${_app_dir}/resources/app/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
76
install -Dm644 "${srcdir}/usr/share/pixmaps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
77
install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}"* -t "${pkgdir}/usr/share/applications"
78
install -Dm644 "${srcdir}/usr/share/appdata/${pkgname%-bin}.appdata.xml" -t "${pkgdir}/usr/share/appdata"
79
install -Dm644 "${srcdir}/usr/share/mime/packages/${pkgname%-bin}-workspace.xml" -t "${pkgdir}/usr/share/mime/packages"
80
if [ -x "/usr/bin/zsh" ];then
81
install -Dm644 "${srcdir}/usr/share/bash-completion/completions/${pkgname%-bin}" -t "${pkgdir}/usr/share/bash-completion/completions"
82
fi
83
if [ -x "/usr/bin/zsh" ];then
84
install -Dm644 "${srcdir}/usr/share/zsh/site-functions/_${pkgname%-bin}" -t "${pkgdir}/usr/share/zsh/site-functions"
85
fi
86
install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
87
}
88
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |