qoderwake-bin

MEDIUM

maintainer lzsnyy 0 votes scanned 2026-11-05 16:09:47.219016

View on AUR

Why flagged

Prebuilt binaries downloaded from download.qoder.com, a non-whitelisted vendor subdomain with few votes and a recently uploaded package; the domain is plausibly the project's own official release infrastructure but cannot be independently verified, and the binaries are installed and run directly without source review.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "qoderwake-${pkgver}-linux-amd64.tar.gz::https://download.qoder.com/qoderwake/releases/${pkgver}/qoderwake_${pkgver}_linux_amd64.tar.gz"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): Prebuilt binaries downloaded from download.qoder.com, a non-whitelisted vendor subdomain with few votes and a recently uploaded package; the domain is plausibly the project's own official release infrastructure but cannot be independently verified, and the binaries are installed and run directly without source review.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lzsnyy <710080675@qq.com>
    
      2#
    
      3# Upstream only ships install.sh, which downloads the Linux runtime tarball
    
      4# from the release channel and unpacks qoderwake + the bundled qodercli into
    
      5# ~/.qoderwake. This package installs that same archive system-wide.
    
      6#
    
      7# The resources/ directory must stay next to the qoderwake executable: the
    
      8# daemon reads it from the install directory and mirrors it into
    
      9# ~/.qoderwake/runtime-resources on first start.
    
      10#
    
      11# The runtime archive carries no LICENSE/COPYING text, so the package declares
    
      12# LicenseRef-custom and cannot install a license file; terms are those of the
    
      13# QoderWake service (https://qoder.com/).
    
      14
    
      15pkgname=qoderwake-bin
    
      16pkgver=1.2.11
    
      17pkgrel=1
    
      18pkgdesc="QoderWake local CLI and daemon (official prebuilt Linux runtime)"
    
      19arch=('x86_64' 'aarch64')
    
      20url='https://qoder.com/'
    
      21license=('LicenseRef-custom')
    
      22depends=('glibc' 'python')
    
      23optdepends=('xdg-utils: open the QoderWake console in the default browser')
    
      24options=('!strip' '!debug')
    
      25provides=("${pkgname%-bin}=${pkgver}")
    
      26conflicts=("${pkgname%-bin}")
    
      27
    
      28source_x86_64=(
    
      29  "qoderwake-${pkgver}-linux-amd64.tar.gz::https://download.qoder.com/qoderwake/releases/${pkgver}/qoderwake_${pkgver}_linux_amd64.tar.gz"
    
      30)
    
      31source_aarch64=(
    
      32  "qoderwake-${pkgver}-linux-arm64.tar.gz::https://download.qoder.com/qoderwake/releases/${pkgver}/qoderwake_${pkgver}_linux_arm64.tar.gz"
    
      33)
    
      34sha256sums_x86_64=('76e1fb306e5427e6457a633430638ea88a58350552b03b4175cc12ae48704518')
    
      35sha256sums_aarch64=('f85d40543faa49b8f7152f84357e44730508c211fb42522af0f0edf66e6f4a96')
    
      36
    
      37package() {
    
      38  # The tarball has no top-level directory, so makepkg extracts it flat into
    
      39  # $srcdir.
    
      40  install -dm755 "${pkgdir}/usr/lib/qoderwake/qodercli"
    
      41  install -m755 "${srcdir}/qoderwake" "${pkgdir}/usr/lib/qoderwake/qoderwake"
    
      42  install -m755 "${srcdir}/qodercli/qodercli-wake" \
    
      43    "${pkgdir}/usr/lib/qoderwake/qodercli/qodercli-wake"
    
      44  cp -a "${srcdir}/resources" "${pkgdir}/usr/lib/qoderwake/"
    
      45  find "${pkgdir}/usr/lib/qoderwake" -type d -name __pycache__ -prune -exec rm -rf {} +
    
      46
    
      47  install -dm755 "${pkgdir}/usr/bin"
    
      48  ln -s ../lib/qoderwake/qoderwake "${pkgdir}/usr/bin/qoderwake"
    
      49  ln -s ../lib/qoderwake/qodercli/qodercli-wake "${pkgdir}/usr/bin/qodercli-wake"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 16:09:47	Medium	3
2026-11-05 14:11:32	Medium	3
2026-11-05 14:09:10	Medium	2