qoderwake-cn-bin

MEDIUM

maintainer lzsnyy 0 votes scanned 2026-11-05 16:09:47.219016

View on AUR

Why flagged

Installs prebuilt binaries downloaded from ide.qoder.com.cn, a non-standard Chinese host unrelated to any major forge or well-known vendor infrastructure; while the host appears to be the project's own release channel and SHA256 checksums are provided, the binaries are unverifiable closed-source executables from a low-trust, low-visibility source that could be silently swapped, warranting medium concern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 "qoderwake-cn-${_upstreamver}-linux-amd64.tar.gz::https://ide.qoder.com.cn/qoderwake-cn/releases/${_upstreamver}/qoderwake-cn_${_upstreamver}_linux_amd64.tar.gz"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 65%): Installs prebuilt binaries downloaded from ide.qoder.com.cn, a non-standard Chinese host unrelated to any major forge or well-known vendor infrastructure; while the host appears to be the project's own release channel and SHA256 checksums are provided, the binaries are unverifiable closed-source executables from a low-trust, low-visibility source that could be silently swapped, warranting medium concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lzsnyy <710080675@qq.com>
    
      2#
    
      3# Domestic edition of qoderwake. Upstream only ships install.sh, which
    
      4# downloads the Linux runtime tarball from the release channel and unpacks
    
      5# qoderwake-cn + the bundled qodercli-cn into ~/.qoderwake-cn. This package
    
      6# installs that same archive system-wide.
    
      7#
    
      8# The resources/ directory must stay next to the qoderwake-cn executable: the
    
      9# daemon reads it from the install directory and mirrors it into
    
      10# ~/.qoderwake-cn/runtime-resources on first start. It can coexist with the
    
      11# international package: different binary names, state dirs and ports.
    
      12#
    
      13# The runtime archive carries no LICENSE/COPYING text, so the package declares
    
      14# LicenseRef-custom and cannot install a license file; terms are those of the
    
      15# QoderWake service (https://qoder.cn/).
    
      16
    
      17pkgname=qoderwake-cn-bin
    
      18_upstreamver=1.2.11-cn
    
      19pkgver=1.2.11_cn
    
      20pkgrel=1
    
      21pkgdesc="QoderWake 国内版 local CLI and daemon (official prebuilt Linux runtime)"
    
      22arch=('x86_64' 'aarch64')
    
      23url='https://qoder.cn/'
    
      24license=('LicenseRef-custom')
    
      25depends=('glibc' 'python')
    
      26optdepends=('xdg-utils: open the QoderWake console in the default browser')
    
      27options=('!strip' '!debug')
    
      28provides=("${pkgname%-bin}=${pkgver}")
    
      29conflicts=("${pkgname%-bin}")
    
      30
    
      31source_x86_64=(
    
      32  "qoderwake-cn-${_upstreamver}-linux-amd64.tar.gz::https://ide.qoder.com.cn/qoderwake-cn/releases/${_upstreamver}/qoderwake-cn_${_upstreamver}_linux_amd64.tar.gz"
    
      33)
    
      34source_aarch64=(
    
      35  "qoderwake-cn-${_upstreamver}-linux-arm64.tar.gz::https://ide.qoder.com.cn/qoderwake-cn/releases/${_upstreamver}/qoderwake-cn_${_upstreamver}_linux_arm64.tar.gz"
    
      36)
    
      37sha256sums_x86_64=('aef63230ee27bd958aa220ddaaff4f9c3bd0723d71dde8c859d118968cfba6cc')
    
      38sha256sums_aarch64=('0a6f9d1edc91f25535451547161517e23e2ee8599840be0f48cb575bda18317d')
    
      39
    
      40package() {
    
      41  # The tarball has no top-level directory, so makepkg extracts it flat into
    
      42  # $srcdir.
    
      43  install -dm755 "${pkgdir}/usr/lib/qoderwake-cn/qodercli"
    
      44  install -m755 "${srcdir}/qoderwake-cn" "${pkgdir}/usr/lib/qoderwake-cn/qoderwake-cn"
    
      45  install -m755 "${srcdir}/qodercli/qodercli-cn-wake" \
    
      46    "${pkgdir}/usr/lib/qoderwake-cn/qodercli/qodercli-cn-wake"
    
      47  cp -a "${srcdir}/resources" "${pkgdir}/usr/lib/qoderwake-cn/"
    
      48  find "${pkgdir}/usr/lib/qoderwake-cn" -type d -name __pycache__ -prune -exec rm -rf {} +
    
      49
    
      50  install -dm755 "${pkgdir}/usr/bin"
    
      51  ln -s ../lib/qoderwake-cn/qoderwake-cn "${pkgdir}/usr/bin/qoderwake-cn"
    
      52  ln -s ../lib/qoderwake-cn/qodercli/qodercli-cn-wake \
    
      53    "${pkgdir}/usr/bin/qodercli-cn-wake"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 16:09:47	Medium	3
2026-11-05 14:11:32	Medium	3
2026-11-05 14:09:10	Medium	3