trae-cn-bin

LOW
maintainer zhaoth 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a prebuilt binary from the official vendor's CDN (trae.com.cn), which is a legitimate source for the software; while the host is not on a standard whitelist, it is plausibly owned by the project, and the binary is not obfuscated or executed remotely.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official vendor's CDN (trae.com.cn), which is a legitimate source for the software; while the host is not on a standard whitelist, it is plausibly owned by the project, and the binary is not obfuscated or executed remotely.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:18 source=("Trae%20CN-linux-x64-${pkgver}.tar.gz::https://lf-cdn.trae.com.cn/obj/trae-com-cn/pkg/app/releases/stable/${pkgver}/linux/Trae%20CN-linux-x64.tar.gz")

PKGBUILD

1 offending line(s) highlighted
1pkgname=trae-cn-bin
2_pkgname=trae-cn
3pkgver=2.3.17110
4pkgrel=1
5pkgdesc="TRAE CN 桌面客户端（预编译二进制包）"
6arch=('x86_64')
7url="https://trae.ai/"
8license=('custom')
9install=${pkgname}.install
10makedepends=('librsvg')
11depends=(
12 'gtk3' 'nss' 'libxss' 'libxkbfile' 'libsecret' 'xdg-utils' 'alsa-lib' 'libnotify'
13 'libxtst' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxrandr' 'pango' 'cairo' 'at-spi2-core' 'glib2' 'cups' 'expat' 'nspr' 'util-linux' 'dbus' 'gcc-libs' 'libxkbcommon' 'mesa'
14)
15optdepends=('vulkan-icd-loader: 启用 Vulkan 加速')
16provides=('trae-cn')
17conflicts=('trae-cn' 'trae-cn-desktop-bin' 'trae-bin')
18source=("Trae%20CN-linux-x64-${pkgver}.tar.gz::https://lf-cdn.trae.com.cn/obj/trae-com-cn/pkg/app/releases/stable/${pkgver}/linux/Trae%20CN-linux-x64.tar.gz")
19sha256sums=('12673204f639ef50f4d2034273be8caac558638ff874c00810e50c00fdd99f2c')
20
21package() {
22 cd "$srcdir"
23
24 # 解包 tar.gz -> /usr/share/${_pkgname}
25 install -d "$pkgdir/usr/share/${_pkgname}"
26 bsdtar -xf "Trae%20CN-linux-x64-${pkgver}.tar.gz" -C "$pkgdir/usr/share/${_pkgname}"
27
28 # 确保关键入口具备可执行权限（上游 tar 权限偶发异常时兜底）
29 if [[ -f "$pkgdir/usr/share/${_pkgname}/${_pkgname}" ]]; then
30 chmod 755 "$pkgdir/usr/share/${_pkgname}/${_pkgname}"
31 fi
32 if [[ -f "$pkgdir/usr/share/${_pkgname}/bin/${_pkgname}" ]]; then
33 chmod 755 "$pkgdir/usr/share/${_pkgname}/bin/${_pkgname}"
34 fi
35
36 # 创建可执行入口（默认启动 GUI；需要 CLI 时再走上游 cli.js）
37 install -d "$pkgdir/usr/bin"
38 install -Dm755 /dev/stdin "$pkgdir/usr/bin/${_pkgname}" <<'EOF'
39#!/usr/bin/env bash
40set -uo pipefail
41
42app_dir="/usr/share/trae-cn"
43gui="$app_dir/trae-cn"
44cli="$app_dir/bin/trae-cn"
45
46hint_on_fail() {
47 local code="$1"
48 local elapsed_s="$2"
49 local kind="$3"
50 local user_argc="$4"
51
52 # CLI 的“秒退”是预期行为（--help/--version 等），不要误报。
53 # GUI 的“秒退”可能是崩溃，也可能是把请求转发给已运行实例后正常退出。
54 # 仅在“无参数直接启动 GUI”且秒退时，按失败提示。
55 local need_hint=0
56 if [[ "$kind" == "GUI" ]]; then
57 if [[ "$code" -ne 0 ]]; then
58 need_hint=1
59 elif [[ "$user_argc" -eq 0 && "$elapsed_s" -lt 2 ]]; then
60 need_hint=1
61 fi
62 else
63 if [[ "$code" -ne 0 ]]; then
64 need_hint=1
65 fi
66 fi
67
68 if [[ "$need_hint" -eq 1 ]]; then
69 printf '%s\n' "Trae CN 未能正常启动（${kind}，退出码 ${code}，用时 ${elapsed_s}s）。" >&2
70 printf '%s\n' "如无任何窗口弹出，可尝试：" >&2
71 printf '%s\n' "1) 清理 Electron 配置：rm -rf \"\$HOME/.config/Electron\"" >&2
72 printf '%s\n' "2) 打印日志重试：ELECTRON_ENABLE_LOGGING=1 trae-cn --enable-logging=stderr --v=1" >&2
73 fi
74}
75
76run_and_hint() {
77 local kind="$1"; shift
78 local user_argc="$1"; shift
79 local start_ts end_ts elapsed_s code
80 start_ts=$(date +%s)
81 "$@"
82 code=$?
83 end_ts=$(date +%s)
84 elapsed_s=$(( end_ts - start_ts ))
85 hint_on_fail "$code" "$elapsed_s" "$kind" "$user_argc"
86 return "$code"
87}
88
89# 远程终端场景（如集成终端）优先走 CLI
90if [[ -n "${VSCODE_IPC_HOOK_CLI:-}" ]]; then
91 run_and_hint "CLI" "$#" "$cli" "$@"
92 exit $?
93fi
94
95# 无参数时，优先启动 GUI（避免上游 CLI 无输出直接退出）
96if [[ "$#" -eq 0 ]]; then
97 run_and_hint "GUI" 0 "$gui"
98 exit $?
99fi
100
101# 常见纯 CLI 子命令/参数，保持原有行为
102for arg in "$@"; do
103 case "$arg" in
104 --help|--version|--status|--verbose|--list-extensions|--install-extension|--uninstall-extension|--file-write|tunnel|serve-web)
105 run_and_hint "CLI" "$#" "$cli" "$@"
106 exit $?
107 ;;
108 esac
109done
110
111run_and_hint "GUI" "$#" "$gui" "$@"
112exit $?
113EOF
114
115 # Electron chrome-sandbox 兼容（与 VSCode/Slack 等一致）
116 if [[ -f "$pkgdir/usr/share/${_pkgname}/chrome-sandbox" ]]; then
117 chmod 4755 "$pkgdir/usr/share/${_pkgname}/chrome-sandbox"
118 fi
119
120 # Desktop entry & icon
121 install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/${_pkgname}.desktop" <<'EOF'
122[Desktop Entry]
123Name=Trae CN
124Comment=TRAE CN 桌面客户端
125TryExec=/usr/bin/trae-cn
126Exec=/usr/bin/trae-cn %F
127Terminal=false
128Type=Application
129Icon=trae-cn
130Categories=Development;IDE;
131MimeType=inode/directory;text/plain;
132StartupWMClass=trae-cn
133StartupNotify=true
134EOF
135
136 icon_svg="$pkgdir/usr/share/${_pkgname}/resources/app/out/media/trae-logo.svg"
137 if [[ -f "$icon_svg" ]]; then
138 install -Dm644 "$icon_svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/${_pkgname}.svg"
139
140 if command -v rsvg-convert >/dev/null 2>&1; then
141 for size in 256 128 64 48 32 16; do
142 install -d "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps"
143 rsvg-convert -w "$size" -h "$size" "$icon_svg" \
144 -o "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/${_pkgname}.png"
145 done
146 fi
147 elif [[ -f "$pkgdir/usr/share/${_pkgname}/resources/app/resources/linux/code.png" ]]; then
148 # 兜底：上游未提供 trae-logo.svg 时沿用旧图标
149 for size in 1024x1024 512x512 256x256 128x128; do
150 install -Dm644 "$pkgdir/usr/share/${_pkgname}/resources/app/resources/linux/code.png" \
151 "$pkgdir/usr/share/icons/hicolor/${size}/apps/${_pkgname}.png"
152 done
153 fi
154
155 # 许可证放置（若上游提供）
156 if [[ -f "$pkgdir/usr/share/${_pkgname}/LICENSES.chromium.html" ]]; then
157 install -Dm644 "$pkgdir/usr/share/${_pkgname}/LICENSES.chromium.html" \
158 "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
159 fi
160}
161
162pkgver() {
163 # 如需从上游内部版本号转化，可在此定制；当前直接使用 URL 中的版本。
164 printf "%s" "$pkgver"
165}
166

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion