trae-cn-desktop-bin

maintainer nukiyoam · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt tarball from the official project's CDN (trae.com.cn), which is plausibly owned by the vendor; despite the non-whitelisted host, this is a standard practice for official binaries and the checksums are provided and match across architectures, reducing supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt tarball from the official project's CDN (trae.com.cn), which is plausibly owned by the vendor; despite the non-whitelisted host, this is a standard practice for official binaries and the checksums are provided and match across architectures, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 "${_pkgname}-${pkgver}-${CARCH}.tar.gz::https://lf-cdn.trae.com.cn/obj/trae-com-cn/pkg/app/releases/stable/${pkgver}/linux/Trae_CN-linux-x64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: nukiyoam <329748113[at]qq[dot]com>
    
      2
    
      3# 参考 https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=visual-studio-code-bin
    
      4
    
      5pkgname=trae-cn-desktop-bin
    
      6_pkgname=trae-cn
    
      7pkgver=2.3.61405
    
      8pkgrel=1
    
      9pkgdesc="字节跳动推出的AI编程IDE（Trae CN）"
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://www.trae.cn/"
    
      12license=('custom')
    
      13# Upstream has signature verification for extensions and stripping breaks it
    
      14# See https://github.com/microsoft/vscode/issues/223455#issuecomment-2610001754
    
      15options=('!strip')
    
      16install=$pkgname.install
    
      17
    
      18# lsof: needed for terminal splitting, see https://github.com/Microsoft/vscode/issues/62991
    
      19# xdg-utils: needed for opening web links with xdg-open
    
      20depends=(libxkbfile gnupg gtk3 libsecret nss gcc-libs libnotify libxss glibc lsof shared-mime-info xdg-utils alsa-lib)
    
      21
    
      22optdepends=(
    
      23    'glib2: Needed for move to trash functionality'
    
      24    'libdbusmenu-glib: Needed for KDE global menu'
    
      25    'org.freedesktop.secrets: Needed for settings sync'
    
      26    # See https://github.com/MicrosoftDocs/live-share/issues/4650
    
      27    'icu69: Needed for live share'
    
      28)
    
      29
    
      30provides=("trae-cn=${pkgver}")
    
      31conflicts=('trae-cn' 'trae-cn-bin')
    
      32
    
      33source_x86_64=(
    
      34    "${_pkgname}-${pkgver}-${CARCH}.tar.gz::https://lf-cdn.trae.com.cn/obj/trae-com-cn/pkg/app/releases/stable/${pkgver}/linux/Trae_CN-linux-x64.tar.gz"
    
      35    "${_pkgname}.desktop"
    
      36    "${_pkgname}-url-handler.desktop"
    
      37    "${_pkgname}-startup.sh"
    
      38)
    
      39
    
      40source_aarch64=(
    
      41    "${_pkgname}-${pkgver}-${CARCH}.tar.gz::https://lf-cdn.trae.com.cn/obj/trae-com-cn/pkg/app/releases/stable/${pkgver}/linux/Trae_CN-linux-arm64.tar.gz"
    
      42    "${_pkgname}.desktop"
    
      43    "${_pkgname}-url-handler.desktop"
    
      44    "${_pkgname}-startup.sh"
    
      45)
    
      46
    
      47sha256sums_x86_64=('7ad3908bb68578a8627e1ca944447b38da05edde7cab71437f9f62d72ef4f2bc'
    
      48                   '30c7bcb0c9d3afcdd751f114b154ad09f2fea481abb2c431469368c6d6069b1c'
    
      49                   'e95823c65fb48674878ebb8c99719fbcf3eb9ccb89e61e4d37bd0b5be300b168'
    
      50                   'cd3a00a606b14d2ab494ad98b1c3926ceaf0c46f226b258f7e79c55b61dbd395')
    
      51sha256sums_aarch64=('7ad3908bb68578a8627e1ca944447b38da05edde7cab71437f9f62d72ef4f2bc'
    
      52                    '30c7bcb0c9d3afcdd751f114b154ad09f2fea481abb2c431469368c6d6069b1c'
    
      53                    'e95823c65fb48674878ebb8c99719fbcf3eb9ccb89e61e4d37bd0b5be300b168'
    
      54                    'cd3a00a606b14d2ab494ad98b1c3926ceaf0c46f226b258f7e79c55b61dbd395')
    
      55
    
      56
    
      57package() {
    
      58    install -d "${pkgdir}/opt/${_pkgname}"
    
      59    install -d "${pkgdir}/usr/bin"
    
      60    install -d "${pkgdir}/usr/share/"{applications,pixmaps,mime/packages,licenses/${_pkgname}}
    
      61    bsdtar -xf "${srcdir}/${_pkgname}-${pkgver}-${CARCH}.tar.gz" -C "${pkgdir}/opt/${_pkgname}"
    
      62    chmod 4755 "${pkgdir}/opt/${_pkgname}/chrome-sandbox"
    
      63    install -Dm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      64    install -Dm644 "${srcdir}/${_pkgname}-url-handler.desktop" "${pkgdir}/usr/share/applications/${_pkgname}-url-handler.desktop"
    
      65    install -Dm644 "${srcdir}/resources/app/resources/linux/code.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      66    install -Dm644 "${srcdir}/resources/app/LICENSE.txt"  "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE.txt"
    
      67    install -Dm644 "${srcdir}/resources/completions/bash/${_pkgname}"  "${pkgdir}/usr/share/bash-completion/completions/${_pkgname}"
    
      68    install -Dm644 "${srcdir}/resources/completions/zsh/_${_pkgname}"  "${pkgdir}/usr/share/zsh/site-functions/_${_pkgname}"
    
      69    install -m755 "${srcdir}/${_pkgname}-startup.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      70    
    
      71    # 暂时修复一下工作区索引不能成功构建的问题
    
      72    rm -rf "${pkgdir}/opt/${_pkgname}/resources/app/modules/ckg/binary/libstdc++.so.6"
    
      73}
    
      74

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,7 +4,7 @@
 
 pkgname=trae-cn-desktop-bin
 _pkgname=trae-cn
-pkgver=2.3.59356
+pkgver=2.3.61405
 pkgrel=1
 pkgdesc="字节跳动推出的AI编程IDE（Trae CN）"
 arch=('x86_64' 'aarch64')
@@ -44,11 +44,11 @@
     "${_pkgname}-startup.sh"
 )
 
-sha256sums_x86_64=('af696186d199a975c616c3682e58ae7846cead55c01d348c14c3994c8f36a6ce'
+sha256sums_x86_64=('7ad3908bb68578a8627e1ca944447b38da05edde7cab71437f9f62d72ef4f2bc'
                    '30c7bcb0c9d3afcdd751f114b154ad09f2fea481abb2c431469368c6d6069b1c'
                    'e95823c65fb48674878ebb8c99719fbcf3eb9ccb89e61e4d37bd0b5be300b168'
                    'cd3a00a606b14d2ab494ad98b1c3926ceaf0c46f226b258f7e79c55b61dbd395')
-sha256sums_aarch64=('af696186d199a975c616c3682e58ae7846cead55c01d348c14c3994c8f36a6ce'
+sha256sums_aarch64=('7ad3908bb68578a8627e1ca944447b38da05edde7cab71437f9f62d72ef4f2bc'
                     '30c7bcb0c9d3afcdd751f114b154ad09f2fea481abb2c431469368c6d6069b1c'
                     'e95823c65fb48674878ebb8c99719fbcf3eb9ccb89e61e4d37bd0b5be300b168'
                     'cd3a00a606b14d2ab494ad98b1c3926ceaf0c46f226b258f7e79c55b61dbd395')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 03:13:55	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 09:27:42	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 03:12:42	MEDIUM	1
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2