trae-sg
LOW
maintainer logan_reed
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt binaries from a CDN domain (lf-cdn.trae.ai) that is not on standard whitelists but is plausibly owned by the project (trae.ai); however, the binaries are verified via b2sums, reducing supply-chain risk, and the installation process is transparent and follows standard practices for packaging an official binary release.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from a CDN domain (lf-cdn.trae.ai) that is not on standard whitelists but is plausibly owned by the project (trae.ai); however, the binaries are verified via b2sums, reducing supply-chain risk, and the installation process is transparent and follows standard practices for packaging an official binary release.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source_x86_64=("Trae-linux-x64-${pkgver}-${pkgrel}.tar.gz::https://lf-cdn.trae.ai/obj/trae-ai-sg/pkg/app/releases/stable/2.3.73738/linux/TraeCode-linux-x64.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: logan_reed <liulingzhang.work@icloud.com>
2
# Contributor: springtwr <springtwr@outlook.com>
3
4
pkgname=trae-sg
5
pkgver=2.3.73738
6
pkgrel=1
7
pkgdesc="AI-powered IDE by ByteDance (Singapore CDN)"
8
arch=('x86_64' 'aarch64')
9
url="https://www.trae.cn/"
10
license=('LicenseRef-Trae')
11
provides=("trae=$pkgver")
12
conflicts=('trae' 'trae-bin')
13
depends=('nss' 'alsa-lib' 'gtk3' 'at-spi2-core' 'libsecret' 'libxkbfile' 'zeromq')
14
optdepends=('libappindicator-gtk3: System tray support'
15
'xdg-utils: Open URLs and files with default applications'
16
'python: Python extension support'
17
'nodejs: Node.js extension scripts')
18
options=('!strip' '!debug')
19
install=trae.install
20
source=("trae.sh" "trae.desktop")
21
source_x86_64=("Trae-linux-x64-${pkgver}-${pkgrel}.tar.gz::https://lf-cdn.trae.ai/obj/trae-ai-sg/pkg/app/releases/stable/2.3.73738/linux/TraeCode-linux-x64.tar.gz")
22
source_aarch64=("Trae-linux-arm64-${pkgver}-${pkgrel}.tar.gz::https://lf-cdn.trae.ai/obj/trae-ai-sg/pkg/app/releases/stable/2.3.73738/linux/TraeCode-linux-arm64.tar.gz")
23
b2sums=('2331b0d37fff8478ea37cbf9e5c2e70a59631aae6efb44741fc6c1a8dce65557098e9dffa8c30148ef27432802bec3d1eda279021421e5d3f979e80900662726'
24
'656c5d6bea6ef15185e0d8ee0181276f6de3bfae8e66a2c65772a5f1354727952dd020dca057246139a2bab8f4805057fa2db367a6ba0a1b90d9ffd7fcab8412')
25
b2sums_x86_64=('8f61879518a2ac7332163854f2ff58e591577e18640687cac8a553cc08fac00d9687cfc6af71ce943690ac41e5a31ec0e90f4a968d0bca454cb4809b0cd21618')
26
b2sums_aarch64=('bca4ef9932b41d98f7fca05d50256d0d5ee7efe92d9a74f5217e234a3935dd9b7f840e1970d1edf777853e7c66a262d28aebea7219a73b9a7671992ad4df3753')
27
28
package() {
29
install -d "${pkgdir}/opt/trae"
30
31
for f in "${srcdir}"/*; do
32
case "${f##*/}" in
33
trae.sh|trae.desktop|*.tar.*) continue ;;
34
esac
35
cp -a "$f" "${pkgdir}/opt/trae/"
36
done
37
38
# SUID sandbox
39
chmod 4755 "${pkgdir}/opt/trae/chrome-sandbox"
40
41
# Launcher
42
install -Dm755 "${srcdir}/trae.sh" "${pkgdir}/usr/bin/trae"
43
44
# Desktop entry
45
install -Dm644 "${srcdir}/trae.desktop" "${pkgdir}/usr/share/applications/trae.desktop"
46
47
# Icon
48
install -Dm644 "${pkgdir}/opt/trae/resources/app/resources/linux/code.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/trae.png"
49
50
# License
51
install -Dm644 "${pkgdir}/opt/trae/resources/app/LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
52
install -Dm644 "${pkgdir}/opt/trae/resources/app/ThirdPartyNotices.txt" "${pkgdir}/usr/share/licenses/${pkgname}/ThirdPartyNotices"
53
install -Dm644 "${pkgdir}/opt/trae/LICENSES.chromium.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
54
55
# Shell completions
56
install -Dm644 "${pkgdir}/opt/trae/resources/completions/bash/trae" "${pkgdir}/usr/share/bash-completion/completions/trae"
57
install -Dm644 "${pkgdir}/opt/trae/resources/completions/zsh/_trae" "${pkgdir}/usr/share/zsh/site-functions/_trae"
58
59
# Remove unnecessary files
60
rm -rf "${pkgdir}/opt/trae/node_modules"
61
find "${pkgdir}/opt/trae" -name "*.asc" -delete
62
find "${pkgdir}/opt/trae" -name "*.bat" -delete
63
find "${pkgdir}/opt/trae" -type d -name "rush-logs" -exec rm -rf {} +
64
65
# Remove bundled GCC runtime libraries (conflict with system gcc-libs, breaks ckg indexing)
66
rm -fv "${pkgdir}/opt/trae/resources/app/modules/ckg/binary/libstdc++.so.6"
67
rm -fv "${pkgdir}/opt/trae/resources/app/modules/ckg/binary/libgcc_s.so.1"
68
}
69
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |