windsurf-next

maintainer bermudi · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt .deb from a non-official, project-unrelated host (windsurf-stable.codeiumdata.com) which is not the project's own domain or a standard distribution point, creating a supply-chain risk if the host is compromised or maliciously redirected.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt .deb from a non-official, project-unrelated host (windsurf-stable.codeiumdata.com) which is not the project's own domain or a standard distribution point, creating a supply-chain risk if the host is compromised or maliciously redirected.

PKGBUILD

      1# Maintainer: Webarch <contact@webarch.ro>
    
      2# Auto-updated by GitHub Actions
    
      3
    
      4pkgname=windsurf-next
    
      5pkgver=3.6.1022_next.d5152ff589
    
      6pkgrel=1
    
      7pkgdesc="Devin Desktop (next channel) - formerly Windsurf Editor"
    
      8arch=('x86_64')
    
      9url="https://docs.devin.ai"
    
      10license=('custom:Proprietary')
    
      11
    
      12# APT repository configuration
    
      13_apt_base="https://windsurf-stable.codeiumdata.com/mQfcApCOdSLoWOSI/apt"
    
      14_upstream_ver="${pkgver//_/+}"
    
      15_debfile="Devin-linux-x64-${_upstream_ver}.deb"
    
      16
    
      17depends=(
    
      18    'vulkan-driver'
    
      19    'ffmpeg'
    
      20    'glibc'
    
      21    'libglvnd'
    
      22    'gtk3'
    
      23    'alsa-lib'
    
      24)
    
      25makedepends=()
    
      26optdepends=(
    
      27    'bash-completion: for bash shell completions'
    
      28    'zsh: for zsh shell completions'
    
      29)
    
      30provides=("windsurf-next")
    
      31conflicts=("windsurf-next")
    
      32options=('!strip' '!debug')
    
      33
    
      34source=(
    
      35    "${pkgname}-${pkgver}.deb::${_apt_base}/pool/main/d/devin-desktop-next/${_debfile}"
    
      36    'windsurf-next.desktop'
    
      37    'windsurf-next-url-handler.desktop'
    
      38)
    
      39
    
      40sha256sums=(
    
      41    '16db9324099d499ec0d60afd9ae4b9481a4e0ae2c5e8eae2147c63ec655fd0a0'
    
      42    'f15127ef9ff42b2eddf5e0b476a27a0f65e3813de911c9154a577746b47e8188'
    
      43    'c2845c4efacb3eb7f0c5756ec9b2f68f3b24af11cc2db6965a4e5f4e744cf539'
    
      44
    
      45)
    
      46
    
      47prepare() {
    
      48    cd "$srcdir"
    
      49
    
      50    # Clean up any previous extraction
    
      51    rm -rf deb-extract
    
      52
    
      53    # Extract the .deb file (ar archive)
    
      54    mkdir -p deb-extract
    
      55    cd deb-extract
    
      56    ar x "../${pkgname}-${pkgver}.deb"
    
      57
    
      58    # Extract the data archive (contains the actual files)
    
      59    mkdir -p data
    
      60    if [[ -f data.tar.xz ]]; then
    
      61        tar -xf data.tar.xz -C data
    
      62    elif [[ -f data.tar.zst ]]; then
    
      63        tar -xf data.tar.zst -C data
    
      64    elif [[ -f data.tar.gz ]]; then
    
      65        tar -xf data.tar.gz -C data
    
      66    fi
    
      67}
    
      68
    
      69package() {
    
      70    cd "$srcdir/deb-extract/data"
    
      71
    
      72    # The deb installs to usr/share/{devin-desktop-next,windsurf-next}/
    
      73    # Find the actual install directory
    
      74    local _installdir
    
      75    for _candidate in "usr/share/devin-desktop-next" "usr/share/windsurf-next"; do
    
      76        if [[ -d "$_candidate" ]]; then
    
      77            _installdir="$_candidate"
    
      78            break
    
      79        fi
    
      80    done
    
      81
    
      82    if [[ -z "$_installdir" ]]; then
    
      83        _installdir=$(find usr/share -maxdepth 1 -type d -not -path "usr/share" | head -1)
    
      84    fi
    
      85
    
      86    # Copy all files to /opt
    
      87    if [[ -z "$_installdir" || ! -d "$_installdir" ]]; then
    
      88        echo "Error: Installation directory not found!" >&2
    
      89        return 1
    
      90    fi
    
      91    install -dm755 "$pkgdir/opt/$pkgname"
    
      92    cp -a "$_installdir"/. "$pkgdir/opt/$pkgname/"
    
      93
    
      94    # Create symlink for the executable
    
      95    # The binary may be named differently (devin-desktop-next vs windsurf-next)
    
      96    install -dm755 "$pkgdir/usr/bin"
    
      97    if [[ -f "$pkgdir/opt/$pkgname/$pkgname" ]]; then
    
      98        ln -sf "/opt/$pkgname/$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      99    else
    
      100        # Binary has a different name (e.g. devin-desktop-next)
    
      101        local _bin
    
      102        _bin=$(find "$pkgdir/opt/$pkgname" -maxdepth 1 -type f -name 'devin-*' -executable | head -1)
    
      103        : "${_bin:=$(find "$pkgdir/opt/$pkgname" -maxdepth 1 -type f -name 'windsurf-*' -executable | head -1)}"
    
      104        _binname=$(basename "$_bin")
    
      105        if [[ -z "$_binname" ]]; then
    
      106            echo "Error: Could not find executable in $pkgdir/opt/$pkgname" >&2
    
      107            return 1
    
      108        fi
    
      109        # Symlink in /opt so /opt/windsurf-next/windsurf-next works
    
      110        ln -sf "$_binname" "$pkgdir/opt/$pkgname/$pkgname"
    
      111        # Symlink in /usr/bin
    
      112        ln -sf "/opt/$pkgname/$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      113    fi
    
      114
    
      115    # Install the desktop entry files
    
      116    install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      117    install -Dm644 "$srcdir/$pkgname-url-handler.desktop" "$pkgdir/usr/share/applications/$pkgname-url-handler.desktop"
    
      118
    
      119    # Install bash completion
    
      120    if [[ -f "$pkgdir/opt/$pkgname/resources/completions/bash/$pkgname" ]]; then
    
      121        install -Dm644 "$pkgdir/opt/$pkgname/resources/completions/bash/$pkgname" \
    
      122            "$pkgdir/usr/share/bash-completion/completions/$pkgname"
    
      123    fi
    
      124
    
      125    # Install zsh completion
    
      126    if [[ -f "$pkgdir/opt/$pkgname/resources/completions/zsh/_$pkgname" ]]; then
    
      127        install -Dm644 "$pkgdir/opt/$pkgname/resources/completions/zsh/_$pkgname" \
    
      128            "$pkgdir/usr/share/zsh/site-functions/_$pkgname"
    
      129    fi
    
      130
    
      131    # Install icon - try both old and new naming conventions
    
      132    local _icon
    
      133    for _icon in "code-next.png" "devin-next.png" "code.png"; do
    
      134        if [[ -f "$pkgdir/opt/$pkgname/resources/app/resources/linux/$_icon" ]]; then
    
      135            install -Dm644 "$pkgdir/opt/$pkgname/resources/app/resources/linux/$_icon" \
    
      136                "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      137            break
    
      138        fi
    
      139    done
    
      140
    
      141    # Fix permissions
    
      142    local _main_bin
    
      143    for _main_bin in "$pkgdir/opt/$pkgname/$pkgname" "$pkgdir/opt/$pkgname/devin-desktop-next"; do
    
      144        if [[ -f "$_main_bin" ]]; then
    
      145            chmod 755 "$_main_bin"
    
      146        fi
    
      147    done
    
      148    if [[ -f "$pkgdir/opt/$pkgname/chrome-sandbox" ]]; then
    
      149        chmod 4755 "$pkgdir/opt/$pkgname/chrome-sandbox"
    
      150    fi
    
      151}
    
      152

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 # Auto-updated by GitHub Actions
 
 pkgname=windsurf-next
-pkgver=3.6.1000_next.05e2e51d52
+pkgver=3.6.1022_next.d5152ff589
 pkgrel=1
 pkgdesc="Devin Desktop (next channel) - formerly Windsurf Editor"
 arch=('x86_64')
@@ -38,7 +38,7 @@
 )
 
 sha256sums=(
-    '40caf9fd08ad3e6d4f48664e31cac3b4d94a391cc5da22b039c41764a4bd40be'
+    '16db9324099d499ec0d60afd9ae4b9481a4e0ae2c5e8eae2147c63ec655fd0a0'
     'f15127ef9ff42b2eddf5e0b476a27a0f65e3813de911c9154a577746b47e8188'
     'c2845c4efacb3eb7f0c5756ec9b2f68f3b24af11cc2db6965a4e5f4e744cf539'
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 03:13:55	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 15:24:42	MEDIUM	2
2026-07-17 03:53:53	CLEAN	0
2026-07-09 00:22:38	CLEAN	0
2026-07-08 00:26:52	MEDIUM	2
2026-07-07 15:25:04	MEDIUM	2
2026-07-07 00:22:52	MEDIUM	2
2026-07-06 00:10:58	MEDIUM	2
2026-07-05 00:27:08	MEDIUM	2