workbuddy
MEDIUM
maintainer Rainbowu
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .deb from a non-whitelisted host (download.codebuddy.cn) with SKIP'd checksums, posing a supply-chain risk if the host is compromised or malicious.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
source_x86_64=("v${pkgver}-x86_64.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${pkgver//_/-}.deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (download.codebuddy.cn) with SKIP'd checksums, posing a supply-chain risk if the host is compromised or malicious.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Rongbo <wurongbo2012@hotmail.com>
2
3
pkgname=workbuddy
4
pkgver=5.5.6.38337834_5f969292
5
pkgrel=1
6
pkgdesc="腾讯云代码助手推出的 AI Agent 办公工具"
7
arch=('x86_64' 'aarch64')
8
url="https://www.workbuddy.cn/app"
9
license=('custom')
10
depends=('electron')
11
makedepends=('asar'
12
)
13
checkdepends=()
14
optdepends=(
15
'nodejs-lts: frontend skills'
16
'gnome-shell-extension-appindicator'
17
)
18
provides=()
19
conflicts=()
20
_registry="https://registry.npmjs.org"
21
source=(
22
WorkBuddy.desktop
23
"${_registry}/better-sqlite3/-/better-sqlite3-13.0.3.tgz"
24
)
25
sha256sums=('SKIP'
26
'77e0513dc1a469fb3bceec4c7fb5ad3f403109787eda05be047ec17fd56868cb')
27
source_x86_64=("v${pkgver}-x86_64.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${pkgver//_/-}.deb")
28
source_aarch64=("v${pkgver}-aarch64.deb::https://download.codebuddy.cn/workbuddy/saas/linux-arm64-deb/WorkBuddy-linux-arm64-deb-${pkgver//_/-}.deb")
29
sha256sums_x86_64=('SKIP')
30
sha256sums_aarch64=('SKIP')
31
32
options=(!strip !debug)
33
pkgver() {
34
upstream=$(curl 'https://copilot.tencent.com/v2/update?platform=workbuddy-linux-x64-deb')
35
_nfile=$(awk -F '"' '{for(i=1;i<=NF;i++){if($i=="url"){print $(i+2)}}}' <<<$upstream |cut -d'-' -f7,8)
36
sed 's/-/_/' <<<${_nfile%.*}
37
}
38
39
prepare() {
40
tar xf data.tar.xz
41
}
42
43
build() {
44
cd opt/WorkBuddy/resources
45
rm -rf app.asar.unpacked/node_modules/better-sqlite3
46
mv ${srcdir}/package app.asar.unpacked/node_modules/better-sqlite3
47
asar e app.asar app.asar.unpacked || true
48
find app.asar.unpacked -type f -exec sed -i "s/process.resourcesPath/\'\/opt\/WorkBuddy\'/g" {} +
49
}
50
51
package() {
52
install -d ${pkgdir}/opt/WorkBuddy
53
cp -a usr ${pkgdir}/
54
install -m644 WorkBuddy.desktop ${pkgdir}/usr/share/applications/workbuddy.desktop
55
cd opt/WorkBuddy/resources
56
cp -a app.asar.unpacked ${pkgdir}/opt/WorkBuddy/
57
install -Dm 755 /dev/stdin "${pkgdir}/usr/bin/workbuddy" <<EOF
58
#!/usr/bin/bash
59
exec electron /opt/WorkBuddy/app.asar.unpacked "\$@"
60
EOF
61
}
62
Changes since previous scan
--- PKGBUILD @ 2026-09-11 00:19+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: Rongbo <wurongbo2012@hotmail.com> pkgname=workbuddy-pkgver=5.5.3.37748631_104760a2+pkgver=5.5.6.38337834_5f969292 pkgrel=1 pkgdesc="腾讯云代码助手推出的 AI Agent 办公工具" arch=('x86_64' 'aarch64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 23:24:29 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 01:20:11 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 07:57:01 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 11:53:08 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 07:50:36 | Medium | 2 |