workbuddy

MEDIUM

maintainer Rainbowu 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted host (download.codebuddy.cn) with SKIP'd checksums, posing a supply-chain risk if the host is compromised or swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source_x86_64=("v${pkgver}-x86_64.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${pkgver//_/-}.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted host (download.codebuddy.cn) with SKIP'd checksums, posing a supply-chain risk if the host is compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rongbo <wurongbo2012@hotmail.com>
    
      2
    
      3pkgname=workbuddy
    
      4pkgver=5.5.6.38337834_5f969292
    
      5pkgrel=2
    
      6pkgdesc="腾讯云代码助手推出的 AI Agent 办公工具"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://www.workbuddy.cn/app"
    
      9license=('custom')
    
      10depends=('electron')
    
      11makedepends=('asar'
    
      12)
    
      13checkdepends=()
    
      14optdepends=(
    
      15	'python-pip'
    
      16	'nodejs-lts: frontend skills'
    
      17	'imagemagick'
    
      18	'gnome-shell-extension-appindicator'
    
      19)
    
      20provides=()
    
      21conflicts=()
    
      22_registry="https://registry.npmjs.org"
    
      23source=(
    
      24  WorkBuddy.desktop
    
      25  "${_registry}/better-sqlite3/-/better-sqlite3-13.0.3.tgz"
    
      26)
    
      27sha256sums=('SKIP'
    
      28            '77e0513dc1a469fb3bceec4c7fb5ad3f403109787eda05be047ec17fd56868cb')
    
      29source_x86_64=("v${pkgver}-x86_64.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${pkgver//_/-}.deb")
    
      30source_aarch64=("v${pkgver}-aarch64.deb::https://download.codebuddy.cn/workbuddy/saas/linux-arm64-deb/WorkBuddy-linux-arm64-deb-${pkgver//_/-}.deb")
    
      31sha256sums_x86_64=('SKIP')
    
      32sha256sums_aarch64=('SKIP')
    
      33
    
      34options=(!strip !debug)
    
      35pkgver() {
    
      36    upstream=$(curl 'https://copilot.tencent.com/v2/update?platform=workbuddy-linux-x64-deb')
    
      37    _nfile=$(awk -F '"' '{for(i=1;i<=NF;i++){if($i=="url"){print $(i+2)}}}' <<<$upstream |cut -d'-' -f7,8)
    
      38    sed 's/-/_/' <<<${_nfile%.*}
    
      39}
    
      40
    
      41prepare() {
    
      42    tar xf data.tar.xz
    
      43}
    
      44
    
      45_debloat_prompt() {
    
      46    sed -i -e '/<content_policy>/,/<\/content_policy>/d' \
    
      47        -e '/<working_modes>/,/<\/working_modes>/d' \
    
      48        -e '/<personal_files_safety>/,/<\/personal_files_safety>/d' \
    
      49        -e '/{% if IsWindows %}/,/{% endif %}/d' \
    
      50        -e '/<final_answer_instructions>/,/<\/final_answer_instructions>/d' \
    
      51        app.asar.unpacked/resources/templates/*prompt.tpl
    
      52}
    
      53
    
      54build() {
    
      55    cd opt/WorkBuddy/resources
    
      56    rm -rf app.asar.unpacked/node_modules/better-sqlite3
    
      57    mv ${srcdir}/package app.asar.unpacked/node_modules/better-sqlite3
    
      58    asar e app.asar app.asar.unpacked || true
    
      59    find app.asar.unpacked -type f -exec sed -i "s/process.resourcesPath/\'\/opt\/WorkBuddy\'/g" {} +
    
      60    _debloat_prompt
    
      61}
    
      62
    
      63package() {
    
      64    install -d ${pkgdir}/opt/WorkBuddy
    
      65    cp -a usr ${pkgdir}/
    
      66    install -m644 WorkBuddy.desktop ${pkgdir}/usr/share/applications/workbuddy.desktop
    
      67    cd opt/WorkBuddy/resources
    
      68    cp -a app.asar.unpacked ${pkgdir}/opt/WorkBuddy/
    
      69#    cp -r wb-guest-sdk/ ${pkgdir}/opt/WorkBuddy/
    
      70    install -Dm 755 /dev/stdin "${pkgdir}/usr/bin/workbuddy" <<EOF
    
      71#!/usr/bin/bash
    
      72exec electron /opt/WorkBuddy/app.asar.unpacked "\$@"
    
      73EOF
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 17:20:19	Medium	2
2026-10-14 00:06:47	Medium	2