workbuddy-international

MEDIUM

maintainer duanluan 0 votes scanned 2026-10-23 11:39:11.286754

View on AUR

Why flagged

The package downloads a prebuilt macOS app from download.codebuddy.ai and a prebuilt Linux .deb from download.codebuddy.cn (a Chinese domestic CDN), then extracts and runs bundled node/python runtimes from the .deb; while these appear to be the project's own official distribution hosts, the combination of an unofficial Linux port, bundled shell scripts (install.sh, lib-*.sh) that are local/unreviewed files with no upstream URL, and prebuilt binaries extracted from a separate regional edition creates a meaningful supply-chain risk that warrants medium severity.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:47 "WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip::https://download.codebuddy.ai/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip"
PKGBUILD:49 "WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 65%): The package downloads a prebuilt macOS app from download.codebuddy.ai and a prebuilt Linux .deb from download.codebuddy.cn (a Chinese domestic CDN), then extracts and runs bundled node/python runtimes from the .deb; while these appear to be the project's own official distribution hosts, the combination of an unofficial Linux port, bundled shell scripts (install.sh, lib-*.sh) that are local/unreviewed files with no upstream URL, and prebuilt binaries extracted from a separate regional edition creates a meaningful supply-chain risk that warrants medium severity.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2# Contributor: wasdxl <https://aur.archlinux.org/account/wasdxl>
    
      3#
    
      4# Unofficial Linux port: the WorkBuddy international edition (workbuddy.ai)
    
      5# publishes no Linux build. This package converts the official macOS build to
    
      6# a Linux Electron app on the user's machine; nothing proprietary is
    
      7# redistributed. Conversion toolchain vendored from the MIT-licensed
    
      8# community project workbuddy-linux (see LICENSE.port-tool); see DISCLAIMER.
    
      9#
    
      10# The node/python session runtimes are taken from the official domestic-
    
      11# edition Linux deb (download.codebuddy.cn): the international darwin build
    
      12# bundles macOS/Windows runtimes only, while the app expects
    
      13# resources/runtime/{node,python} on Linux. The runtimes are edition-
    
      14# agnostic and pinned to their own upstream version.
    
      15
    
      16pkgname=workbuddy-international
    
      17_pkgver=5.8.4.41366630
    
      18_build=73952edb
    
      19_electronver=37.10.3
    
      20_cn_pkgver=5.6.2.40046327
    
      21_cn_build=c7b525f3
    
      22pkgver=${_pkgver}_${_build}
    
      23pkgrel=2
    
      24pkgdesc='AI Agent for everyday office work - WorkBuddy international edition (unofficial Linux port)'
    
      25arch=('x86_64' 'aarch64')
    
      26url='https://www.workbuddy.ai'
    
      27license=('NOASSERTION')
    
      28depends=('libsecret' 'libappindicator-gtk3' 'nss' 'alsa-lib' 'gtk3' 'libxss')
    
      29makedepends=('nodejs' 'npm' 'p7zip' 'unzip' 'python' 'imagemagick')
    
      30optdepends=('gnome-shell-extension-appindicator: tray icon support')
    
      31options=('!strip' '!debug')
    
      32provides=('workbuddy-international-bin')
    
      33conflicts=('workbuddy-international-bin')
    
      34source=(
    
      35  'install.sh'
    
      36  'lib-common.sh'
    
      37  'lib-dmg.sh'
    
      38  'lib-electron.sh'
    
      39  'lib-native-modules.sh'
    
      40  'lib-linux-patches.sh'
    
      41  'lib-apply-linux-patches.js'
    
      42  'workbuddy-international.desktop'
    
      43  'LICENSE.port-tool'
    
      44  'DISCLAIMER'
    
      45)
    
      46source_x86_64=(
    
      47  "WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip::https://download.codebuddy.ai/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip"
    
      48  "electron-v${_electronver}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electronver}/electron-v${_electronver}-linux-x64.zip"
    
      49  "WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      50)
    
      51source_aarch64=(
    
      52  "WorkBuddy-darwin-arm64-${_pkgver}-${_build}.zip::https://download.codebuddy.ai/workbuddy/saas/darwin-arm64/WorkBuddy-darwin-arm64-${_pkgver}-${_build}.zip"
    
      53  "electron-v${_electronver}-linux-arm64.zip::https://github.com/electron/electron/releases/download/v${_electronver}/electron-v${_electronver}-linux-arm64.zip"
    
      54  "WorkBuddy-linux-arm64-deb-${_cn_pkgver}-${_cn_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-arm64-deb/WorkBuddy-linux-arm64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      55)
    
      56noextract=(
    
      57  "WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      58  "WorkBuddy-linux-arm64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      59)
    
      60sha256sums=('6e8c6154b013e26cb2f8f2c3646b206a135cd0060e67f86298c1d2b23c10a1c3'
    
      61            '33aeab4b44329127ce747cc3048df98db9873cb511685e666d81332d9c219c73'
    
      62            'f263ea88a81ceb8be3b59c458fd7be15daf0dbbd2b625fc143f772ad300742fd'
    
      63            'f207ee01cc207532c3c804ba6ff6ab4209adab06a1903d9b9f38b8d96d90d50c'
    
      64            '6d9bf1001374d62e12941c7e98acee1329fbe4dcaf4ae809509c934b865417c1'
    
      65            'e2c715973e9e720008bb6507f3fe31563772907eb236a6ecb804186b539485c2'
    
      66            'f436d99d242064c905f06eb53f1a810e90e7be92a804015e4679cea1fcb62885'
    
      67            '6fcbfa4cba8e730e603b68fcca484c7963aacdaf56a3f6c5c47ff320a5189e85'
    
      68            '43164499524650222076bae69b7cb21d3e3e4a954c7c56426474267a554a2f33'
    
      69            'aa036c1f37d070f14a551bcba2133390710da46bd91225dfd366711bb5a3b6ec')
    
      70sha256sums_x86_64=('5767e48a9f3cf374489adedc857c539eb83de54d3cfc72c0f3192883f6d390ee'
    
      71                   'c0b4edd6bd9858cda4cf7ab299e69a2d3ecd2e5fcca78507bc0851ba35614660'
    
      72                   '12149ad8c0cd748fd5062d8f62c7827d688d8095427ada99b1ae9e7019897523')
    
      73sha256sums_aarch64=('0b805783a732c7c9816aebe972d97effe24d678cae89821e06270cd8661056c3'
    
      74                    '37a228821184136fa86a8727bec19ab400524dd7d4bca78937de5d50704592d1'
    
      75                    '561822578435d382a06d0a0b079a4b157f68b588c9fe72d589e2a88b2fd155fa')
    
      76
    
      77build() {
    
      78  local darwin_zip electron_zip cn_deb app_bundle
    
      79
    
      80  case "${CARCH}" in
    
      81    x86_64)
    
      82      darwin_zip="WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip"
    
      83      electron_zip="electron-v${_electronver}-linux-x64.zip"
    
      84      cn_deb="WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      85      ;;
    
      86    aarch64)
    
      87      darwin_zip="WorkBuddy-darwin-arm64-${_pkgver}-${_build}.zip"
    
      88      electron_zip="electron-v${_electronver}-linux-arm64.zip"
    
      89      cn_deb="WorkBuddy-linux-arm64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      90      ;;
    
      91    *)
    
      92      printf 'unsupported architecture: %s\n' "${CARCH}" >&2
    
      93      return 1
    
      94      ;;
    
      95  esac
    
      96
    
      97  rm -rf "${srcdir}/app-extract"
    
      98  install -dm755 "${srcdir}/app-extract"
    
      99  # __MACOSX 是 macOS 打包时混入的资源叉元数据，解包时直接排除，
    
      100  # 避免 find 选到错误的 .app
    
      101  unzip -q "${srcdir}/${darwin_zip}" -d "${srcdir}/app-extract" -x '__MACOSX/*'
    
      102
    
      103  app_bundle="$(find "${srcdir}/app-extract" -maxdepth 2 -name '*.app' -type d | sort | head -n1)"
    
      104  [[ -n "${app_bundle}" ]] || { printf 'no .app bundle found in the darwin zip\n' >&2; return 1; }
    
      105
    
      106  WORKBUDDY_APP_ID='WorkBuddy AI' \
    
      107  WORKBUDDY_APP_DISPLAY_NAME='WorkBuddy AI (International)' \
    
      108  WORKBUDDY_INSTALL_DIR="${srcdir}/workbuddy-app" \
    
      109  WORKBUDDY_ELECTRON_ZIP="${srcdir}/${electron_zip}" \
    
      110    bash "${srcdir}/install.sh" "${app_bundle}"
    
      111
    
      112  # 从国内版官方 Linux deb 提取会话运行时。国际版的 darwin 包只在
    
      113  # win32/darwin 条目下捆绑运行时，Linux 条目（node.tar.gz/python.tar.gz）
    
      114  # 实际不存在；缺失时 daemon 反复退出并弹 "critical component" 警告
    
      115  rm -rf "${srcdir}/cn-deb-extract"
    
      116  install -dm755 "${srcdir}/cn-deb-extract"
    
      117  bsdtar -C "${srcdir}/cn-deb-extract" -xf "${srcdir}/${cn_deb}"
    
      118  bsdtar -C "${srcdir}/cn-deb-extract" -xf "${srcdir}/cn-deb-extract"/data.tar.* \
    
      119    ./opt/WorkBuddy/resources/runtime
    
      120
    
      121  local runtime_dir="${srcdir}/cn-deb-extract/opt/WorkBuddy/resources/runtime"
    
      122  [[ -x "${runtime_dir}/node/bin/node" && -x "${runtime_dir}/python/bin/python3" ]] || {
    
      123    printf 'session runtimes missing from the domestic deb: %s\n' "${runtime_dir}" >&2
    
      124    return 1
    
      125  }
    
      126  rm -rf "${srcdir}/workbuddy-app/resources/runtime"
    
      127  cp -a "${runtime_dir}" "${srcdir}/workbuddy-app/resources/runtime"
    
      128}
    
      129
    
      130package() {
    
      131  install -dm755 "${pkgdir}/opt/workbuddy-international"
    
      132  cp -a "${srcdir}/workbuddy-app/." "${pkgdir}/opt/workbuddy-international/"
    
      133
    
      134  # The helper desktop file written by install.sh embeds the build-time
    
      135  # srcdir in Exec=; point it at the final install location instead.
    
      136  sed -i "s|${srcdir}/workbuddy-app|/opt/workbuddy-international|g" \
    
      137    "${pkgdir}/opt/workbuddy-international/.workbuddy-linux/WorkBuddy AI.desktop" 2>/dev/null || true
    
      138
    
      139  # Desktop entry: named exactly after the app's Wayland app_id ("WorkBuddy AI")
    
      140  # so the task manager associates windows with this entry and its icon.
    
      141  install -Dm644 "${srcdir}/workbuddy-international.desktop" \
    
      142    "${pkgdir}/usr/share/applications/WorkBuddy AI.desktop"
    
      143
    
      144  # Icons: theme-integrated hicolor entry plus pixmaps fallback
    
      145  install -Dm644 "${srcdir}/workbuddy-app/.workbuddy-linux/workbuddy.png" \
    
      146    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/workbuddy-international.png"
    
      147  install -Dm644 "${srcdir}/workbuddy-app/.workbuddy-linux/workbuddy.png" \
    
      148    "${pkgdir}/usr/share/pixmaps/workbuddy-international.png"
    
      149
    
      150  # Launcher
    
      151  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/workbuddy-international" <<'LAUNCHER'
    
      152#!/usr/bin/env bash
    
      153exec /opt/workbuddy-international/start.sh "$@"
    
      154LAUNCHER
    
      155
    
      156  # Licenses / notices
    
      157  install -Dm644 "${srcdir}/LICENSE.port-tool" \
    
      158    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.port-tool"
    
      159  install -Dm644 "${srcdir}/DISCLAIMER" \
    
      160    "${pkgdir}/usr/share/licenses/${pkgname}/DISCLAIMER"
    
      161}
    
      162

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 11:39:11	Medium	3
2026-10-23 11:37:13	Medium	3