workbuddy-international-bin

MEDIUM

maintainer wasdxl 0 votes scanned 2026-09-11 15:25:17.165717

View on AUR

Why flagged

The macOS DMG is downloaded from a Tencent Cloud COS bucket (codebuddy-1328495429.cos.accelerate.myqcloud.com) which, while plausibly the vendor's own CDN, is an opaque object storage URL with no official documentation linking it to workbuddy.ai; additionally, a local install.sh script (not in source=()) is executed during build() with full access to the extracted app bundle, making its contents unauditable from the PKGBUILD alone — together these represent a meaningful but not clearly malicious supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 source=("${_dmg}::https://codebuddy-1328495429.cos.accelerate.myqcloud.com/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${_pkgver}-${_build}.dmg"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): The macOS DMG is downloaded from a Tencent Cloud COS bucket (codebuddy-1328495429.cos.accelerate.myqcloud.com) which, while plausibly the vendor's own CDN, is an opaque object storage URL with no official documentation linking it to workbuddy.ai; additionally, a local install.sh script (not in source=()) is executed during build() with full access to the extracted app bundle, making its contents unauditable from the PKGBUILD alone — together these represent a meaningful but not clearly malicious supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: local build
    
      2# Unofficial Linux port of the WorkBuddy AI international (workbuddy.ai) macOS client.
    
      3# Conversion toolchain vendored from the MIT-licensed workbuddy-linux community
    
      4# project (see LICENSE.port-tool). Not affiliated with Tencent. See DISCLAIMER.
    
      5
    
      6pkgname=workbuddy-international-bin
    
      7_pkgver=5.5.2.37849279
    
      8_build=910352f0
    
      9_electronver=37.10.3
    
      10pkgver=${_pkgver}_${_build}
    
      11pkgrel=1
    
      12pkgdesc="AI Agent for everyday office work (international edition, unofficial Linux port)"
    
      13arch=('x86_64')
    
      14url="https://www.workbuddy.ai"
    
      15license=('custom')
    
      16depends=('libsecret' 'libappindicator-gtk3' 'nss' 'alsa-lib' 'gtk3' 'libxss')
    
      17makedepends=('nodejs' 'npm' 'p7zip' 'unzip' 'python' 'imagemagick')
    
      18optdepends=('nodejs-lts: frontend skills'
    
      19            'gnome-shell-extension-appindicator: tray icon support')
    
      20options=(!strip !debug)
    
      21
    
      22# The international edition publishes no Linux package; the macOS x64 DMG is the
    
      23# canonical source. Version and DMG sha256 are published by the official update
    
      24# API:  curl 'https://www.workbuddy.ai/v2/update?platform=workbuddy-darwin-x64'
    
      25# The Electron runtime version matches the one bundled in the DMG.
    
      26_dmg="WorkBuddy-darwin-x64-${_pkgver}-${_build}.dmg"
    
      27_electronzip="electron-v${_electronver}-linux-x64.zip"
    
      28source=("${_dmg}::https://codebuddy-1328495429.cos.accelerate.myqcloud.com/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${_pkgver}-${_build}.dmg"
    
      29        "${_electronzip}::https://github.com/electron/electron/releases/download/v${_electronver}/${_electronzip}"
    
      30        "workbuddy-international.desktop")
    
      31sha256sums=('722065401d9e8fc0b49147662198e132f62e18df0ce03baee23336caf1687006'
    
      32            'c0b4edd6bd9858cda4cf7ab299e69a2d3ecd2e5fcca78507bc0851ba35614660'
    
      33            '6fcbfa4cba8e730e603b68fcca484c7963aacdaf56a3f6c5c47ff320a5189e85')
    
      34
    
      35prepare() {
    
      36    # Extract the .app bundle out of the DMG
    
      37    rm -rf "${srcdir}/dmg"
    
      38    mkdir -p "${srcdir}/dmg"
    
      39    7z x -o"${srcdir}/dmg" "${srcdir}/${_dmg}" -y >/dev/null
    
      40}
    
      41
    
      42build() {
    
      43    # Run the vendored conversion toolchain: use the pre-seeded Linux Electron
    
      44    # runtime, rebuild native modules for Linux, apply runtime patches
    
      45    # (anchor-tolerant; 5.5.x needs almost none of them).
    
      46    export WORKBUDDY_APP_ID="WorkBuddy AI"
    
      47    export WORKBUDDY_APP_DISPLAY_NAME="WorkBuddy AI (International)"
    
      48    export WORKBUDDY_INSTALL_DIR="${srcdir}/workbuddy-app"
    
      49    export WORKBUDDY_ELECTRON_ZIP="${srcdir}/${_electronzip}"
    
      50    local app_bundle
    
      51    app_bundle="$(find "${srcdir}/dmg" -maxdepth 2 -name "*.app" -type d | head -1)"
    
      52    bash "${startdir}/install.sh" "${app_bundle}"
    
      53}
    
      54
    
      55package() {
    
      56    install -dm755 "${pkgdir}/opt/workbuddy-international"
    
      57    cp -a "${srcdir}/workbuddy-app/." "${pkgdir}/opt/workbuddy-international/"
    
      58
    
      59    # The helper desktop file written by install.sh embeds the build-time
    
      60    # srcdir in Exec=; point it at the final install location instead.
    
      61    sed -i "s|${srcdir}/workbuddy-app|/opt/workbuddy-international|g" \
    
      62        "${pkgdir}/opt/workbuddy-international/.workbuddy-linux/WorkBuddy AI.desktop" 2>/dev/null || true
    
      63
    
      64    # Desktop entry: named exactly after the app's Wayland app_id ("WorkBuddy AI")
    
      65    # so the task manager associates windows with this entry and its icon.
    
      66    install -Dm644 "${startdir}/workbuddy-international.desktop" \
    
      67        "${pkgdir}/usr/share/applications/WorkBuddy AI.desktop"
    
      68
    
      69    # Icons: theme-integrated hicolor entry plus pixmaps fallback
    
      70    install -Dm644 "${srcdir}/workbuddy-app/.workbuddy-linux/workbuddy.png" \
    
      71        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/workbuddy-international.png"
    
      72    install -Dm644 "${srcdir}/workbuddy-app/.workbuddy-linux/workbuddy.png" \
    
      73        "${pkgdir}/usr/share/pixmaps/workbuddy-international.png"
    
      74
    
      75    # Launcher
    
      76    install -dm755 "${pkgdir}/usr/bin"
    
      77    cat > "${pkgdir}/usr/bin/workbuddy-international" <<'EOF'
    
      78#!/usr/bin/env bash
    
      79exec /opt/workbuddy-international/start.sh "$@"
    
      80EOF
    
      81    chmod 755 "${pkgdir}/usr/bin/workbuddy-international"
    
      82
    
      83    # Licenses / notices
    
      84    install -Dm644 "${startdir}/LICENSE.port-tool" \
    
      85        "${pkgdir}/usr/share/licenses/workbuddy-international/LICENSE.port-tool"
    
      86    install -Dm644 "${startdir}/DISCLAIMER" \
    
      87        "${pkgdir}/usr/share/licenses/workbuddy-international/DISCLAIMER"
    
      88}
    
      89

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-11 15:25:17	Medium	3
2026-09-11 15:22:58	Medium	3