workbuddy-intl-agent

MEDIUM

maintainer lzsnyy 0 votes scanned 2026-11-03 12:09:28.176153

View on AUR

Why flagged

Downloads and executes a macOS app bundle converted to Linux via bundled shell scripts (install.sh, lib-*.sh) from local sources with checksums, plus extracts node/python runtimes from a Chinese-edition .deb (download.codebuddy.cn) — a non-standard host that is plausibly the project's own but unverifiable; the runtimes are executed at runtime, making a silently swapped binary a real supply-chain risk, though checksums are provided for all sources.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:46 "WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip::https://download.codebuddy.ai/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip"
PKGBUILD:48 "WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and executes a macOS app bundle converted to Linux via bundled shell scripts (install.sh, lib-*.sh) from local sources with checksums, plus extracts node/python runtimes from a Chinese-edition .deb (download.codebuddy.cn) — a non-standard host that is plausibly the project's own but unverifiable; the runtimes are executed at runtime, making a silently swapped binary a real supply-chain risk, though checksums are provided for all sources.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: lzsnyy <710080675@qq.com>
    
      2#
    
      3# Unofficial Linux port: the WorkBuddy international edition (workbuddy.ai)
    
      4# publishes no Linux build. This package converts the official macOS build to
    
      5# a Linux Electron app on the user's machine; nothing proprietary is
    
      6# redistributed. Conversion toolchain vendored from the MIT-licensed
    
      7# community project workbuddy-linux (see LICENSE.port-tool); see DISCLAIMER.
    
      8#
    
      9# The node/python session runtimes are taken from the official domestic-
    
      10# edition Linux deb (download.codebuddy.cn): the international darwin build
    
      11# bundles macOS/Windows runtimes only, while the app expects
    
      12# resources/runtime/{node,python} on Linux. The runtimes are edition-
    
      13# agnostic and pinned to their own upstream version.
    
      14
    
      15pkgname=workbuddy-intl-agent
    
      16_pkgver=5.9.4.42593613
    
      17_build=fa0a0901
    
      18_electronver=37.10.3
    
      19_cn_pkgver=5.6.2.40046327
    
      20_cn_build=c7b525f3
    
      21pkgver=${_pkgver}_${_build}
    
      22pkgrel=1
    
      23pkgdesc='AI Agent for everyday office work - WorkBuddy international edition (unofficial Linux port)'
    
      24arch=('x86_64' 'aarch64')
    
      25url='https://www.workbuddy.ai'
    
      26license=('NOASSERTION')
    
      27depends=('libsecret' 'libappindicator-gtk3' 'nss' 'alsa-lib' 'gtk3' 'libxss')
    
      28makedepends=('nodejs' 'npm' 'p7zip' 'unzip' 'python' 'imagemagick')
    
      29optdepends=('gnome-shell-extension-appindicator: tray icon support')
    
      30options=('!strip' '!debug')
    
      31provides=('workbuddy-international-bin')
    
      32conflicts=('workbuddy-international')
    
      33source=(
    
      34  'install.sh'
    
      35  'lib-common.sh'
    
      36  'lib-dmg.sh'
    
      37  'lib-electron.sh'
    
      38  'lib-native-modules.sh'
    
      39  'lib-linux-patches.sh'
    
      40  'lib-apply-linux-patches.js'
    
      41  'workbuddy-international.desktop'
    
      42  'LICENSE.port-tool'
    
      43  'DISCLAIMER'
    
      44)
    
      45source_x86_64=(
    
      46  "WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip::https://download.codebuddy.ai/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip"
    
      47  "electron-v${_electronver}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electronver}/electron-v${_electronver}-linux-x64.zip"
    
      48  "WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-x64-deb/WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      49)
    
      50source_aarch64=(
    
      51  "WorkBuddy-darwin-arm64-${_pkgver}-${_build}.zip::https://download.codebuddy.ai/workbuddy/saas/darwin-arm64/WorkBuddy-darwin-arm64-${_pkgver}-${_build}.zip"
    
      52  "electron-v${_electronver}-linux-arm64.zip::https://github.com/electron/electron/releases/download/v${_electronver}/electron-v${_electronver}-linux-arm64.zip"
    
      53  "WorkBuddy-linux-arm64-deb-${_cn_pkgver}-${_cn_build}.deb::https://download.codebuddy.cn/workbuddy/saas/linux-arm64-deb/WorkBuddy-linux-arm64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      54)
    
      55noextract=(
    
      56  "WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      57  "WorkBuddy-linux-arm64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      58)
    
      59sha256sums=('6e8c6154b013e26cb2f8f2c3646b206a135cd0060e67f86298c1d2b23c10a1c3'
    
      60            '33aeab4b44329127ce747cc3048df98db9873cb511685e666d81332d9c219c73'
    
      61            'f263ea88a81ceb8be3b59c458fd7be15daf0dbbd2b625fc143f772ad300742fd'
    
      62            'f207ee01cc207532c3c804ba6ff6ab4209adab06a1903d9b9f38b8d96d90d50c'
    
      63            '6d9bf1001374d62e12941c7e98acee1329fbe4dcaf4ae809509c934b865417c1'
    
      64            'e2c715973e9e720008bb6507f3fe31563772907eb236a6ecb804186b539485c2'
    
      65            'f436d99d242064c905f06eb53f1a810e90e7be92a804015e4679cea1fcb62885'
    
      66            '6fcbfa4cba8e730e603b68fcca484c7963aacdaf56a3f6c5c47ff320a5189e85'
    
      67            '43164499524650222076bae69b7cb21d3e3e4a954c7c56426474267a554a2f33'
    
      68            'aa036c1f37d070f14a551bcba2133390710da46bd91225dfd366711bb5a3b6ec')
    
      69sha256sums_x86_64=('57935f9578fed1ddf0ab0219a328d96f69494a45369e88aabf1f650242084e87'
    
      70                   'c0b4edd6bd9858cda4cf7ab299e69a2d3ecd2e5fcca78507bc0851ba35614660'
    
      71                   '12149ad8c0cd748fd5062d8f62c7827d688d8095427ada99b1ae9e7019897523')
    
      72sha256sums_aarch64=('754926260c0ab867b5fe1050ab5cc01724a1330451617c8f339c679ff3bbc542'
    
      73                    '37a228821184136fa86a8727bec19ab400524dd7d4bca78937de5d50704592d1'
    
      74                    '561822578435d382a06d0a0b079a4b157f68b588c9fe72d589e2a88b2fd155fa')
    
      75
    
      76build() {
    
      77  local darwin_zip electron_zip cn_deb app_bundle
    
      78
    
      79  case "${CARCH}" in
    
      80    x86_64)
    
      81      darwin_zip="WorkBuddy-darwin-x64-${_pkgver}-${_build}.zip"
    
      82      electron_zip="electron-v${_electronver}-linux-x64.zip"
    
      83      cn_deb="WorkBuddy-linux-x64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      84      ;;
    
      85    aarch64)
    
      86      darwin_zip="WorkBuddy-darwin-arm64-${_pkgver}-${_build}.zip"
    
      87      electron_zip="electron-v${_electronver}-linux-arm64.zip"
    
      88      cn_deb="WorkBuddy-linux-arm64-deb-${_cn_pkgver}-${_cn_build}.deb"
    
      89      ;;
    
      90    *)
    
      91      printf 'unsupported architecture: %s\n' "${CARCH}" >&2
    
      92      return 1
    
      93      ;;
    
      94  esac
    
      95
    
      96  rm -rf "${srcdir}/app-extract"
    
      97  install -dm755 "${srcdir}/app-extract"
    
      98  # __MACOSX 是 macOS 打包时混入的资源叉元数据，解包时直接排除，
    
      99  # 避免 find 选到错误的 .app
    
      100  unzip -q "${srcdir}/${darwin_zip}" -d "${srcdir}/app-extract" -x '__MACOSX/*'
    
      101
    
      102  app_bundle="$(find "${srcdir}/app-extract" -maxdepth 2 -name '*.app' -type d | sort | head -n1)"
    
      103  [[ -n "${app_bundle}" ]] || { printf 'no .app bundle found in the darwin zip\n' >&2; return 1; }
    
      104
    
      105  WORKBUDDY_APP_ID='WorkBuddy AI' \
    
      106  WORKBUDDY_APP_DISPLAY_NAME='WorkBuddy AI (International)' \
    
      107  WORKBUDDY_INSTALL_DIR="${srcdir}/workbuddy-app" \
    
      108  WORKBUDDY_ELECTRON_ZIP="${srcdir}/${electron_zip}" \
    
      109    bash "${srcdir}/install.sh" "${app_bundle}"
    
      110
    
      111  # 从国内版官方 Linux deb 提取会话运行时。国际版的 darwin 包只在
    
      112  # win32/darwin 条目下捆绑运行时，Linux 条目（node.tar.gz/python.tar.gz）
    
      113  # 实际不存在；缺失时 daemon 反复退出并弹 "critical component" 警告
    
      114  rm -rf "${srcdir}/cn-deb-extract"
    
      115  install -dm755 "${srcdir}/cn-deb-extract"
    
      116  bsdtar -C "${srcdir}/cn-deb-extract" -xf "${srcdir}/${cn_deb}"
    
      117  bsdtar -C "${srcdir}/cn-deb-extract" -xf "${srcdir}/cn-deb-extract"/data.tar.* \
    
      118    ./opt/WorkBuddy/resources/runtime
    
      119
    
      120  local runtime_dir="${srcdir}/cn-deb-extract/opt/WorkBuddy/resources/runtime"
    
      121  [[ -x "${runtime_dir}/node/bin/node" && -x "${runtime_dir}/python/bin/python3" ]] || {
    
      122    printf 'session runtimes missing from the domestic deb: %s\n' "${runtime_dir}" >&2
    
      123    return 1
    
      124  }
    
      125  rm -rf "${srcdir}/workbuddy-app/resources/runtime"
    
      126  cp -a "${runtime_dir}" "${srcdir}/workbuddy-app/resources/runtime"
    
      127}
    
      128
    
      129package() {
    
      130  install -dm755 "${pkgdir}/opt/workbuddy-international"
    
      131  cp -a "${srcdir}/workbuddy-app/." "${pkgdir}/opt/workbuddy-international/"
    
      132
    
      133  # The helper desktop file written by install.sh embeds the build-time
    
      134  # srcdir in Exec=; point it at the final install location instead.
    
      135  sed -i "s|${srcdir}/workbuddy-app|/opt/workbuddy-international|g" \
    
      136    "${pkgdir}/opt/workbuddy-international/.workbuddy-linux/WorkBuddy AI.desktop" 2>/dev/null || true
    
      137
    
      138  # Desktop entry: named exactly after the app's Wayland app_id ("WorkBuddy AI")
    
      139  # so the task manager associates windows with this entry and its icon.
    
      140  install -Dm644 "${srcdir}/workbuddy-international.desktop" \
    
      141    "${pkgdir}/usr/share/applications/WorkBuddy AI.desktop"
    
      142
    
      143  # Icons: theme-integrated hicolor entry plus pixmaps fallback
    
      144  install -Dm644 "${srcdir}/workbuddy-app/.workbuddy-linux/workbuddy.png" \
    
      145    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/workbuddy-international.png"
    
      146  install -Dm644 "${srcdir}/workbuddy-app/.workbuddy-linux/workbuddy.png" \
    
      147    "${pkgdir}/usr/share/pixmaps/workbuddy-international.png"
    
      148
    
      149  # Launcher
    
      150  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/workbuddy-international" <<'LAUNCHER'
    
      151#!/usr/bin/env bash
    
      152exec /opt/workbuddy-international/start.sh "$@"
    
      153LAUNCHER
    
      154
    
      155  # Licenses / notices
    
      156  install -Dm644 "${srcdir}/LICENSE.port-tool" \
    
      157    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.port-tool"
    
      158  install -Dm644 "${srcdir}/DISCLAIMER" \
    
      159    "${pkgdir}/usr/share/licenses/${pkgname}/DISCLAIMER"
    
      160}
    
      161

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 12:09:28	Medium	3
2026-11-03 12:04:35	Medium	3