api-fox-bin

maintainer czyt · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a prebuilt .deb from the official vendor's domain (apifox.com) over HTTPS, which is then extracted and installed; this is a normal distribution method for proprietary software and the checksums are verified, but the download URL uses a non-standard subdomain which triggered a static warning, though the source is legitimate and the risk is low.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a prebuilt .deb from the official vendor's domain (apifox.com) over HTTPS, which is then extracted and installed; this is a normal distribution method for proprietary software and the checksums are verified, but the download URL uses a non-standard subdomain which triggered a static warning, though the source is legitimate and the risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:56 "${_zip_x86_64}::https://file-assets.apifox.com/download/Apifox-linux-deb-latest.zip?version=${pkgver}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2# Official downloads: https://apifox.com/download
    
      3
    
      4pkgname=api-fox-bin
    
      5pkgver=2.8.43
    
      6pkgrel=1
    
      7pkgdesc="Apifox API documentation, debugging, mocking, and automated testing tool"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://apifox.com"
    
      10license=('LicenseRef-Proprietary')
    
      11
    
      12depends=(
    
      13  'alsa-lib'
    
      14  'at-spi2-core'
    
      15  'cairo'
    
      16  'dbus'
    
      17  'expat'
    
      18  'gcc-libs'
    
      19  'glib2'
    
      20  'glibc'
    
      21  'gtk3'
    
      22  'libcups'
    
      23  'libnotify'
    
      24  'libsecret'
    
      25  'libx11'
    
      26  'libxcb'
    
      27  'libxcomposite'
    
      28  'libxdamage'
    
      29  'libxext'
    
      30  'libxfixes'
    
      31  'libxkbcommon'
    
      32  'libxrandr'
    
      33  'libxss'
    
      34  'libxtst'
    
      35  'mesa'
    
      36  'nspr'
    
      37  'nss'
    
      38  'pango'
    
      39  'systemd-libs'
    
      40  'util-linux-libs'
    
      41  'xdg-utils'
    
      42)
    
      43
    
      44optdepends=(
    
      45  'java-runtime: run the bundled Java database executors'
    
      46  'libappindicator-gtk3: system tray icon support'
    
      47)
    
      48makedepends=('libarchive')
    
      49provides=("apifox=${pkgver}")
    
      50conflicts=('apifox' 'apifox-bin' 'apifox-appimage')
    
      51options=('!debug' '!strip')
    
      52
    
      53_zip_x86_64="apifox-${pkgver}-${pkgrel}-x86_64.zip"
    
      54_zip_aarch64="apifox-${pkgver}-${pkgrel}-aarch64.zip"
    
      55source_x86_64=(
    
      56  "${_zip_x86_64}::https://file-assets.apifox.com/download/Apifox-linux-deb-latest.zip?version=${pkgver}"
    
      57)
    
      58source_aarch64=(
    
      59  "${_zip_aarch64}::https://file-assets.apifox.com/download/Apifox-linux-arm64-deb-latest.zip?version=${pkgver}"
    
      60)
    
      61noextract=("${_zip_x86_64}" "${_zip_aarch64}")
    
      62sha256sums_x86_64=('f465cb6fe1f35c0ff4b1b13b229679e7754fc74daf35c956d35b4655fc4f7387')
    
      63sha256sums_aarch64=('07c8a95b7d9f6b54b40156702ecda42422442478e54ce8d58fb0aa76f0cd386c')
    
      64
    
      65package() {
    
      66  local zip_var="_zip_${CARCH}"
    
      67  local zip_file="${!zip_var}"
    
      68  local data_member
    
      69  local -a deb_files
    
      70
    
      71  mapfile -t deb_files < <(bsdtar -tf "${srcdir}/${zip_file}" | awk '/[.]deb$/')
    
      72  [[ ${#deb_files[@]} -eq 1 ]] || {
    
      73    printf 'Expected exactly one deb in %s, found %d\n' \
    
      74      "${zip_file}" "${#deb_files[@]}" >&2
    
      75    return 1
    
      76  }
    
      77
    
      78  data_member=$(
    
      79    bsdtar -xOf "${srcdir}/${zip_file}" "${deb_files[0]}" |
    
      80      bsdtar -tf - |
    
      81      awk '/^data[.]tar[.]/ { print; exit }'
    
      82  )
    
      83  [[ -n "${data_member}" ]] || {
    
      84    printf 'Could not find the deb data archive in %s\n' "${zip_file}" >&2
    
      85    return 1
    
      86  }
    
      87
    
      88  bsdtar -xOf "${srcdir}/${zip_file}" "${deb_files[0]}" |
    
      89    bsdtar -xOf - "${data_member}" |
    
      90    bsdtar --no-same-owner -xf - -C "${pkgdir}"
    
      91
    
      92  install -dm755 "${pkgdir}/usr/bin"
    
      93  ln -s /opt/Apifox/apifox "${pkgdir}/usr/bin/apifox"
    
      94  chmod 4755 "${pkgdir}/opt/Apifox/chrome-sandbox"
    
      95
    
      96  install -Dm644 "${pkgdir}/opt/Apifox/LICENSE.electron.txt" \
    
      97    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      98  install -Dm644 "${pkgdir}/opt/Apifox/LICENSES.chromium.html" \
    
      99    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      100
    
      101  # Debian package-policy files are not used on Arch Linux.
    
      102  rm -rf "${pkgdir}/usr/share/doc"
    
      103}
    
      104

Changes since previous scan

--- PKGBUILD @ 2026-08-16 00:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,8 +2,8 @@
 # Official downloads: https://apifox.com/download
 
 pkgname=api-fox-bin
-pkgver=2.8.42
-pkgrel=2
+pkgver=2.8.43
+pkgrel=1
 pkgdesc="Apifox API documentation, debugging, mocking, and automated testing tool"
 arch=('x86_64' 'aarch64')
 url="https://apifox.com"
@@ -50,17 +50,17 @@
 conflicts=('apifox' 'apifox-bin' 'apifox-appimage')
 options=('!debug' '!strip')
 
-_zip_x86_64="apifox-${pkgver}-x86_64.zip"
-_zip_aarch64="apifox-${pkgver}-aarch64.zip"
+_zip_x86_64="apifox-${pkgver}-${pkgrel}-x86_64.zip"
+_zip_aarch64="apifox-${pkgver}-${pkgrel}-aarch64.zip"
 source_x86_64=(
-  "${_zip_x86_64}::https://file-assets.apifox.com/download/Apifox-linux-deb-latest.zip"
+  "${_zip_x86_64}::https://file-assets.apifox.com/download/Apifox-linux-deb-latest.zip?version=${pkgver}"
 )
 source_aarch64=(
-  "${_zip_aarch64}::https://file-assets.apifox.com/download/Apifox-linux-arm64-deb-latest.zip"
+  "${_zip_aarch64}::https://file-assets.apifox.com/download/Apifox-linux-arm64-deb-latest.zip?version=${pkgver}"
 )
 noextract=("${_zip_x86_64}" "${_zip_aarch64}")
-sha256sums_x86_64=('0ba43fd19a309fa9e55ee920e2d95008b34dff3ebd99210be7b54be033bc5761')
-sha256sums_aarch64=('fd8127b42e039d559cb52d10a761e897b01cdf7f78e84c320e18b3ce6a54613b')
+sha256sums_x86_64=('f465cb6fe1f35c0ff4b1b13b229679e7754fc74daf35c956d35b4655fc4f7387')
+sha256sums_aarch64=('07c8a95b7d9f6b54b40156702ecda42422442478e54ce8d58fb0aa76f0cd386c')
 
 package() {
   local zip_var="_zip_${CARCH}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 13:32:24	MEDIUM	2
2026-08-16 00:03:42	LOW	3
2026-08-15 00:26:13	LOW	3
2026-08-14 01:27:12	MEDIUM	2
2026-08-14 00:03:41	LOW	3
2026-08-13 15:32:42	LOW	3
2026-08-13 15:26:23	MEDIUM	2