api-fox-bin
LOW
maintainer czyt
1 votes
scanned 2026-10-02 00:00:32.890515
Why flagged
The package downloads a prebuilt .deb from the official vendor's domain (apifox.com) over HTTPS, which is then extracted and installed; despite the non-whitelisted host, the source is verifiable and the checksums are provided, reducing risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official vendor's domain (apifox.com) over HTTPS, which is then extracted and installed; despite the non-whitelisted host, the source is verifiable and the checksums are provided, reducing risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:56
"${_zip_x86_64}::https://file-assets.apifox.com/download/Apifox-linux-deb-latest.zip?version=${pkgver}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: czyt <czytcn@gmail.com>
2
# Official downloads: https://apifox.com/download
3
4
pkgname=api-fox-bin
5
pkgver=2.8.48
6
pkgrel=1
7
pkgdesc="Apifox API documentation, debugging, mocking, and automated testing tool"
8
arch=('x86_64' 'aarch64')
9
url="https://apifox.com"
10
license=('LicenseRef-Proprietary')
11
12
depends=(
13
'alsa-lib'
14
'at-spi2-core'
15
'cairo'
16
'dbus'
17
'expat'
18
'gcc-libs'
19
'glib2'
20
'glibc'
21
'gtk3'
22
'libcups'
23
'libnotify'
24
'libsecret'
25
'libx11'
26
'libxcb'
27
'libxcomposite'
28
'libxdamage'
29
'libxext'
30
'libxfixes'
31
'libxkbcommon'
32
'libxrandr'
33
'libxss'
34
'libxtst'
35
'mesa'
36
'nspr'
37
'nss'
38
'pango'
39
'systemd-libs'
40
'util-linux-libs'
41
'xdg-utils'
42
)
43
44
optdepends=(
45
'java-runtime: run the bundled Java database executors'
46
'libappindicator-gtk3: system tray icon support'
47
)
48
makedepends=('libarchive')
49
provides=("apifox=${pkgver}")
50
conflicts=('apifox' 'apifox-bin' 'apifox-appimage')
51
options=('!debug' '!strip')
52
53
_zip_x86_64="apifox-${pkgver}-${pkgrel}-x86_64.zip"
54
_zip_aarch64="apifox-${pkgver}-${pkgrel}-aarch64.zip"
55
source_x86_64=(
56
"${_zip_x86_64}::https://file-assets.apifox.com/download/Apifox-linux-deb-latest.zip?version=${pkgver}"
57
)
58
source_aarch64=(
59
"${_zip_aarch64}::https://file-assets.apifox.com/download/Apifox-linux-arm64-deb-latest.zip?version=${pkgver}"
60
)
61
noextract=("${_zip_x86_64}" "${_zip_aarch64}")
62
sha256sums_x86_64=('30a9a936ca2bfa1d1a2d3a9393e3562ef1e9dfbd4fb47e811fba239930cdd740')
63
sha256sums_aarch64=('082dc09a703fbb9ef916a2107cfbc9d7bf3f4b23942e1bf839b10f5161ea86f4')
64
65
package() {
66
local zip_var="_zip_${CARCH}"
67
local zip_file="${!zip_var}"
68
local data_member
69
local -a deb_files
70
71
mapfile -t deb_files < <(bsdtar -tf "${srcdir}/${zip_file}" | awk '/[.]deb$/')
72
[[ ${#deb_files[@]} -eq 1 ]] || {
73
printf 'Expected exactly one deb in %s, found %d\n' \
74
"${zip_file}" "${#deb_files[@]}" >&2
75
return 1
76
}
77
78
data_member=$(
79
bsdtar -xOf "${srcdir}/${zip_file}" "${deb_files[0]}" |
80
bsdtar -tf - |
81
awk '/^data[.]tar[.]/ { print; exit }'
82
)
83
[[ -n "${data_member}" ]] || {
84
printf 'Could not find the deb data archive in %s\n' "${zip_file}" >&2
85
return 1
86
}
87
88
bsdtar -xOf "${srcdir}/${zip_file}" "${deb_files[0]}" |
89
bsdtar -xOf - "${data_member}" |
90
bsdtar --no-same-owner -xf - -C "${pkgdir}"
91
92
install -dm755 "${pkgdir}/usr/bin"
93
ln -s /opt/Apifox/apifox "${pkgdir}/usr/bin/apifox"
94
chmod 4755 "${pkgdir}/opt/Apifox/chrome-sandbox"
95
96
install -Dm644 "${pkgdir}/opt/Apifox/LICENSE.electron.txt" \
97
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
98
install -Dm644 "${pkgdir}/opt/Apifox/LICENSES.chromium.html" \
99
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
100
101
# Debian package-policy files are not used on Arch Linux.
102
rm -rf "${pkgdir}/usr/share/doc"
103
}
104
Changes since previous scan
--- PKGBUILD @ 2026-09-20 00:25+++ PKGBUILD @ 2026-10-02 00:00@@ -2,7 +2,7 @@ # Official downloads: https://apifox.com/download pkgname=api-fox-bin-pkgver=2.8.47+pkgver=2.8.48 pkgrel=1 pkgdesc="Apifox API documentation, debugging, mocking, and automated testing tool" arch=('x86_64' 'aarch64')@@ -59,8 +59,8 @@ "${_zip_aarch64}::https://file-assets.apifox.com/download/Apifox-linux-arm64-deb-latest.zip?version=${pkgver}" ) noextract=("${_zip_x86_64}" "${_zip_aarch64}")-sha256sums_x86_64=('a8d732b1ef073b0135ab0dd1b42a83568f42837b67e6c1ddd54770ba8b423d71')-sha256sums_aarch64=('283d191de2394e64366bc8bf78a6c5f5a04107d269ef8a015ac93f188f6ee4d2')+sha256sums_x86_64=('30a9a936ca2bfa1d1a2d3a9393e3562ef1e9dfbd4fb47e811fba239930cdd740')+sha256sums_aarch64=('082dc09a703fbb9ef916a2107cfbc9d7bf3f4b23942e1bf839b10f5161ea86f4') package() { local zip_var="_zip_${CARCH}"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 15:33:19 | Medium | 1 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 17:20:16 | Medium | 1 |
| 2026-09-15 00:25:31 | Low | 2 |