apifox
LOW
maintainer duanluan
9 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt tarball from a non-whitelisted but plausibly official Aliyun CDN host; however, it is a standard distribution method for the vendor, checksums are provided and match, and the content is a self-contained Electron app without obfuscated payloads or remote code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt tarball from a non-whitelisted but plausibly official Aliyun CDN host; however, it is a standard distribution method for the vendor, checksums are provided and match, and the content is a self-contained Electron app without obfuscated payloads or remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:50
"${_source_archive}::https://file-assets-cdn.oss-cn-hangzhou.aliyuncs.com/download/Apifox-linux-manual-latest.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: duanluan <duanluan@outlook.com>
2
3
pkgname=apifox
4
pkgver=2.8.53
5
pkgrel=1
6
pkgdesc='API documentation, debugging, mocking, and automated testing tool'
7
arch=('x86_64')
8
url='https://apifox.com/'
9
license=('LicenseRef-Proprietary')
10
depends=(
11
'alsa-lib'
12
'at-spi2-core'
13
'cairo'
14
'dbus'
15
'expat'
16
'gcc-libs'
17
'glib2'
18
'glibc'
19
'gtk3'
20
'hicolor-icon-theme'
21
'libcups'
22
'libnotify'
23
'libsecret'
24
'libx11'
25
'libxcb'
26
'libxcomposite'
27
'libxdamage'
28
'libxext'
29
'libxfixes'
30
'libxkbcommon'
31
'libxrandr'
32
'libxss'
33
'libxtst'
34
'mesa'
35
'nspr'
36
'nss'
37
'pango'
38
'systemd-libs'
39
'util-linux-libs'
40
'xdg-utils'
41
)
42
optdepends=(
43
'java-runtime: run the bundled Java database executors'
44
'libappindicator-gtk3: system tray icon support'
45
)
46
conflicts=('api-fox-bin' 'apifox-bin' 'apifox-appimage')
47
options=('!strip' '!lto')
48
_source_archive="Apifox-linux-manual-${pkgver}.tar.gz"
49
source=(
50
"${_source_archive}::https://file-assets-cdn.oss-cn-hangzhou.aliyuncs.com/download/Apifox-linux-manual-latest.tar.gz"
51
'apifox.desktop'
52
'apifox.png'
53
)
54
sha256sums=(
55
'35bf90ad81d8d3c9e918ea5431499829a1ac2fb1b67d02f9a98b2e4da0f7a400'
56
'4478f9ad5f70828608bde15a50fe700a6b8ff83d632dd065bac4bcbd3eedbe9e'
57
'b3d3b84f5a5f35ef8a85b0db3ddcb239fb982ee8a6d53a5fb81ed296021fb44a'
58
)
59
60
package() {
61
local upstream_dir="${srcdir}/apifox-${pkgver}"
62
local install_root="${pkgdir}/opt/Apifox"
63
64
for required_path in \
65
"${upstream_dir}/apifox" \
66
"${upstream_dir}/chrome-sandbox" \
67
"${upstream_dir}/resources/app.asar" \
68
"${upstream_dir}/resources/app.asar.unpacked/package.json" \
69
"${upstream_dir}/LICENSE.electron.txt" \
70
"${upstream_dir}/LICENSES.chromium.html"; do
71
[[ -e "${required_path}" ]] || {
72
printf 'missing required upstream path: %s\n' "${required_path}" >&2
73
return 1
74
}
75
done
76
77
install -dm755 "${install_root}"
78
cp -a "${upstream_dir}/." "${install_root}/"
79
80
install -dm755 "${pkgdir}/usr/bin"
81
ln -s "/opt/Apifox/apifox" "${pkgdir}/usr/bin/apifox"
82
83
# Electron's sandbox helper must retain its setuid bit for sandboxed renderers.
84
chmod 4755 "${install_root}/chrome-sandbox"
85
86
install -Dm644 "${srcdir}/apifox.desktop" \
87
"${pkgdir}/usr/share/applications/apifox.desktop"
88
# Official app logo (upstream app.asar.unpacked/dist/assets/logo.png,
89
# resized to 512x512). Installed into 512x512 because hicolor's index.theme
90
# declares no 1024x1024 directory, so icons placed there are never found.
91
install -Dm644 "${srcdir}/apifox.png" \
92
"${pkgdir}/usr/share/icons/hicolor/512x512/apps/apifox.png"
93
94
install -Dm644 "${upstream_dir}/LICENSE.electron.txt" \
95
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
96
install -Dm644 "${upstream_dir}/LICENSES.chromium.html" \
97
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
98
}
99
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: duanluan <duanluan@outlook.com> pkgname=apifox-pkgver=2.8.52+pkgver=2.8.53 pkgrel=1 pkgdesc='API documentation, debugging, mocking, and automated testing tool' arch=('x86_64')@@ -52,7 +52,7 @@ 'apifox.png' ) sha256sums=(- '7d6a5911707b5a9341b46560700dbcf397f64e8f4c6c43e8efc650722458f97c'+ '35bf90ad81d8d3c9e918ea5431499829a1ac2fb1b67d02f9a98b2e4da0f7a400' '4478f9ad5f70828608bde15a50fe700a6b8ff83d632dd065bac4bcbd3eedbe9e' 'b3d3b84f5a5f35ef8a85b0db3ddcb239fb982ee8a6d53a5fb81ed296021fb44a' )Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 07:52:02 | Medium | 1 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 05:39:24 | Medium | 1 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 05:17:05 | Medium | 1 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |