claude-code

maintainer cg505 · 87 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from the official project domain (downloads.claude.ai), which is a legitimate source; the binary is checksum-verified, and the only non-whitelisted host is used for a non-executable legal document, posing minimal risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official project domain (downloads.claude.ai), which is a legitimate source; the binary is checksum-verified, and the only non-whitelisted host is used for a non-executable legal document, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("cc-legal::https://code.claude.com/docs/en/legal-and-compliance.md")
PKGBUILD:28 source_x86_64=("claude-${pkgver}-x86_64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-x64/claude")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Christopher Cooper <christopher@cg505.com>
    
      2# Maintainer: Jérôme Poulin <jeromepoulin@gmail.com>
    
      3# Maintainer: Fabio Fontana (fabifont) <me@fabifont.dev>
    
      4# Automation repository: https://github.com/fabifont/claude-code-aur
    
      5
    
      6pkgname=claude-code
    
      7pkgver=2.1.219
    
      8pkgrel=1
    
      9pkgdesc="An agentic coding tool that lives in your terminal"
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://github.com/anthropics/claude-code"
    
      12license=('LicenseRef-claude-code')
    
      13depends=('bash')
    
      14# Binary is a self-contained Bun executable with embedded JS/resources - stripping breaks it
    
      15options=('!strip')
    
      16
    
      17optdepends=(
    
      18	'git: allow Claude to use git'
    
      19	'github-cli: interact with GitHub'
    
      20	'glab: interact with GitLab'
    
      21	'ripgrep: enhanced file search'
    
      22	'tmux: agent team split panes'
    
      23	'bubblewrap: sandboxing'
    
      24	'socat: sandboxing'
    
      25)
    
      26
    
      27source=("cc-legal::https://code.claude.com/docs/en/legal-and-compliance.md")
    
      28source_x86_64=("claude-${pkgver}-x86_64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-x64/claude")
    
      29source_aarch64=("claude-${pkgver}-aarch64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-arm64/claude")
    
      30
    
      31sha256sums=('SKIP')
    
      32sha256sums_x86_64=('22cfd6f5b3061c0391ba84e9cf8c9deaa37783aac18b004d42ec061e98f00691')
    
      33sha256sums_aarch64=('1f834b322ba9d1291cc7ffeff16a6795a59145bda279dbd59cd7ecebc7b7f15a')
    
      34
    
      35package() {
    
      36	install -Dm755 "${srcdir}/claude-${pkgver}-${CARCH}" "${pkgdir}/opt/claude-code/bin/claude"
    
      37
    
      38	# Create wrapper script to disable upstream update paths, and to suppress the
    
      39	# native-install health check. Claude Code expects the native installer layout
    
      40	# (~/.local/bin/claude); since we install to /opt + /usr/bin it would otherwise
    
      41	# warn on every startup: "claude command at ~/.local/bin/claude missing or broken".
    
      42	install -dm755 "${pkgdir}/usr/bin"
    
      43	cat > "${pkgdir}/usr/bin/claude" << 'EOF'
    
      44#!/bin/sh
    
      45export DISABLE_UPDATES=1
    
      46export DISABLE_INSTALLATION_CHECKS=1
    
      47exec /opt/claude-code/bin/claude "$@"
    
      48EOF
    
      49	chmod 755 "${pkgdir}/usr/bin/claude"
    
      50
    
      51	install -Dm644 "${srcdir}/cc-legal" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      52}
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-07-26 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,7 +4,7 @@
 # Automation repository: https://github.com/fabifont/claude-code-aur
 
 pkgname=claude-code
-pkgver=2.1.218
+pkgver=2.1.219
 pkgrel=1
 pkgdesc="An agentic coding tool that lives in your terminal"
 arch=('x86_64' 'aarch64')
@@ -29,8 +29,8 @@
 source_aarch64=("claude-${pkgver}-aarch64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-arm64/claude")
 
 sha256sums=('SKIP')
-sha256sums_x86_64=('e12071751a9336b8af1012c103358ff04ac18f9aaff4a738cff7ba5cdfaf63f2')
-sha256sums_aarch64=('295fd30481bd03b38450fdec2a6e25bb6472c2074f04b0c4a566cd5988f230bf')
+sha256sums_x86_64=('22cfd6f5b3061c0391ba84e9cf8c9deaa37783aac18b004d42ec061e98f00691')
+sha256sums_aarch64=('1f834b322ba9d1291cc7ffeff16a6795a59145bda279dbd59cd7ecebc7b7f15a')
 
 package() {
 	install -Dm755 "${srcdir}/claude-${pkgver}-${CARCH}" "${pkgdir}/opt/claude-code/bin/claude"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 17:32:42	MEDIUM	1
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 17:28:09	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 23:22:13	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 23:18:24	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 23:15:21	MEDIUM	1
2026-07-20 00:19:49	LOW	2