claude-code
LOW
maintainer cg505
99 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt binary from the official vendor domain (downloads.claude.ai), which is plausibly the project's own release infrastructure, and installs it with a wrapper script to disable update checks; the non-whitelisted host is the vendor's own domain, and the binary is checksum-verified, making this a standard AUR package for a closed-source tool.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official vendor domain (downloads.claude.ai), which is plausibly the project's own release infrastructure, and installs it with a wrapper script to disable update checks; the non-whitelisted host is the vendor's own domain, and the binary is checksum-verified, making this a standard AUR package for a closed-source tool.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
source=("cc-legal::https://code.claude.com/docs/en/legal-and-compliance.md") -
PKGBUILD:28
source_x86_64=("claude-${pkgver}-x86_64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-x64/claude")
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Christopher Cooper <christopher@cg505.com>
2
# Maintainer: Jérôme Poulin <jeromepoulin@gmail.com>
3
# Maintainer: Fabio Fontana (fabifont) <me@fabifont.dev>
4
# Automation repository: https://github.com/fabifont/claude-code-aur
5
6
pkgname=claude-code
7
pkgver=2.1.316
8
pkgrel=1
9
pkgdesc="An agentic coding tool that lives in your terminal"
10
arch=('x86_64' 'aarch64')
11
url="https://github.com/anthropics/claude-code"
12
license=('LicenseRef-claude-code')
13
depends=('bash')
14
# Binary is a self-contained Bun executable with embedded JS/resources - stripping breaks it
15
options=('!strip')
16
17
optdepends=(
18
'git: allow Claude to use git'
19
'github-cli: interact with GitHub'
20
'glab: interact with GitLab'
21
'ripgrep: enhanced file search'
22
'tmux: agent team split panes'
23
'bubblewrap: sandboxing'
24
'socat: sandboxing'
25
)
26
27
source=("cc-legal::https://code.claude.com/docs/en/legal-and-compliance.md")
28
source_x86_64=("claude-${pkgver}-x86_64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-x64/claude")
29
source_aarch64=("claude-${pkgver}-aarch64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-arm64/claude")
30
31
sha256sums=('SKIP')
32
sha256sums_x86_64=('fd13c70000fec3f2116dfbcbb6121210b4a29328bf0e46210a59dd594a67d824')
33
sha256sums_aarch64=('55cdb8e162d190432696ea54010e0fca2e18d06fa7a7127fd563b9ffd4f22624')
34
35
package() {
36
install -Dm755 "${srcdir}/claude-${pkgver}-${CARCH}" "${pkgdir}/opt/claude-code/bin/claude"
37
38
# Create wrapper script to disable upstream update paths, and to suppress the
39
# native-install health check. Claude Code expects the native installer layout
40
# (~/.local/bin/claude); since we install to /opt + /usr/bin it would otherwise
41
# warn on every startup: "claude command at ~/.local/bin/claude missing or broken".
42
install -dm755 "${pkgdir}/usr/bin"
43
cat > "${pkgdir}/usr/bin/claude" << 'EOF'
44
#!/bin/sh
45
export DISABLE_UPDATES=1
46
export DISABLE_INSTALLATION_CHECKS=1
47
exec /opt/claude-code/bin/claude "$@"
48
EOF
49
chmod 755 "${pkgdir}/usr/bin/claude"
50
51
install -Dm644 "${srcdir}/cc-legal" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
52
}
53
Changes since previous scan
--- PKGBUILD @ 2026-10-31 00:07+++ PKGBUILD @ 2026-11-01 00:21@@ -4,7 +4,7 @@ # Automation repository: https://github.com/fabifont/claude-code-aur pkgname=claude-code-pkgver=2.1.314+pkgver=2.1.316 pkgrel=1 pkgdesc="An agentic coding tool that lives in your terminal" arch=('x86_64' 'aarch64')@@ -29,8 +29,8 @@ source_aarch64=("claude-${pkgver}-aarch64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-arm64/claude") sha256sums=('SKIP')-sha256sums_x86_64=('4487042b4c4f5d88d4568f68ae98aae0b1ffae58864cf57fb868641bc5f84594')-sha256sums_aarch64=('a66c0a8f5d0c87a439953d797985192bbcbaefbce2e0d7b2eaa8df30ef0f3ef2')+sha256sums_x86_64=('fd13c70000fec3f2116dfbcbb6121210b4a29328bf0e46210a59dd594a67d824')+sha256sums_aarch64=('55cdb8e162d190432696ea54010e0fca2e18d06fa7a7127fd563b9ffd4f22624') package() { install -Dm755 "${srcdir}/claude-${pkgver}-${CARCH}" "${pkgdir}/opt/claude-code/bin/claude"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 07:58:04 | Medium | 1 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 01:55:02 | Medium | 1 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 21:48:49 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 23:46:04 | Medium | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 01:38:37 | Medium | 1 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 23:36:19 | Medium | 1 |
| 2026-10-22 05:34:05 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 23:33:14 | Medium | 1 |
| 2026-10-21 03:30:06 | Medium | 1 |