lzc-client-bin

LOW

maintainer czyt 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Prebuilt proprietary Electron binary downloaded from the project's own official domain (dl.lazycat.cloud), with a sha256 checksum provided; the main concern is trusting a closed-source binary, not a supply-chain substitution risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Prebuilt proprietary Electron binary downloaded from the project's own official domain (dl.lazycat.cloud), with a sha256 checksum provided; the main concern is trusting a closed-source binary, not a supply-chain substitution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 source_x86_64=("lzc-client-desktop_${pkgver}_x86_64.tar.zst::https://dl.lazycat.cloud/client/desktop/stable/lzc-client-desktop_v${pkgver}.tar.zst")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:czyt <czytcn@gmail.com>
    
      2# Upstream only ships x86_64. To add aarch64 later:
    
      3#   1. add source_aarch64 / sha256sums_aarch64 with a distinct local filename
    
      4#   2. add 'aarch64' to arch=()
    
      5#   3. extend the CARCH switch in package() below
    
      6pkgname=lzc-client-bin
    
      7pkgver=2.0.30
    
      8pkgrel=5
    
      9pkgdesc='懒猫微服桌面客户端（LCMD），扫码登录后管理微服应用、文件与远程访问'
    
      10arch=('x86_64')
    
      11url='https://lazycat.cloud/'
    
      12license=('custom')
    
      13install="${pkgname}.install"
    
      14provides=('lzc-client-desktop' 'lazycat-client')
    
      15conflicts=('lzc-client-desktop' 'lazycat-client' 'lzc-client-desktop-bin')
    
      16options=('!strip' '!debug')
    
      17depends=(
    
      18  'zenity'
    
      19  'libcap'
    
      20  'glib2'
    
      21  'nspr'
    
      22  'nss'
    
      23  'dbus'
    
      24  'at-spi2-core'
    
      25  'libcups'
    
      26  'cairo'
    
      27  'gtk3'
    
      28  'pango'
    
      29  'libx11'
    
      30  'libxcomposite'
    
      31  'libxdamage'
    
      32  'libxext'
    
      33  'libxfixes'
    
      34  'libxrandr'
    
      35  'mesa'
    
      36  'expat'
    
      37  'libxcb'
    
      38  'libxkbcommon'
    
      39  'systemd-libs'
    
      40  'alsa-lib'
    
      41)
    
      42makedepends=('zstd')
    
      43source_x86_64=("lzc-client-desktop_${pkgver}_x86_64.tar.zst::https://dl.lazycat.cloud/client/desktop/stable/lzc-client-desktop_v${pkgver}.tar.zst")
    
      44sha256sums_x86_64=('4a1a14bd73c41fd59250ef9d77da5dfcad7735019c6a8bfee851ba4090890d00')
    
      45
    
      46package() {
    
      47    cd "${srcdir}"
    
      48
    
      49    # Archive contents extract directly to srcdir (no top-level directory)
    
      50    install -dm755 "${pkgdir}/usr/lib/lzc-client-desktop"
    
      51    cp -a ./* "${pkgdir}/usr/lib/lzc-client-desktop/"
    
      52
    
      53    # Wrapper in PATH
    
      54    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/lzc-client-desktop" <<'EOF'
    
      55#!/bin/bash
    
      56exec /usr/lib/lzc-client-desktop/lzc-client-desktop "$@"
    
      57EOF
    
      58
    
      59    # Desktop file: patch per-user paths to system locations
    
      60    install -Dm644 "${pkgdir}/usr/lib/lzc-client-desktop/lzc-client.desktop" \
    
      61        "${pkgdir}/usr/share/applications/lzc-client-desktop.desktop"
    
      62    sed -i \
    
      63        -e 's|^Exec=.*|Exec=/usr/bin/lzc-client-desktop %u|g' \
    
      64        -e 's|^Icon=.*|Icon=lzc-client-desktop|g' \
    
      65        "${pkgdir}/usr/share/applications/lzc-client-desktop.desktop"
    
      66
    
      67    # Icon
    
      68    install -Dm644 "${pkgdir}/usr/lib/lzc-client-desktop/icon.png" \
    
      69        "${pkgdir}/usr/share/pixmaps/lzc-client-desktop.png"
    
      70
    
      71    # polkit policy: point at the packaged setcap helper
    
      72    sed -i 's|__SETCAP_SCRIPT_PATH__|/usr/lib/lzc-client-desktop/core/linux_setcap.sh|g' \
    
      73        "${pkgdir}/usr/lib/lzc-client-desktop/cloud.lazycat.client.policy"
    
      74    install -Dm644 "${pkgdir}/usr/lib/lzc-client-desktop/cloud.lazycat.client.policy" \
    
      75        "${pkgdir}/usr/share/polkit-1/actions/cloud.lazycat.client.policy"
    
      76
    
      77    # License
    
      78    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
    
      79Proprietary software from Lazy Cat (lazycat.cloud)
    
      80License terms available at: https://lazycat.cloud/
    
      81EOF
    
      82
    
      83    # Remove files installed to their proper system locations
    
      84    rm -f "${pkgdir}/usr/lib/lzc-client-desktop/lzc-client.desktop" \
    
      85          "${pkgdir}/usr/lib/lzc-client-desktop/cloud.lazycat.client.policy"
    
      86
    
      87    # chrome-sandbox needs setuid for Electron
    
      88    chmod 4755 "${pkgdir}/usr/lib/lzc-client-desktop/chrome-sandbox"
    
      89
    
      90    # Prevent the app from self-modifying capabilities via pacman-owned files
    
      91    rm -f "${pkgdir}/usr/lib/lzc-client-desktop/set-capabilities.sh"
    
      92}
    
      93

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 03:15:40	Low	3
2026-10-16 03:14:05	Medium	2