lzc-client-desktop-bin

LOW
maintainer washan 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a prebuilt Electron app from the project's own domain (dl.lazycat.cloud), which is not on standard whitelists but plausibly official; the binary is not obfuscated or executed remotely, and the build process only installs and configures it locally with appropriate hardening steps.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Electron app from the project's own domain (dl.lazycat.cloud), which is not on standard whitelists but plausibly official; the binary is not obfuscated or executed remotely, and the build process only installs and configures it locally with appropriate hardening steps.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:36 source=("lzc-client-desktop_${pkgver}.tar.zst::https://dl.lazycat.cloud/client/desktop/stable/lzc-client-desktop_v${pkgver}.tar.zst"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Your Name <your.email@example.com>
2pkgname=lzc-client-desktop-bin
3pkgver=2.0.11
4pkgrel=1
5pkgdesc='懒猫微服客户端 Lazy Cat microservice desktop client'
6arch=('x86_64')
7url='https://lazycat.cloud/'
8license=('custom')
9depends=(
10 'zenity'
11 'libcap'
12 'glib2'
13 'nspr'
14 'nss'
15 'dbus'
16 'at-spi2-core'
17 'libcups'
18 'cairo'
19 'gtk3'
20 'pango'
21 'libx11'
22 'libxcomposite'
23 'libxdamage'
24 'libxext'
25 'libxfixes'
26 'libxrandr'
27 'mesa'
28 'expat'
29 'libxcb'
30 'libxkbcommon'
31 'systemd-libs'
32 'alsa-lib'
33)
34makedepends=('zstd')
35install="${pkgname}.install"
36source=("lzc-client-desktop_${pkgver}.tar.zst::https://dl.lazycat.cloud/client/desktop/stable/lzc-client-desktop_v${pkgver}.tar.zst"
37 "image.png")
38sha256sums=('1059d5aa4296af42fcc68be8115185010fd58f69eec297c39fd7f74b793a9c17'
39 'cf462ea972a91a51d277d8bb8fd20647a10f8b9de2ac558b3a5cb3fc238711f4')
40
41# Disable compression for faster testing during development
42# Remove this line before publishing to AUR
43PKGEXT='.pkg.tar'
44
45package() {
46 cd "$srcdir"
47
48 # Files extract directly to srcdir, not in a subdirectory
49 _appdir="."
50
51 # 1. Install application files to /usr/lib/lzc-client-desktop
52 msg "Installing application files..."
53 install -dm755 "$pkgdir/usr/lib/lzc-client-desktop"
54
55 # Copy all application files (adjust based on actual structure)
56 cp -a "$_appdir"/* "$pkgdir/usr/lib/lzc-client-desktop/" 2>/dev/null || true
57
58 # Ensure binary is executable
59 if [ -f "$pkgdir/usr/lib/lzc-client-desktop/lzc-client-desktop" ]; then
60 chmod +x "$pkgdir/usr/lib/lzc-client-desktop/lzc-client-desktop"
61 fi
62
63 # Set chrome-sandbox permissions (required for Electron apps)
64 if [ -f "$pkgdir/usr/lib/lzc-client-desktop/chrome-sandbox" ]; then
65 chmod 4755 "$pkgdir/usr/lib/lzc-client-desktop/chrome-sandbox"
66 fi
67
68 # 2. Create wrapper script in /usr/bin
69 msg "Creating wrapper script..."
70 install -Dm755 /dev/stdin "$pkgdir/usr/bin/lzc-client-desktop" <<'EOF'
71#!/bin/bash
72# Wrapper script for lzc-client-desktop
73exec /usr/lib/lzc-client-desktop/lzc-client-desktop "$@"
74EOF
75
76 # 3. Install desktop file with corrected paths
77 msg "Installing desktop file..."
78 if [ -f "$_appdir/lzc-client.desktop" ]; then
79 install -Dm644 "$_appdir/lzc-client.desktop" \
80 "$pkgdir/usr/share/applications/lzc-client-desktop.desktop"
81
82 # Patch Exec and Icon paths
83 sed -i \
84 -e 's|^Exec=.*|Exec=/usr/bin/lzc-client-desktop|g' \
85 -e 's|^Icon=.*|Icon=lzc-client-desktop|g' \
86 -e 's|HOMEDIR|/usr/lib/lzc-client-desktop|g' \
87 "$pkgdir/usr/share/applications/lzc-client-desktop.desktop"
88 fi
89
90 # 4. Install icon
91 msg "Installing icon..."
92 install -Dm644 "$srcdir/image.png" \
93 "$pkgdir/usr/share/pixmaps/lzc-client-desktop.png"
94
95 # 5. Install polkit policy if present
96 msg "Installing polkit policy..."
97 if [ -f "$_appdir/cloud.lazycat.client.policy" ]; then
98 install -Dm644 "$_appdir/cloud.lazycat.client.policy" \
99 "$pkgdir/usr/share/polkit-1/actions/cloud.lazycat.client.policy"
100
101 # Patch script paths in polkit policy to use system paths
102 sed -i \
103 -e 's|HOMEDIR|/usr/lib/lzc-client-desktop|g' \
104 -e "s|/home/[^/]*/[^<]*|/usr/lib/lzc-client-desktop/lzc-client-desktop|g" \
105 "$pkgdir/usr/share/polkit-1/actions/cloud.lazycat.client.policy"
106 fi
107
108 # 6. Handle capabilities
109 # Note: Capabilities will be set during post_install via the .install script
110 # This is the recommended approach for AUR packages
111
112 # 7. Install license if present
113 msg "Installing license..."
114 for license_file in \
115 "$_appdir/LICENSE" \
116 "$_appdir/LICENSE.txt" \
117 "$_appdir/COPYING"
118 do
119 if [ -f "$license_file" ]; then
120 install -Dm644 "$license_file" \
121 "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
122 break
123 fi
124 done
125
126 # Create a placeholder license file if none found
127 if [ ! -f "$pkgdir/usr/share/licenses/$pkgname/LICENSE" ]; then
128 install -Dm644 /dev/stdin "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<EOF
129Proprietary software from Lazy Cat (lazycat.cloud)
130License terms available at: https://lazycat.cloud/
131EOF
132 fi
133
134 # 8. Remove any bundled setcap scripts to prevent self-modification
135 rm -f "$pkgdir/usr/lib/lzc-client-desktop/set-capabilities.sh"
136
137 # 9. Clean up unnecessary files from /usr/lib
138 rm -f "$pkgdir/usr/lib/lzc-client-desktop"/*.desktop
139 rm -f "$pkgdir/usr/lib/lzc-client-desktop"/*.policy
140 rm -f "$pkgdir/usr/lib/lzc-client-desktop"/*.png
141}
142

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion