lzc-client-desktop-bin

maintainer washan · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt Electron app from the project's own domain (dl.lazycat.cloud), which is not on standard whitelists but plausibly official; the binary is not obfuscated or executed remotely, and the build process only installs and configures it locally with appropriate hardening steps.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Electron app from the project's own domain (dl.lazycat.cloud), which is not on standard whitelists but plausibly official; the binary is not obfuscated or executed remotely, and the build process only installs and configures it locally with appropriate hardening steps.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 source=("lzc-client-desktop_${pkgver}.tar.zst::https://dl.lazycat.cloud/client/desktop/stable/lzc-client-desktop_v${pkgver}.tar.zst"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Your Name <your.email@example.com>
    
      2pkgname=lzc-client-desktop-bin
    
      3pkgver=2.0.11
    
      4pkgrel=1
    
      5pkgdesc='懒猫微服客户端 Lazy Cat microservice desktop client'
    
      6arch=('x86_64')
    
      7url='https://lazycat.cloud/'
    
      8license=('custom')
    
      9depends=(
    
      10  'zenity'
    
      11  'libcap'
    
      12  'glib2'
    
      13  'nspr'
    
      14  'nss'
    
      15  'dbus'
    
      16  'at-spi2-core'
    
      17  'libcups'
    
      18  'cairo'
    
      19  'gtk3'
    
      20  'pango'
    
      21  'libx11'
    
      22  'libxcomposite'
    
      23  'libxdamage'
    
      24  'libxext'
    
      25  'libxfixes'
    
      26  'libxrandr'
    
      27  'mesa'
    
      28  'expat'
    
      29  'libxcb'
    
      30  'libxkbcommon'
    
      31  'systemd-libs'
    
      32  'alsa-lib'
    
      33)
    
      34makedepends=('zstd')
    
      35install="${pkgname}.install"
    
      36source=("lzc-client-desktop_${pkgver}.tar.zst::https://dl.lazycat.cloud/client/desktop/stable/lzc-client-desktop_v${pkgver}.tar.zst"
    
      37        "image.png")
    
      38sha256sums=('1059d5aa4296af42fcc68be8115185010fd58f69eec297c39fd7f74b793a9c17'
    
      39            'cf462ea972a91a51d277d8bb8fd20647a10f8b9de2ac558b3a5cb3fc238711f4')
    
      40
    
      41# Disable compression for faster testing during development
    
      42# Remove this line before publishing to AUR
    
      43PKGEXT='.pkg.tar'
    
      44
    
      45package() {
    
      46  cd "$srcdir"
    
      47
    
      48  # Files extract directly to srcdir, not in a subdirectory
    
      49  _appdir="."
    
      50
    
      51  # 1. Install application files to /usr/lib/lzc-client-desktop
    
      52  msg "Installing application files..."
    
      53  install -dm755 "$pkgdir/usr/lib/lzc-client-desktop"
    
      54
    
      55  # Copy all application files (adjust based on actual structure)
    
      56  cp -a "$_appdir"/* "$pkgdir/usr/lib/lzc-client-desktop/" 2>/dev/null || true
    
      57
    
      58  # Ensure binary is executable
    
      59  if [ -f "$pkgdir/usr/lib/lzc-client-desktop/lzc-client-desktop" ]; then
    
      60    chmod +x "$pkgdir/usr/lib/lzc-client-desktop/lzc-client-desktop"
    
      61  fi
    
      62
    
      63  # Set chrome-sandbox permissions (required for Electron apps)
    
      64  if [ -f "$pkgdir/usr/lib/lzc-client-desktop/chrome-sandbox" ]; then
    
      65    chmod 4755 "$pkgdir/usr/lib/lzc-client-desktop/chrome-sandbox"
    
      66  fi
    
      67
    
      68  # 2. Create wrapper script in /usr/bin
    
      69  msg "Creating wrapper script..."
    
      70  install -Dm755 /dev/stdin "$pkgdir/usr/bin/lzc-client-desktop" <<'EOF'
    
      71#!/bin/bash
    
      72# Wrapper script for lzc-client-desktop
    
      73exec /usr/lib/lzc-client-desktop/lzc-client-desktop "$@"
    
      74EOF
    
      75
    
      76  # 3. Install desktop file with corrected paths
    
      77  msg "Installing desktop file..."
    
      78  if [ -f "$_appdir/lzc-client.desktop" ]; then
    
      79    install -Dm644 "$_appdir/lzc-client.desktop" \
    
      80      "$pkgdir/usr/share/applications/lzc-client-desktop.desktop"
    
      81
    
      82    # Patch Exec and Icon paths
    
      83    sed -i \
    
      84      -e 's|^Exec=.*|Exec=/usr/bin/lzc-client-desktop|g' \
    
      85      -e 's|^Icon=.*|Icon=lzc-client-desktop|g' \
    
      86      -e 's|HOMEDIR|/usr/lib/lzc-client-desktop|g' \
    
      87      "$pkgdir/usr/share/applications/lzc-client-desktop.desktop"
    
      88  fi
    
      89
    
      90  # 4. Install icon
    
      91  msg "Installing icon..."
    
      92  install -Dm644 "$srcdir/image.png" \
    
      93    "$pkgdir/usr/share/pixmaps/lzc-client-desktop.png"
    
      94
    
      95  # 5. Install polkit policy if present
    
      96  msg "Installing polkit policy..."
    
      97  if [ -f "$_appdir/cloud.lazycat.client.policy" ]; then
    
      98    install -Dm644 "$_appdir/cloud.lazycat.client.policy" \
    
      99      "$pkgdir/usr/share/polkit-1/actions/cloud.lazycat.client.policy"
    
      100
    
      101    # Patch script paths in polkit policy to use system paths
    
      102    sed -i \
    
      103      -e 's|HOMEDIR|/usr/lib/lzc-client-desktop|g' \
    
      104      -e "s|/home/[^/]*/[^<]*|/usr/lib/lzc-client-desktop/lzc-client-desktop|g" \
    
      105      "$pkgdir/usr/share/polkit-1/actions/cloud.lazycat.client.policy"
    
      106  fi
    
      107
    
      108  # 6. Handle capabilities
    
      109  # Note: Capabilities will be set during post_install via the .install script
    
      110  # This is the recommended approach for AUR packages
    
      111
    
      112  # 7. Install license if present
    
      113  msg "Installing license..."
    
      114  for license_file in \
    
      115    "$_appdir/LICENSE" \
    
      116    "$_appdir/LICENSE.txt" \
    
      117    "$_appdir/COPYING"
    
      118  do
    
      119    if [ -f "$license_file" ]; then
    
      120      install -Dm644 "$license_file" \
    
      121        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      122      break
    
      123    fi
    
      124  done
    
      125
    
      126  # Create a placeholder license file if none found
    
      127  if [ ! -f "$pkgdir/usr/share/licenses/$pkgname/LICENSE" ]; then
    
      128    install -Dm644 /dev/stdin "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<EOF
    
      129Proprietary software from Lazy Cat (lazycat.cloud)
    
      130License terms available at: https://lazycat.cloud/
    
      131EOF
    
      132  fi
    
      133
    
      134  # 8. Remove any bundled setcap scripts to prevent self-modification
    
      135  rm -f "$pkgdir/usr/lib/lzc-client-desktop/set-capabilities.sh"
    
      136
    
      137  # 9. Clean up unnecessary files from /usr/lib
    
      138  rm -f "$pkgdir/usr/lib/lzc-client-desktop"/*.desktop
    
      139  rm -f "$pkgdir/usr/lib/lzc-client-desktop"/*.policy
    
      140  rm -f "$pkgdir/usr/lib/lzc-client-desktop"/*.png
    
      141}
    
      142

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2