visual-studio-code-bin
LOW
maintainer dcelasun
1702 votes
scanned 2026-08-19 13:41:59.633391
Why flagged
The package downloads official Visual Studio Code .deb binaries from Microsoft's own update domain (update.code.visualstudio.com), which is the project's legitimate release infrastructure; despite the static analyzer flag for a non-whitelisted host, this is a standard and trusted source for the software, and the binaries are verified via provided sha256 checksums.
Triggered rules
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads official Visual Studio Code .deb binaries from Microsoft's own update domain (update.code.visualstudio.com), which is the project's legitimate release infrastructure; despite the static analyzer flag for a non-whitelisted host, this is a standard and trusted source for the software, and the binaries are verified via provided sha256 checksums.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
source_x86_64=(code_${pkgver}_amd64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-x64/stable)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: D. Can Celasun <can[at]dcc[dot]im>
2
3
pkgname=visual-studio-code-bin
4
_pkgname=visual-studio-code
5
pkgver=1.134.0
6
pkgrel=1
7
pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
8
arch=('x86_64' 'aarch64' 'armv7h')
9
url="https://code.visualstudio.com/"
10
license=('custom: commercial')
11
provides=('code' 'vscode')
12
conflicts=('code')
13
# Upstream has signature verification for extensions and stripping breaks it
14
# See https://github.com/microsoft/vscode/issues/223455#issuecomment-2610001754
15
options=(!strip)
16
install=$pkgname.install
17
# lsof: needed for terminal splitting, see https://github.com/Microsoft/vscode/issues/62991
18
# xdg-utils: needed for opening web links with xdg-open
19
depends=(libxkbfile gnupg gtk3 libsecret nss gcc-libs libnotify libxss glibc lsof shared-mime-info xdg-utils alsa-lib)
20
optdepends=('glib2: Needed for move to trash functionality'
21
'libdbusmenu-glib: Needed for KDE global menu'
22
'org.freedesktop.secrets: Needed for settings sync'
23
# See https://github.com/MicrosoftDocs/live-share/issues/4650
24
'icu69: Needed for live share' )
25
source=(${_pkgname}-bin.sh)
26
source_x86_64=(code_${pkgver}_amd64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-x64/stable)
27
source_aarch64=(code_${pkgver}_arm64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-arm64/stable)
28
source_armv7h=(code_${pkgver}_armhf.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-armhf/stable)
29
sha256sums=('bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad')
30
sha256sums_x86_64=('dcd3a2f52d53df079cd389662ff1fdbeb629938331d3a63655fed929f8d49f19')
31
sha256sums_aarch64=('b30f5bda4855231681cc7fe22d4a59e7dbee2be170b0e4fb04c7e83b9f9affe5')
32
sha256sums_armv7h=('01460717d4f4c7b3109cc06b8df5ba579e98ea373751cc0ed4ae7928f26fad89')
33
34
package() {
35
bsdtar -xf data.tar.xz -C "${pkgdir}/"
36
37
install -d "${pkgdir}/usr/bin"
38
install -d "${pkgdir}/usr/share/licenses/${pkgname}"
39
40
ln -s /usr/share/code/resources/app/LICENSE.rtf \
41
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.rtf"
42
43
# Launcher
44
install -m755 "${srcdir}/${_pkgname}-bin.sh" "${pkgdir}/usr/bin/code"
45
46
# Fix the desktop entries
47
sed -i \
48
-e 's/^\(Exec=\)[^ ]*/\1code/g' \
49
"${pkgdir}"/usr/share/applications/*.desktop
50
51
# setuid on chrome-sandbox
52
# Comment out if using a kernel without user namespaces, like linux-hardened
53
chmod u-s "${pkgdir}/usr/share/code/chrome-sandbox"
54
}
55
Changes since previous scan
--- PKGBUILD @ 2026-08-13 00:17+++ PKGBUILD @ 2026-08-19 13:41@@ -2,7 +2,7 @@ pkgname=visual-studio-code-bin _pkgname=visual-studio-code-pkgver=1.133.0+pkgver=1.134.0 pkgrel=1 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications (official binary version)" arch=('x86_64' 'aarch64' 'armv7h')@@ -27,9 +27,9 @@ source_aarch64=(code_${pkgver}_arm64.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-arm64/stable) source_armv7h=(code_${pkgver}_armhf.deb::https://update.code.visualstudio.com/${pkgver}/linux-deb-armhf/stable) sha256sums=('bd0d9edf69283ebdf4e73e0a7b168d2fcf50acbd01f63674cad93ed4fe42fdad')-sha256sums_x86_64=('d064e87e22f556b8a91e1354b5227e340597324e52886dbb288551596b00e34a')-sha256sums_aarch64=('b20bfb21c5b3656e3411391c5c18df1782aedd7cd3bda0b9c08363ea261fca4b')-sha256sums_armv7h=('f68acc6874f59d829779d82e259cfb339ca168b5707f406cfc262353e5d34e45')+sha256sums_x86_64=('dcd3a2f52d53df079cd389662ff1fdbeb629938331d3a63655fed929f8d49f19')+sha256sums_aarch64=('b30f5bda4855231681cc7fe22d4a59e7dbee2be170b0e4fb04c7e83b9f9affe5')+sha256sums_armv7h=('01460717d4f4c7b3109cc06b8df5ba579e98ea373751cc0ed4ae7928f26fad89') package() { bsdtar -xf data.tar.xz -C "${pkgdir}/"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-19 13:41:59 | Low | 2 |
| 2026-08-13 00:17:07 | Clean | 2 |
| 2026-08-12 11:23:23 | Low | 1 |
| 2026-08-12 00:27:08 | Clean | 2 |
| 2026-08-11 19:21:46 | Low | 1 |
| 2026-08-11 17:21:34 | Low | 1 |
| 2026-07-30 00:17:23 | Clean | 2 |
| 2026-07-29 13:11:48 | Low | 1 |
| 2026-07-29 00:25:53 | Low | 2 |
| 2026-07-28 00:07:28 | Low | 2 |
| 2026-07-27 00:24:32 | Low | 2 |
| 2026-07-26 00:07:32 | Low | 2 |
| 2026-07-25 00:13:44 | Low | 2 |
| 2026-07-24 00:02:28 | Low | 2 |
| 2026-07-23 00:14:47 | Low | 2 |
| 2026-07-22 19:21:42 | Low | 2 |
| 2026-07-19 00:17:08 | Clean | 2 |
| 2026-07-18 05:56:57 | Low | 1 |
| 2026-07-18 00:14:48 | Low | 2 |
| 2026-07-17 00:06:16 | Low | 2 |