visual-studio-code-cli-bin

maintainer jclds139 · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The source URLs point to Microsoft's official update domain for Visual Studio Code CLI binaries, which is a legitimate and expected source despite not being on a standard whitelist; the package installs only the official binary without executing remote code or introducing untrusted dependencies.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URLs point to Microsoft's official update domain for Visual Studio Code CLI binaries, which is a legitimate and expected source despite not being on a standard whitelist; the package installs only the official binary without executing remote code or introducing untrusted dependencies.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=(code_cli_x64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-x64/stable)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jay Chu <tothesong[at]gmail[dot]com>
    
      2# Co-Maintainer: Jesse R Codling <codling[at]umich.edu>
    
      3
    
      4pkgname=visual-studio-code-cli-bin
    
      5pkgver=1.133.0
    
      6pkgrel=1
    
      7pkgdesc="The Visual Studio Code Server is a service you can run on a remote development machine, like your desktop PC or a virtual machine (VM)."
    
      8arch=('x86_64' 'aarch64' 'armv7h')
    
      9url="https://code.visualstudio.com/"
    
      10license=('custom: Microsoft EULA')
    
      11provides=('code' 'vscode')
    
      12conflicts=('code' 'vscode')
    
      13source_x86_64=(code_cli_x64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-x64/stable)
    
      14source_aarch64=(code_cli_arm64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-arm64/stable)
    
      15source_armv7h=(code_cli_armhf_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-armhf/stable)
    
      16sha256sums_x86_64=('a9143a00aab25ac6c8fe0331c995076db641a43675622d9acd3b8205e7cea062')
    
      17sha256sums_aarch64=('4ee86ffacf366274227e9b4b9e6a003ae716e5817bfcb25e95807c9454dcd2ea')
    
      18sha256sums_armv7h=('6a61919c61245813abbea024de9349b47f3a71b3607f821c3abca6d2be61f4cb')
    
      19
    
      20
    
      21package() {
    
      22  install -Dm755 -t "${pkgdir}/usr/bin/" code
    
      23}
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-08-13 00:17
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,7 +2,7 @@
 # Co-Maintainer: Jesse R Codling <codling[at]umich.edu>
 
 pkgname=visual-studio-code-cli-bin
-pkgver=1.132.1
+pkgver=1.133.0
 pkgrel=1
 pkgdesc="The Visual Studio Code Server is a service you can run on a remote development machine, like your desktop PC or a virtual machine (VM)."
 arch=('x86_64' 'aarch64' 'armv7h')
@@ -13,9 +13,9 @@
 source_x86_64=(code_cli_x64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-x64/stable)
 source_aarch64=(code_cli_arm64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-arm64/stable)
 source_armv7h=(code_cli_armhf_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-armhf/stable)
-sha256sums_x86_64=('0269f5fcd574823e6c90ad490f43a2a173f93ee3e5be5c2caae0847179133374')
-sha256sums_aarch64=('39a8e15364043c6b33ff8120e508c1fb106252e72f94dccc1ba0d4c4120d5faa')
-sha256sums_armv7h=('40548059173da614f4de15e1cc04a030dd3e83465acfd4663cb883ea81e49e9f')
+sha256sums_x86_64=('a9143a00aab25ac6c8fe0331c995076db641a43675622d9acd3b8205e7cea062')
+sha256sums_aarch64=('4ee86ffacf366274227e9b4b9e6a003ae716e5817bfcb25e95807c9454dcd2ea')
+sha256sums_armv7h=('6a61919c61245813abbea024de9349b47f3a71b3607f821c3abca6d2be61f4cb')
 
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 09:26:10	MEDIUM	1
2026-08-13 00:17:07	CLEAN	2
2026-08-12 09:23:17	MEDIUM	1
2026-07-31 00:14:10	CLEAN	2
2026-07-30 11:14:12	MEDIUM	1
2026-07-24 00:02:28	CLEAN	2
2026-07-23 11:23:42	MEDIUM	1
2026-07-19 00:17:08	CLEAN	2
2026-07-18 09:57:20	MEDIUM	1
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 11:51:28	MEDIUM	1
2026-07-16 00:05:41	CLEAN	2
2026-07-15 09:48:24	MEDIUM	1
2026-07-09 00:22:38	CLEAN	2