visual-studio-code-cli-bin

LOW

maintainer jclds139 0 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The package downloads prebuilt binaries from Microsoft's official update domain (update.code.visualstudio.com), which is the legitimate release infrastructure for VS Code, making the source trustworthy despite not being on a static analyzer whitelist.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from Microsoft's official update domain (update.code.visualstudio.com), which is the legitimate release infrastructure for VS Code, making the source trustworthy despite not being on a static analyzer whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=(code_cli_x64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-x64/stable)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jay Chu <tothesong[at]gmail[dot]com>
    
      2# Co-Maintainer: Jesse R Codling <codling[at]umich.edu>
    
      3
    
      4pkgname=visual-studio-code-cli-bin
    
      5pkgver=1.139.1
    
      6pkgrel=1
    
      7pkgdesc="The Visual Studio Code Server is a service you can run on a remote development machine, like your desktop PC or a virtual machine (VM)."
    
      8arch=('x86_64' 'aarch64' 'armv7h')
    
      9url="https://code.visualstudio.com/"
    
      10license=('custom: Microsoft EULA')
    
      11provides=('code' 'vscode')
    
      12conflicts=('code' 'vscode')
    
      13source_x86_64=(code_cli_x64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-x64/stable)
    
      14source_aarch64=(code_cli_arm64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-arm64/stable)
    
      15source_armv7h=(code_cli_armhf_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-armhf/stable)
    
      16sha256sums_x86_64=('e079ddb70377cca515ab0cf5ca1ee4095a14e1f510af4b10a75b01c6018f9f02')
    
      17sha256sums_aarch64=('5bc80c3622a628a8aee4be15967bdc7a039235d867c3d1bedf1b373d2d731dc7')
    
      18sha256sums_armv7h=('efedf174d86463178c4335d5b886bcc9a5a2f3bbb8c265c815b553bdad3cdd81')
    
      19
    
      20
    
      21package() {
    
      22  install -Dm755 -t "${pkgdir}/usr/bin/" code
    
      23}
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-09-24 00:24
+++ PKGBUILD @ 2026-10-02 00:00
@@ -2,7 +2,7 @@
 # Co-Maintainer: Jesse R Codling <codling[at]umich.edu>
 
 pkgname=visual-studio-code-cli-bin
-pkgver=1.139.0
+pkgver=1.139.1
 pkgrel=1
 pkgdesc="The Visual Studio Code Server is a service you can run on a remote development machine, like your desktop PC or a virtual machine (VM)."
 arch=('x86_64' 'aarch64' 'armv7h')
@@ -13,9 +13,9 @@
 source_x86_64=(code_cli_x64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-x64/stable)
 source_aarch64=(code_cli_arm64_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-arm64/stable)
 source_armv7h=(code_cli_armhf_${pkgver}.tar.gz::https://update.code.visualstudio.com/${pkgver}/cli-linux-armhf/stable)
-sha256sums_x86_64=('651bc54695531375589c837b907a4e784bc2892076592e2464da12ead994d4bd')
-sha256sums_aarch64=('b114eb9c53e798e6a6a140e9081d811c9897d10559d37b2b48a7f6bb86ce5855')
-sha256sums_armv7h=('e0c43e80c9d393cbbb91b60611cc55f34d0c24f5ee466e4f07443cdd33900207')
+sha256sums_x86_64=('e079ddb70377cca515ab0cf5ca1ee4095a14e1f510af4b10a75b01c6018f9f02')
+sha256sums_aarch64=('5bc80c3622a628a8aee4be15967bdc7a039235d867c3d1bedf1b373d2d731dc7')
+sha256sums_armv7h=('efedf174d86463178c4335d5b886bcc9a5a2f3bbb8c265c815b553bdad3cdd81')
 
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 13:11:58	Medium	1
2026-09-24 00:24:14	Clean	2
2026-09-23 13:40:34	Medium	1
2026-09-17 00:27:14	Clean	2
2026-09-16 13:22:46	Medium	1
2026-09-11 00:19:22	Clean	2
2026-09-10 13:20:36	Medium	1
2026-09-10 00:22:44	Clean	2
2026-09-09 13:19:49	Medium	1
2026-09-05 00:16:27	Clean	2
2026-09-04 13:57:51	Medium	1
2026-09-04 00:03:13	Clean	2
2026-09-03 13:53:13	Medium	1