visual-studio-code-electron-bin

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt RPMs from Microsoft's official Visual Studio Code download endpoint (code.visualstudio.com), which is a legitimate and expected source; despite the non-standard host pattern, the source is trustworthy and the package installs only verified, official binaries with proper checksums.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt RPMs from Microsoft's official Visual Studio Code download endpoint (code.visualstudio.com), which is a legitimate and expected source; despite the non-standard host pattern, the source is trustworthy and the package installs only verified, official binaries with proper checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:49 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-arm64")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# `vscodium-electron.js` from Richardn <rniu at umich dot edu>
    
      3_appname=code
    
      4_pkgname="visual-studio-${_appname}"
    
      5pkgname="${_pkgname}-electron-bin"
    
      6pkgver=1.131.0
    
      7_electronversion=42
    
      8pkgrel=1
    
      9pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications.(Prebuilt and System-wide Electron edition)"
    
      10arch=(
    
      11    'aarch64'
    
      12    'armv7h'
    
      13    'x86_64'
    
      14)
    
      15url="https://code.visualstudio.com/"
    
      16_ghurl="https://github.com/microsoft/vscode"
    
      17#_dlurl="https://packages.microsoft.com/yumrepos/vscode/Packages/c"
    
      18license=('LicenseRef-scancode-commercial-license')
    
      19provides=(
    
      20    "${_pkgname}"
    
      21    "vs${_appname}"
    
      22)
    
      23conflicts=(
    
      24    "${pkgname%-bin}"
    
      25    "${_pkgname}"
    
      26    "${_appname}"
    
      27    "${_pkgname}-insiders"
    
      28    "${_pkgname}-marketplace"
    
      29)
    
      30depends=(
    
      31    "electron${_electronversion}"
    
      32    'nodejs'
    
      33    'libx11'
    
      34    'libxkbfile'
    
      35    'webkit2gtk-4.1'
    
      36    'libsecret'
    
      37)
    
      38optdepends=(
    
      39    'gvfs: For move to trash functionality'
    
      40    'libdbusmenu-glib: For KDE global menu'
    
      41)
    
      42options=(
    
      43    '!strip'
    
      44)
    
      45source=(
    
      46    "${pkgname%-bin}.js"
    
      47    "${pkgname%-bin}.sh"
    
      48)
    
      49source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-arm64")
    
      50source_armv7h=("${pkgname%-bin}-${pkgver}-armv7h.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-armhf")
    
      51source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-x64")
    
      52sha256sums=('68a94e4a9d746da48f5bb990d48b434363e476dfde006394a3ced94b4a54b4a7'
    
      53            '700067aa4b354a91ab3374b5495af9eb3093855a3d8016a8303e88abf3470599')
    
      54sha256sums_aarch64=('6350a70eab54e2e7ebd169ca36c83b29e1349de5b361d5b80901d3568271601e')
    
      55sha256sums_armv7h=('6c79b9a94ac193a474d6a70117d328c5428d52da9923c1abb1e5c4c3b9ec291b')
    
      56sha256sums_x86_64=('4b8483e05ad1ca7474e87d045ee8f5c71b2c4fe73fdd823466483a68527dabfd')
    
      57pkgver() {
    
      58    cd "${srcdir}/usr/share/${_appname}/resources/app"
    
      59    grep '"version": ' package.json | awk '{print $2}' | tr -d '"' | tr -d ','
    
      60}
    
      61_get_app_dir() {
    
      62    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      63}
    
      64_get_electron_version() {
    
      65    _elec_ver="$(strings "${srcdir}/usr/share/${_appname}/${_appname}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1)"
    
      66    echo -e "The electron version is: \033[1;31m${_elec_ver}\033[0m"
    
      67}
    
      68prepare() {
    
      69    sed -i -e "
    
      70        s/@electronversion@/${_electronversion}/g
    
      71        s/@appname@/${pkgname%-bin}/g
    
      72        s/@runname@/app/g
    
      73        s/@cfgdirname@/${_pkgname}/g
    
      74    " "${srcdir}/${pkgname%-bin}.sh"
    
      75    _get_electron_version
    
      76    sed -i "s/@ELECTRON@/electron${_electronversion}/g" "${srcdir}/${pkgname%-bin}.js"
    
      77    sed -i "s/${_appname}.desktop/${pkgname%-bin}.desktop/g" "${srcdir}/usr/share/appdata/${_appname}.appdata.xml"
    
      78    sed -i -e "
    
      79        s/\/usr\/share\/${_appname}\/${_appname}/${pkgname%-bin}/g
    
      80        s/Icon=vs${_appname}/Icon=${pkgname%-bin}/g
    
      81    " "${srcdir}/usr/share/applications/"{"${_appname}-url-handler.desktop","${_appname}.desktop"}
    
      82    rm -rf \
    
      83        "${srcdir}/usr/share/${_appname}/resources/app/node_modules/@microsoft/mxc-sdk/bin/arm64" \
    
      84        "${srcdir}/usr/share/${_appname}/resources/app/extensions/ms-vscode.js-debug/src/win32-app-container-tokens."*".node"
    
      85}
    
      86package() {
    
      87    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      88    install -Dm755 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      89    local _app_dir=$(_get_app_dir)
    
      90    cp -a "${_app_dir}/resources/app/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      91    install -Dm644 "${srcdir}/usr/share/appdata/${_appname}.appdata.xml" "${pkgdir}/usr/share/appdata/${pkgname%-bin}.appdata.xml"
    
      92    install -Dm644 "${srcdir}/usr/share/applications/${_appname}-url-handler.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}-url-handler.desktop"
    
      93    install -Dm644 "${srcdir}/usr/share/applications/${_appname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      94    install -Dm644 "${srcdir}/usr/share/mime/packages/${_appname}-workspace.xml" "${pkgdir}/usr/share/mime/packages/${pkgname%-bin}-workspace.xml"
    
      95    install -Dm644 "${srcdir}/usr/share/pixmaps/vs${_appname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
    
      96    install -Dm644 "${srcdir}/usr/share/bash-completion/completions/${_appname}" -t "${pkgdir}/usr/share/bash-completion/completions"
    
      97    install -Dm644 "${srcdir}/usr/share/zsh/site-functions/_${_appname}" -t "${pkgdir}/usr/share/zsh/vendor-completions/"
    
      98    install -Dm644 "${srcdir}/usr/share/${_appname}/resources/app/licenses/"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      99}
    
      100

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 _appname=code
 _pkgname="visual-studio-${_appname}"
 pkgname="${_pkgname}-electron-bin"
-pkgver=1.130.0
+pkgver=1.131.0
 _electronversion=42
 pkgrel=1
 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications.(Prebuilt and System-wide Electron edition)"
@@ -32,9 +32,6 @@
     'nodejs'
     'libx11'
     'libxkbfile'
-    'python'
-    'python-fonttools'
-    'perl'
     'webkit2gtk-4.1'
     'libsecret'
 )
@@ -54,9 +51,9 @@
 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-x64")
 sha256sums=('68a94e4a9d746da48f5bb990d48b434363e476dfde006394a3ced94b4a54b4a7'
             '700067aa4b354a91ab3374b5495af9eb3093855a3d8016a8303e88abf3470599')
-sha256sums_aarch64=('81616c5f5c26e5f3f45c73872655d4c24b34dc25501efb557fc6f0b960d083af')
-sha256sums_armv7h=('8ae08a68371f8eced2f391c7b8620e14ea58ee1e53d93bfb5bec18aa6f312cd1')
-sha256sums_x86_64=('1190f3e6b1d39687d4cc81ae6e841f5d7d1bbe89504dfc8fc1aa17decb026c55')
+sha256sums_aarch64=('6350a70eab54e2e7ebd169ca36c83b29e1349de5b361d5b80901d3568271601e')
+sha256sums_armv7h=('6c79b9a94ac193a474d6a70117d328c5428d52da9923c1abb1e5c4c3b9ec291b')
+sha256sums_x86_64=('4b8483e05ad1ca7474e87d045ee8f5c71b2c4fe73fdd823466483a68527dabfd')
 pkgver() {
     cd "${srcdir}/usr/share/${_appname}/resources/app"
     grep '"version": ' package.json | awk '{print $2}' | tr -d '"' | tr -d ','

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 03:13:55	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 21:22:00	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 09:14:00	MEDIUM	1
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2