visual-studio-code-electron-bin

LOW

maintainer zxp19821005 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt RPMs from Microsoft's official domain (code.visualstudio.com), which is plausibly the project's own release infrastructure; despite the non-standard URL format, the source is trustworthy and checksummed, and the build process only installs and configures the official binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt RPMs from Microsoft's official domain (code.visualstudio.com), which is plausibly the project's own release infrastructure; despite the non-standard URL format, the source is trustworthy and checksummed, and the build process only installs and configures the official binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:52 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-arm64")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# `vscodium-electron.js` from Richardn <rniu at umich dot edu>
    
      3_appname=code
    
      4_pkgname="visual-studio-${_appname}"
    
      5pkgname="${_pkgname}-electron-bin"
    
      6_debname=com.microsoft.VSCode
    
      7pkgver=1.144.0
    
      8_electronversion=43
    
      9pkgrel=1
    
      10pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications."
    
      11arch=(
    
      12    'aarch64'
    
      13    'armv7h'
    
      14    'x86_64'
    
      15)
    
      16url="https://code.visualstudio.com/"
    
      17_ghurl="https://github.com/microsoft/vscode"
    
      18#_dlurl="https://packages.microsoft.com/yumrepos/vscode/Packages/c"
    
      19license=('LicenseRef-scancode-commercial-license')
    
      20provides=(
    
      21    "${_pkgname}"
    
      22    "vs${_appname}"
    
      23)
    
      24conflicts=(
    
      25    "${pkgname%-bin}"
    
      26    "${_pkgname}"
    
      27    "${_appname}"
    
      28    "${_pkgname}-insiders"
    
      29    "${_pkgname}-marketplace"
    
      30)
    
      31depends=(
    
      32    "electron${_electronversion}"
    
      33    'nodejs'
    
      34    'libx11'
    
      35    'libxkbfile'
    
      36    'webkit2gtk-4.1'
    
      37    'libsecret'
    
      38    'glibc>=2.28'
    
      39    'gcc-libs>=8.1.0'
    
      40)
    
      41optdepends=(
    
      42    'gvfs: For move to trash functionality'
    
      43    'libdbusmenu-glib: For KDE global menu'
    
      44)
    
      45options=(
    
      46    '!strip'
    
      47)
    
      48source=(
    
      49    "${pkgname%-bin}.js"
    
      50    "${pkgname%-bin}.sh"
    
      51)
    
      52source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-arm64")
    
      53source_armv7h=("${pkgname%-bin}-${pkgver}-armv7h.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-armhf")
    
      54source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-x64")
    
      55sha256sums=('dc6e622af50c366f1713adfa1de690bbee9af76c8fec1d4dccddadffc9bdf2ba'
    
      56            '13fb5f66f31ced197d0e2b566daae599ffe96ab6f9eea7a0ffccbfc2eedae92f')
    
      57sha256sums_aarch64=('c3e620a22b5d444b433dcd7fd27238fb71d3afb6a52df534ab03474d683543c5')
    
      58sha256sums_armv7h=('2a1e8e5ac39de60f3e6e10d20da38d9dd90bee798cf9c419f69934b39cc11730')
    
      59sha256sums_x86_64=('ecd59c8a9f99f966a0aabfcc0675772b5b263ad652aa80322115a6e9215e7544')
    
      60pkgver() {
    
      61	cat "${srcdir}/.pkgver" 2>/dev/null || echo "${pkgver}"
    
      62}
    
      63_get_app_dir() {
    
      64	find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
    
      65		| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
    
      66}
    
      67_check_electron_version() {
    
      68	local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
    
      69		-executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
    
      70		| grep -oP 'Electron/\K[0-9]+' | head -1)
    
      71	[[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
    
      72	(( _v == _electronversion )) && c=32 || c=31
    
      73	echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
    
      74}
    
      75prepare() {
    
      76    _check_electron_version
    
      77    sed -i -e "
    
      78        s/@electronversion@/${_electronversion}/g
    
      79        s/@appname@/${pkgname%-bin}/g
    
      80    " "${srcdir}/${pkgname%-bin}.sh" "${srcdir}/${pkgname%-bin}.js"
    
      81    grep '"version": ' "$(_get_app_dir)/resources/app/package.json" | awk '{print $2}' | tr -d '"' | tr -d ',' > "${srcdir}/.pkgver"
    
      82    sed -i "s/${_debname}.desktop/${pkgname%-bin}.desktop/g" "${srcdir}/usr/share/appdata/${_debname}.appdata.xml"
    
      83    sed -i -e "
    
      84        s/\/usr\/share\/${_appname}\/${_appname}/${pkgname%-bin}/g
    
      85        s/Icon=vs${_appname}/Icon=${pkgname%-bin}/g
    
      86    " "${srcdir}/usr/share/applications/${_debname}"*.desktop
    
      87    rm -rf "$(_get_app_dir)/resources/app/node-compile-cache"
    
      88}
    
      89package() {
    
      90    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      91    install -Dm755 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      92    cp -a "$(_get_app_dir)/resources/app/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      93    install -Dm644 "${srcdir}/usr/share/appdata/${_debname}.appdata.xml" "${pkgdir}/usr/share/appdata/${pkgname%-bin}.appdata.xml"
    
      94    install -Dm644 "${srcdir}/usr/share/applications/${_debname}.UrlHandler.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}-UrlHandler.desktop"
    
      95    install -Dm644 "${srcdir}/usr/share/applications/${_debname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      96    install -Dm644 "${srcdir}/usr/share/mime/packages/${_appname}-workspace.xml" "${pkgdir}/usr/share/mime/packages/${pkgname%-bin}-workspace.xml"
    
      97    install -Dm644 "${srcdir}/usr/share/pixmaps/vs${_appname}.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname%-bin}.png"
    
      98    install -Dm644 "${srcdir}/usr/share/bash-completion/completions/${_appname}" -t "${pkgdir}/usr/share/bash-completion/completions"
    
      99    install -Dm644 "${srcdir}/usr/share/zsh/site-functions/_${_appname}" -t "${pkgdir}/usr/share/zsh/vendor-completions/"
    
      100    install -Dm644 "${srcdir}/usr/share/${_appname}/resources/app/licenses/"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      101}
    
      102

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -4,7 +4,7 @@
 _pkgname="visual-studio-${_appname}"
 pkgname="${_pkgname}-electron-bin"
 _debname=com.microsoft.VSCode
-pkgver=1.143.0
+pkgver=1.144.0
 _electronversion=43
 pkgrel=1
 pkgdesc="Visual Studio Code (vscode): Editor for building and debugging modern web and cloud applications."
@@ -54,9 +54,9 @@
 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::https://code.visualstudio.com/sha/download?build=stable&os=linux-rpm-x64")
 sha256sums=('dc6e622af50c366f1713adfa1de690bbee9af76c8fec1d4dccddadffc9bdf2ba'
             '13fb5f66f31ced197d0e2b566daae599ffe96ab6f9eea7a0ffccbfc2eedae92f')
-sha256sums_aarch64=('748258df06e3c6c7c94081d3d53ad265ca3e1217840928e81001546cff376252')
-sha256sums_armv7h=('8ae4f1581c767977aed86ec82781123bcd42d25020093b9f3b2f000725193f30')
-sha256sums_x86_64=('624da32c2c3634cffe741c8a76218aa82e747f25eef5d03ea05133de617bc319')
+sha256sums_aarch64=('c3e620a22b5d444b433dcd7fd27238fb71d3afb6a52df534ab03474d683543c5')
+sha256sums_armv7h=('2a1e8e5ac39de60f3e6e10d20da38d9dd90bee798cf9c419f69934b39cc11730')
+sha256sums_x86_64=('ecd59c8a9f99f966a0aabfcc0675772b5b263ad652aa80322115a6e9215e7544')
 pkgver() {
 	cat "${srcdir}/.pkgver" 2>/dev/null || echo "${pkgver}"
 }
@@ -84,6 +84,7 @@
         s/\/usr\/share\/${_appname}\/${_appname}/${pkgname%-bin}/g
         s/Icon=vs${_appname}/Icon=${pkgname%-bin}/g
     " "${srcdir}/usr/share/applications/${_debname}"*.desktop
+    rm -rf "$(_get_app_dir)/resources/app/node-compile-cache"
 }
 package() {
     install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 01:51:16	Medium	1
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 01:43:34	Medium	1
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 05:34:05	Medium	1
2026-10-20 00:10:31	Clean	2
2026-10-19 03:23:49	Medium	1
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2