visual-studio-code-insiders-bin
LOW
maintainer dcelasun
43 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads official Microsoft Visual Studio Code Insiders binaries from a non-whitelisted but plausibly official Microsoft domain (vscode.download.prss.microsoft.com), which is a standard practice for AUR packages; the binaries are verified via sha256sums, and no unreviewed remote code execution or malicious activity is present.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official Microsoft Visual Studio Code Insiders binaries from a non-whitelisted but plausibly official Microsoft domain (vscode.download.prss.microsoft.com), which is a standard practice for AUR packages; the binaries are verified via sha256sums, and no unreviewed remote code execution or malicious activity is present.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
source_x86_64=(code_x64_1793395618.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/caeec36b81bb8046f680cfe00d4a6d699b22cd9d/code-insiders_1.145.0-1793395618_amd64.deb)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: D. Can Celasun <can[at]dcc[dot]im>
2
3
pkgname=visual-studio-code-insiders-bin
4
_pkgname=visual-studio-code-insiders
5
pkgver=1793395618
6
pkgrel=1
7
pkgdesc="Visual Studio Code Insiders (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
8
arch=('x86_64' 'aarch64' 'armv7h')
9
url="https://code.visualstudio.com/"
10
license=('custom: commercial')
11
provides=('code-insiders' 'vscode-insiders')
12
conflicts=('code-insiders')
13
# Upstream has signature verification for extensions and stripping breaks it
14
# See https://github.com/microsoft/vscode/issues/223455#issuecomment-2610001754
15
options=(!strip)
16
install=$pkgname.install
17
# lsof: needed for terminal splitting, see https://github.com/Microsoft/vscode/issues/62991
18
# xdg-utils: needed for opening web links with xdg-open
19
depends=(libxkbfile gnupg gtk3 libsecret nss gcc-libs libnotify libxss glibc lsof shared-mime-info xdg-utils alsa-lib)
20
optdepends=('glib2: Needed for move to trash functionality'
21
'libdbusmenu-glib: Needed for KDE global menu'
22
'org.freedesktop.secrets: Needed for settings sync'
23
# See https://github.com/MicrosoftDocs/live-share/issues/4650
24
'icu69: Needed for live share'
25
# See https://code.visualstudio.com/docs/agents/run/agent-sandboxing#_check-platform-availability
26
'bubblewrap: Agent host sandboxing' 'socat: Agent host sandboxing'
27
)
28
source=(${_pkgname}-bin.sh)
29
source_x86_64=(code_x64_1793395618.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/caeec36b81bb8046f680cfe00d4a6d699b22cd9d/code-insiders_1.145.0-1793395618_amd64.deb)
30
source_aarch64=(code_arm64_1793395473.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/caeec36b81bb8046f680cfe00d4a6d699b22cd9d/code-insiders_1.145.0-1793395473_arm64.deb)
31
source_armv7h=(code_armhf_1793395038.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/caeec36b81bb8046f680cfe00d4a6d699b22cd9d/code-insiders_1.145.0-1793395038_armhf.deb)
32
sha256sums=('bf8abef6671392bf1f11d203fd940cc44e764e9c6352be7799880535c2f15087')
33
sha256sums_x86_64=('d5b514208ea468c4fb0a56f0e76a80b3dece22e3a2a47c7c7a7d23d1d9653ce9')
34
sha256sums_aarch64=('04e365caccaa022380e38fc1392925dd0169a4e31c2f64f501d332d6385a2713')
35
sha256sums_armv7h=('dc91ecef3116a221b300edfd5c1b5d50af9a057625c1babe78dab9f0b9e37317')
36
37
package() {
38
bsdtar -xf data.tar.xz -C "${pkgdir}/"
39
40
install -d "${pkgdir}/usr/bin"
41
install -d "${pkgdir}/usr/share/licenses/${pkgname}"
42
43
ln -s /usr/share/code-insiders/resources/app/LICENSE.rtf \
44
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.rtf"
45
46
# Launcher
47
install -m755 "${srcdir}/${_pkgname}-bin.sh" "${pkgdir}/usr/bin/code-insiders"
48
49
# Fix the desktop entries
50
sed -i \
51
-e 's/^\(Exec=\)[^ ]*/\1code-insiders/g' \
52
"${pkgdir}"/usr/share/applications/*.desktop
53
54
# setuid on chrome-sandbox
55
# Comment out if using a kernel without user namespaces, like linux-hardened
56
chmod u-s "${pkgdir}/usr/share/code-insiders/chrome-sandbox"
57
}
58
Changes since previous scan
--- PKGBUILD @ 2026-10-31 00:07+++ PKGBUILD @ 2026-11-01 00:21@@ -2,7 +2,7 @@ pkgname=visual-studio-code-insiders-bin _pkgname=visual-studio-code-insiders-pkgver=1793381130+pkgver=1793395618 pkgrel=1 pkgdesc="Visual Studio Code Insiders (vscode): Editor for building and debugging modern web and cloud applications (official binary version)" arch=('x86_64' 'aarch64' 'armv7h')@@ -26,13 +26,13 @@ 'bubblewrap: Agent host sandboxing' 'socat: Agent host sandboxing' ) source=(${_pkgname}-bin.sh)-source_x86_64=(code_x64_1793381130.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/41ac65b056070e8fd5617580b82feb0b17632117/code-insiders_1.145.0-1793381130_amd64.deb)-source_aarch64=(code_arm64_1793380925.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/41ac65b056070e8fd5617580b82feb0b17632117/code-insiders_1.145.0-1793380925_arm64.deb)-source_armv7h=(code_armhf_1793380581.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/41ac65b056070e8fd5617580b82feb0b17632117/code-insiders_1.145.0-1793380581_armhf.deb)+source_x86_64=(code_x64_1793395618.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/caeec36b81bb8046f680cfe00d4a6d699b22cd9d/code-insiders_1.145.0-1793395618_amd64.deb)+source_aarch64=(code_arm64_1793395473.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/caeec36b81bb8046f680cfe00d4a6d699b22cd9d/code-insiders_1.145.0-1793395473_arm64.deb)+source_armv7h=(code_armhf_1793395038.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/caeec36b81bb8046f680cfe00d4a6d699b22cd9d/code-insiders_1.145.0-1793395038_armhf.deb) sha256sums=('bf8abef6671392bf1f11d203fd940cc44e764e9c6352be7799880535c2f15087')-sha256sums_x86_64=('bb63f8b30dc00f07172aa670f63b62481bb791b731c829805f12e4d75582d33c')-sha256sums_aarch64=('efe87f0a2c344d4341b7227efd0ad5a45de5488009d59b87afa747a29ad4a962')-sha256sums_armv7h=('5715a926c9dbef97b694f5e474bdf3470b72e750863eb11a5b0231bf3da34d1b')+sha256sums_x86_64=('d5b514208ea468c4fb0a56f0e76a80b3dece22e3a2a47c7c7a7d23d1d9653ce9')+sha256sums_aarch64=('04e365caccaa022380e38fc1392925dd0169a4e31c2f64f501d332d6385a2713')+sha256sums_armv7h=('dc91ecef3116a221b300edfd5c1b5d50af9a057625c1babe78dab9f0b9e37317') package() { bsdtar -xf data.tar.xz -C "${pkgdir}/"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 05:57:59 | Medium | 1 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 19:57:05 | Medium | 1 |
| 2026-10-30 07:55:24 | Medium | 1 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 21:53:30 | Medium | 1 |
| 2026-10-29 07:52:02 | Medium | 1 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 09:50:05 | Medium | 1 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 21:48:49 | Medium | 1 |
| 2026-10-27 11:47:37 | Medium | 1 |
| 2026-10-27 01:46:28 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 13:45:05 | Medium | 1 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 01:38:37 | Medium | 1 |
| 2026-10-24 00:14:55 | Low | 2 |