visual-studio-code-insiders-bin
maintainer dcelasun
· 40 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads prebuilt Microsoft VS Code Insiders binaries from a non-whitelisted but official Microsoft-controlled domain (vscode.download.prss.microsoft.com); the source is verifiable via provided sha256sums, and the binaries are from the project's official release infrastructure, making this a standard AUR packaging pattern with low risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Microsoft VS Code Insiders binaries from a non-whitelisted but official Microsoft-controlled domain (vscode.download.prss.microsoft.com); the source is verifiable via provided sha256sums, and the binaries are from the project's official release infrastructure, making this a standard AUR packaging pattern with low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
source_x86_64=(code_x64_1785518583.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/9e200810d9e54a5c66a50ba9538bd8b2545761b2/code-insiders_1.132.0-1785518583_amd64.deb)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: D. Can Celasun <can[at]dcc[dot]im>
2
3
pkgname=visual-studio-code-insiders-bin
4
_pkgname=visual-studio-code-insiders
5
pkgver=1785518583
6
pkgrel=1
7
pkgdesc="Visual Studio Code Insiders (vscode): Editor for building and debugging modern web and cloud applications (official binary version)"
8
arch=('x86_64' 'aarch64' 'armv7h')
9
url="https://code.visualstudio.com/"
10
license=('custom: commercial')
11
provides=('code-insiders' 'vscode-insiders')
12
conflicts=('code-insiders')
13
# Upstream has signature verification for extensions and stripping breaks it
14
# See https://github.com/microsoft/vscode/issues/223455#issuecomment-2610001754
15
options=(!strip)
16
install=$pkgname.install
17
# lsof: needed for terminal splitting, see https://github.com/Microsoft/vscode/issues/62991
18
# xdg-utils: needed for opening web links with xdg-open
19
depends=(libxkbfile gnupg gtk3 libsecret nss gcc-libs libnotify libxss glibc lsof shared-mime-info xdg-utils alsa-lib)
20
optdepends=('glib2: Needed for move to trash functionality'
21
'libdbusmenu-glib: Needed for KDE global menu'
22
'org.freedesktop.secrets: Needed for settings sync'
23
# See https://github.com/MicrosoftDocs/live-share/issues/4650
24
'icu69: Needed for live share' )
25
source=(${_pkgname}-bin.sh)
26
source_x86_64=(code_x64_1785518583.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/9e200810d9e54a5c66a50ba9538bd8b2545761b2/code-insiders_1.132.0-1785518583_amd64.deb)
27
source_aarch64=(code_arm64_1785518648.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/9e200810d9e54a5c66a50ba9538bd8b2545761b2/code-insiders_1.132.0-1785518648_arm64.deb)
28
source_armv7h=(code_armhf_1785518367.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/9e200810d9e54a5c66a50ba9538bd8b2545761b2/code-insiders_1.132.0-1785518367_armhf.deb)
29
sha256sums=('bf8abef6671392bf1f11d203fd940cc44e764e9c6352be7799880535c2f15087')
30
sha256sums_x86_64=('d670c49101378d2b6a155a05e77eb968534e95e138e2c07b23121c357d7e13e9')
31
sha256sums_aarch64=('ea8e695ce2fa1ab59a76dab7ade4c580567f991af0ee35544a110f810844d930')
32
sha256sums_armv7h=('a75368881b60d1c4120d8997be579140c699fa395cde356fbe60195608dd9239')
33
34
package() {
35
bsdtar -xf data.tar.xz -C "${pkgdir}/"
36
37
install -d "${pkgdir}/usr/bin"
38
install -d "${pkgdir}/usr/share/licenses/${pkgname}"
39
40
ln -s /usr/share/code-insiders/resources/app/LICENSE.rtf \
41
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.rtf"
42
43
# Launcher
44
install -m755 "${srcdir}/${_pkgname}-bin.sh" "${pkgdir}/usr/bin/code-insiders"
45
46
# Fix the desktop entries
47
sed -i \
48
-e 's/^\(Exec=\)[^ ]*/\1code-insiders/g' \
49
"${pkgdir}"/usr/share/applications/*.desktop
50
51
# setuid on chrome-sandbox
52
# Comment out if using a kernel without user namespaces, like linux-hardened
53
chmod u-s "${pkgdir}/usr/share/code-insiders/chrome-sandbox"
54
}
55
Changes since previous scan
--- PKGBUILD @ 2026-07-31 11:17+++ PKGBUILD @ 2026-08-03 00:08@@ -2,7 +2,7 @@ pkgname=visual-studio-code-insiders-bin _pkgname=visual-studio-code-insiders-pkgver=1785475140+pkgver=1785518583 pkgrel=1 pkgdesc="Visual Studio Code Insiders (vscode): Editor for building and debugging modern web and cloud applications (official binary version)" arch=('x86_64' 'aarch64' 'armv7h')@@ -23,13 +23,13 @@ # See https://github.com/MicrosoftDocs/live-share/issues/4650 'icu69: Needed for live share' ) source=(${_pkgname}-bin.sh)-source_x86_64=(code_x64_1785475140.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/d1ced2b15b280d2cf7a77b12baafaf5e68f7076c/code-insiders_1.132.0-1785475140_amd64.deb)-source_aarch64=(code_arm64_1785475145.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/d1ced2b15b280d2cf7a77b12baafaf5e68f7076c/code-insiders_1.132.0-1785475145_arm64.deb)-source_armv7h=(code_armhf_1785474997.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/d1ced2b15b280d2cf7a77b12baafaf5e68f7076c/code-insiders_1.132.0-1785474997_armhf.deb)+source_x86_64=(code_x64_1785518583.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/9e200810d9e54a5c66a50ba9538bd8b2545761b2/code-insiders_1.132.0-1785518583_amd64.deb)+source_aarch64=(code_arm64_1785518648.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/9e200810d9e54a5c66a50ba9538bd8b2545761b2/code-insiders_1.132.0-1785518648_arm64.deb)+source_armv7h=(code_armhf_1785518367.deb::https://vscode.download.prss.microsoft.com/dbazure/download/insider/9e200810d9e54a5c66a50ba9538bd8b2545761b2/code-insiders_1.132.0-1785518367_armhf.deb) sha256sums=('bf8abef6671392bf1f11d203fd940cc44e764e9c6352be7799880535c2f15087')-sha256sums_x86_64=('7afa62abe78159b49b30a96b693732bf073905b0b64287c72ab70f692a94c48f')-sha256sums_aarch64=('1ef33f4af97ae8e21aa17a1b13bb5986719e001684a3db74210a6d6c46146e7f')-sha256sums_armv7h=('a1ec210bb4cd5abfcabbaaa42ae34e5b695086547c8e7cf5c8c5f4e58164639d')+sha256sums_x86_64=('d670c49101378d2b6a155a05e77eb968534e95e138e2c07b23121c357d7e13e9')+sha256sums_aarch64=('ea8e695ce2fa1ab59a76dab7ade4c580567f991af0ee35544a110f810844d930')+sha256sums_armv7h=('a75368881b60d1c4120d8997be579140c699fa395cde356fbe60195608dd9239') package() { bsdtar -xf data.tar.xz -C "${pkgdir}/"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 21:18:45 | MEDIUM | 1 |
| 2026-07-31 11:17:50 | MEDIUM | 1 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 21:16:48 | MEDIUM | 1 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 21:12:47 | MEDIUM | 1 |
| 2026-07-29 13:11:48 | MEDIUM | 1 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 19:39:35 | MEDIUM | 1 |
| 2026-07-28 15:39:03 | MEDIUM | 1 |
| 2026-07-28 03:37:00 | MEDIUM | 1 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 21:35:42 | MEDIUM | 1 |
| 2026-07-27 13:35:00 | MEDIUM | 1 |
| 2026-07-27 09:34:56 | MEDIUM | 1 |
| 2026-07-25 00:13:44 | CLEAN | 2 |
| 2026-07-24 21:28:26 | MEDIUM | 1 |