ya-claude-code

maintainer aaronsb · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Downloads a prebuilt binary from downloads.claude.ai (Anthropic's own official release infrastructure) and verifies it against a GPG-signed manifest using a pinned Anthropic key fingerprint and a pinned sha256sum — this is a legitimate, well-constructed packaging approach for a proprietary CLI tool; the non-standard host is the project's own official download domain, not a personal/swappable host.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads a prebuilt binary from downloads.claude.ai (Anthropic's own official release infrastructure) and verifies it against a GPG-signed manifest using a pinned Anthropic key fingerprint and a pinned sha256sum — this is a legitimate, well-constructed packaging approach for a proprietary CLI tool; the non-standard host is the project's own official download domain, not a personal/swappable host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 "legal-${pkgver}.md::https://code.claude.com/docs/en/legal-and-compliance.md"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aaron Bockelie <aaronsb@gmail.com>
    
      2
    
      3pkgname=ya-claude-code
    
      4pkgver=2.1.233
    
      5pkgrel=1
    
      6pkgdesc="Claude Code CLI, verified at build time against Anthropic's signed release manifest"
    
      7arch=('x86_64')
    
      8url="https://github.com/anthropics/claude-code"
    
      9license=('LicenseRef-claude-code')
    
      10depends=('bash' 'glibc')
    
      11
    
      12# Same key that signs the Claude Desktop apt repository — one Anthropic release
    
      13# signing identity covers both products.
    
      14_fpr='31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE'
    
      15_rel="https://downloads.claude.ai/claude-code-releases/${pkgver}"
    
      16
    
      17optdepends=('git: let Claude use git'
    
      18            'github-cli: GitHub integration'
    
      19            'glab: GitLab integration'
    
      20            'ripgrep: faster file search'
    
      21            'tmux: agent team split panes'
    
      22            'bubblewrap: sandboxing'
    
      23            'socat: sandboxing')
    
      24
    
      25provides=('claude-code')
    
      26conflicts=('claude-code')
    
      27
    
      28# Self-contained Bun executable with an embedded runtime and resources;
    
      29# stripping corrupts it.
    
      30options=('!strip' '!debug')
    
      31
    
      32source=("claude-${pkgver}::${_rel}/linux-x64/claude"
    
      33        "manifest-${pkgver}.json::${_rel}/manifest.json"
    
      34        "manifest-${pkgver}.json.pgpsig::${_rel}/manifest.json.sig"
    
      35        "legal-${pkgver}.md::https://code.claude.com/docs/en/legal-and-compliance.md"
    
      36        'anthropic-release-signing.key')
    
      37
    
      38# The manifest and its detached signature authenticate each other, and the legal
    
      39# text is prose that upstream edits in place; none of the three can carry a fixed
    
      40# hash. The binary's hash is pinned and additionally re-derived from the signed
    
      41# manifest in prepare().
    
      42sha256sums=('55d281096f57d411ebbdd94dbf5e9ff3accb7c05713e37348c2c11d4b83bf9d9'
    
      43            'SKIP'
    
      44            'SKIP'
    
      45            'SKIP'
    
      46            'bd70a5e4a268002704024ceba7f8446024114e94f3f0bdd11c23a9e592be81c6')
    
      47
    
      48prepare() {
    
      49  cd "$srcdir"
    
      50
    
      51  local keyring="$srcdir/.gnupg"
    
      52  rm -rf "$keyring"
    
      53  install -dm700 "$keyring"
    
      54  gpg --homedir "$keyring" --batch --quiet --import anthropic-release-signing.key
    
      55
    
      56  local got
    
      57  got=$(gpg --homedir "$keyring" --batch --with-colons --fingerprint \
    
      58        | awk -F: '/^fpr:/{print $10; exit}')
    
      59  if [[ $got != "$_fpr" ]]; then
    
      60    echo "==> signing key is not Anthropic's: $got" >&2
    
      61    return 1
    
      62  fi
    
      63
    
      64  gpg --homedir "$keyring" --batch --verify \
    
      65      "manifest-${pkgver}.json.pgpsig" "manifest-${pkgver}.json" >/dev/null 2>&1 || {
    
      66    echo "==> release manifest signature did not verify" >&2
    
      67    return 1
    
      68  }
    
      69
    
      70  # The signed manifest carries the version alongside the checksums, so a
    
      71  # manifest for some other release cannot be substituted for this one.
    
      72  local mver
    
      73  mver=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' \
    
      74         "manifest-${pkgver}.json" | head -1)
    
      75  if [[ $mver != "$pkgver" ]]; then
    
      76    echo "==> signed manifest is for ${mver:-nothing}, not ${pkgver}" >&2
    
      77    return 1
    
      78  fi
    
      79
    
      80  local signed
    
      81  signed=$(sed -n '/"linux-x64"[[:space:]]*:/,/}/p' "manifest-${pkgver}.json" \
    
      82           | sed -n 's/.*"checksum"[[:space:]]*:[[:space:]]*"\([0-9a-f]\{64\}\)".*/\1/p' | head -1)
    
      83  if [[ $signed != "${sha256sums[0]}" ]]; then
    
      84    echo "==> linux-x64 checksum in the signed manifest (${signed:-none}) != pinned ${sha256sums[0]}" >&2
    
      85    return 1
    
      86  fi
    
      87
    
      88  echo "==> verified claude ${pkgver} against Anthropic's signed release manifest"
    
      89}
    
      90
    
      91package() {
    
      92  cd "$srcdir"
    
      93
    
      94  install -Dm755 "claude-${pkgver}" "$pkgdir/opt/${pkgname}/bin/claude"
    
      95
    
      96  # The binary self-updates and expects the native-installer layout under
    
      97  # ~/.local/bin. Both are wrong for a packaged install: an in-place update
    
      98  # would replace pacman-owned files, and the layout check warns on every
    
      99  # start. The wrapper turns off each.
    
      100  install -d "$pkgdir/usr/bin"
    
      101  cat > "$pkgdir/usr/bin/claude" <<EOF
    
      102#!/bin/sh
    
      103export DISABLE_UPDATES=1
    
      104export DISABLE_INSTALLATION_CHECKS=1
    
      105exec /opt/${pkgname}/bin/claude "\$@"
    
      106EOF
    
      107  chmod 755 "$pkgdir/usr/bin/claude"
    
      108
    
      109  install -Dm644 "legal-${pkgver}.md" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      110}
    
      111

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 09:38:30	LOW	3
2026-08-16 09:32:18	MEDIUM	2