z-code

LOW

maintainer logan_reed 1 votes scanned 2026-09-19 23:33:04.891294

View on AUR

Why flagged

Downloads a prebuilt .deb from cdn-zcode.z.ai, which appears to be the project's own official CDN (matching the official url https://zcode.z.ai/), with b2 checksums provided; the main concern is that this is a prebuilt binary from a relatively unknown vendor, but the host is plausibly official infrastructure rather than a swappable personal/cloud storage host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt .deb from cdn-zcode.z.ai, which appears to be the project's own official CDN (matching the official url https://zcode.z.ai/), with b2 checksums provided; the main concern is that this is a prebuilt binary from a relatively unknown vendor, but the host is plausibly official infrastructure rather than a swappable personal/cloud storage host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source_x86_64=("https://cdn-zcode.z.ai/zcode/electron/releases/${_upstream_ver}/linux-x64/${_upstream}-${_upstream_ver}-linux-x64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: logan_reed <liulingzhang.work@icloud.com>
    
      2
    
      3_upstream=ZCode
    
      4# pkgver 取 deb 头部 dpkg 权威版本归一化（3.14.0-7681 → 3.14.0_7681，与
    
      5# aur-metadata rule-deb 采集一致）；上游版本号经 ${_upstream_ver} 进 URL
    
      6pkgname=z-code
    
      7pkgver=3.14.0_7681
    
      8_upstream_ver="${pkgver%_*}"
    
      9pkgrel=1
    
      10pkgdesc="AI coding agent desktop app by Z.ai"
    
      11arch=('x86_64' 'aarch64')
    
      12url="https://zcode.z.ai/"
    
      13license=('LicenseRef-ZCode')
    
      14conflicts=('zcode' 'zcode-bin' 'z-code-bin')
    
      15provides=("zcode=${pkgver}")
    
      16depends=('nss' 'alsa-lib' 'gtk3' 'at-spi2-core' 'libsecret' 'libnotify' 'libxss'
    
      17         'libxtst' 'xdg-utils' 'util-linux-libs')
    
      18optdepends=('libappindicator-gtk3: System tray support')
    
      19options=('!strip' '!debug')
    
      20source=("z-code.sh" "z-code.desktop")
    
      21source_x86_64=("https://cdn-zcode.z.ai/zcode/electron/releases/${_upstream_ver}/linux-x64/${_upstream}-${_upstream_ver}-linux-x64.deb")
    
      22source_aarch64=("https://cdn-zcode.z.ai/zcode/electron/releases/${_upstream_ver}/linux-arm64/${_upstream}-${_upstream_ver}-linux-arm64.deb")
    
      23b2sums=('eac2332eb52f8a6b079120c6d7b30124409f96eafc12d192074e9c8b26ddcb0b3e09876236ccf48894c1bf057c9c6376e090eae8bbdfa9ac361ddc42e3f17aee'
    
      24        '0b3a5b925482fc438cdca38ec75e5dcdbbfdf034383a867cfbb0583c2cb5e2d6f535906c5d51fa71c7c2f0440f4fc781b89ae8bc8acfa747faa131cd98cceb7b')
    
      25b2sums_x86_64=('bbaec96fe7f0a26f30018e31f8ea8fef1d55e7a2f75ff6ce6972bfab2fa37b39a6d0c5c265b6e7e168797790c74e46758ad5822de9354ab4656263d571a0d840')
    
      26b2sums_aarch64=('1caa435d8681b7c4d6e11613c9bd853affc71e51e9750862f70b75ebdb72091b935c2d53406ec231172657d45f0139390d0a417ea09162a3538bdf92548baae0')
    
      27
    
      28# NOTE: z-code.sh hardcodes /opt/ZCode/zcode
    
      29# If _installdir changes, the launcher script must also be updated.
    
      30package() {
    
      31    bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      32
    
      33    # Launcher
    
      34    install -Dm755 "z-code.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      35
    
      36    # Desktop entry: replace upstream zcode.desktop (Exec 指向 /opt/ZCode/zcode)
    
      37    rm -f "${pkgdir}/usr/share/applications/zcode.desktop"
    
      38    install -Dm644 "z-code.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      39
    
      40    # Debian 打包残留
    
      41    rm -rf "${pkgdir}/usr/share/doc"
    
      42
    
      43    # License
    
      44    install -Dm644 "${pkgdir}/opt/${_upstream}/LICENSE.electron.txt" \
    
      45        -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      46    install -Dm644 "${pkgdir}/opt/${_upstream}/LICENSES.chromium.html" \
    
      47        -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      48
    
      49    # SUID sandbox
    
      50    chmod 4755 "${pkgdir}/opt/${_upstream}/chrome-sandbox"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-19 23:33:04	Low	3
2026-09-19 23:31:49	Medium	2