z-code
LOW
maintainer logan_reed
1 votes
scanned 2026-11-04 00:25:23.536954
Why flagged
The package downloads a prebuilt .deb from the project's own CDN (cdn-zcode.z.ai), which is plausibly official; the source is not executed directly but extracted and repackaged, and the checksums are provided, limiting supply-chain risk to LOW despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the project's own CDN (cdn-zcode.z.ai), which is plausibly official; the source is not executed directly but extracted and repackaged, and the checksums are provided, limiting supply-chain risk to LOW despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source_x86_64=("https://cdn-zcode.z.ai/zcode/electron/releases/${_upstream_ver}/linux-x64/${_upstream}-${_upstream_ver}-linux-x64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: logan_reed <liulingzhang.work@icloud.com>
2
3
_upstream=ZCode
4
# pkgver 取 deb 头部 dpkg 权威版本归一化（3.14.0-7681 → 3.14.0_7681，与
5
# aur-metadata rule-deb 采集一致）；上游版本号经 ${_upstream_ver} 进 URL
6
pkgname=z-code
7
pkgver=3.16.2_8769
8
_upstream_ver="${pkgver%_*}"
9
pkgrel=1
10
pkgdesc="AI coding agent desktop app by Z.ai"
11
arch=('x86_64' 'aarch64')
12
url="https://zcode.z.ai/"
13
license=('LicenseRef-ZCode')
14
conflicts=('zcode' 'zcode-bin' 'z-code-bin')
15
provides=("zcode=${pkgver}")
16
depends=('nss' 'alsa-lib' 'gtk3' 'at-spi2-core' 'libsecret' 'libnotify' 'libxss'
17
'libxtst' 'xdg-utils' 'util-linux-libs')
18
optdepends=('libappindicator-gtk3: System tray support')
19
options=('!strip' '!debug')
20
source=("z-code.sh" "z-code.desktop")
21
source_x86_64=("https://cdn-zcode.z.ai/zcode/electron/releases/${_upstream_ver}/linux-x64/${_upstream}-${_upstream_ver}-linux-x64.deb")
22
source_aarch64=("https://cdn-zcode.z.ai/zcode/electron/releases/${_upstream_ver}/linux-arm64/${_upstream}-${_upstream_ver}-linux-arm64.deb")
23
b2sums=('eac2332eb52f8a6b079120c6d7b30124409f96eafc12d192074e9c8b26ddcb0b3e09876236ccf48894c1bf057c9c6376e090eae8bbdfa9ac361ddc42e3f17aee'
24
'0b3a5b925482fc438cdca38ec75e5dcdbbfdf034383a867cfbb0583c2cb5e2d6f535906c5d51fa71c7c2f0440f4fc781b89ae8bc8acfa747faa131cd98cceb7b')
25
b2sums_x86_64=('5c16f99bddf827f16a0f872e30fcece09c9b4e2a65fc7512695fda7762defc819fb7129c7feb3d489968adb04b71c2040919c35c1f8f0926fc5714a85afb576e')
26
b2sums_aarch64=('da00aefa4b78be1f324c9c8cdb87d1381b204b0b8060240303fd0c3a9d1a7b73b821df9818655eb2cfd5b1a5b078db4907bf94c2195996b7116c0faec79189e5')
27
28
# NOTE: z-code.sh hardcodes /opt/ZCode/zcode
29
# If _installdir changes, the launcher script must also be updated.
30
package() {
31
bsdtar -xf data.tar.xz -C "${pkgdir}/"
32
33
# Launcher
34
install -Dm755 "z-code.sh" "${pkgdir}/usr/bin/${pkgname}"
35
36
# Desktop entry: replace upstream zcode.desktop (Exec 指向 /opt/ZCode/zcode)
37
rm -f "${pkgdir}/usr/share/applications/zcode.desktop"
38
install -Dm644 "z-code.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
39
40
# Debian 打包残留
41
rm -rf "${pkgdir}/usr/share/doc"
42
43
# License
44
install -Dm644 "${pkgdir}/opt/${_upstream}/LICENSE.electron.txt" \
45
-t "${pkgdir}/usr/share/licenses/${pkgname}/"
46
install -Dm644 "${pkgdir}/opt/${_upstream}/LICENSES.chromium.html" \
47
-t "${pkgdir}/usr/share/licenses/${pkgname}/"
48
49
# SUID sandbox
50
chmod 4755 "${pkgdir}/opt/${_upstream}/chrome-sandbox"
51
}
52
Changes since previous scan
--- PKGBUILD @ 2026-10-22 00:13+++ PKGBUILD @ 2026-11-04 00:25@@ -4,7 +4,7 @@ # pkgver 取 deb 头部 dpkg 权威版本归一化（3.14.0-7681 → 3.14.0_7681，与 # aur-metadata rule-deb 采集一致）；上游版本号经 ${_upstream_ver} 进 URL pkgname=z-code-pkgver=3.14.0_7681+pkgver=3.16.2_8769 _upstream_ver="${pkgver%_*}" pkgrel=1 pkgdesc="AI coding agent desktop app by Z.ai"@@ -22,8 +22,8 @@ source_aarch64=("https://cdn-zcode.z.ai/zcode/electron/releases/${_upstream_ver}/linux-arm64/${_upstream}-${_upstream_ver}-linux-arm64.deb") b2sums=('eac2332eb52f8a6b079120c6d7b30124409f96eafc12d192074e9c8b26ddcb0b3e09876236ccf48894c1bf057c9c6376e090eae8bbdfa9ac361ddc42e3f17aee' '0b3a5b925482fc438cdca38ec75e5dcdbbfdf034383a867cfbb0583c2cb5e2d6f535906c5d51fa71c7c2f0440f4fc781b89ae8bc8acfa747faa131cd98cceb7b')-b2sums_x86_64=('bbaec96fe7f0a26f30018e31f8ea8fef1d55e7a2f75ff6ce6972bfab2fa37b39a6d0c5c265b6e7e168797790c74e46758ad5822de9354ab4656263d571a0d840')-b2sums_aarch64=('1caa435d8681b7c4d6e11613c9bd853affc71e51e9750862f70b75ebdb72091b935c2d53406ec231172657d45f0139390d0a417ea09162a3538bdf92548baae0')+b2sums_x86_64=('5c16f99bddf827f16a0f872e30fcece09c9b4e2a65fc7512695fda7762defc819fb7129c7feb3d489968adb04b71c2040919c35c1f8f0926fc5714a85afb576e')+b2sums_aarch64=('da00aefa4b78be1f324c9c8cdb87d1381b204b0b8060240303fd0c3a9d1a7b73b821df9818655eb2cfd5b1a5b078db4907bf94c2195996b7116c0faec79189e5') # NOTE: z-code.sh hardcodes /opt/ZCode/zcode # If _installdir changes, the launcher script must also be updated.Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-04 00:25:23 | Low | 2 |
| 2026-11-03 00:01:00 | Low | 2 |
| 2026-11-02 00:26:00 | Low | 2 |
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 13:48:00 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 03:33:54 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |