z-code-bin

maintainer czyt · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt .deb binaries from the project's own CDN (cdn-zcode.z.ai), which is plausibly official; the source is not obfuscated, and the build process only extracts and installs files with standard permissions, posing no active code execution or redirection risk beyond the trustworthiness of the vendor's release artifacts.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb binaries from the project's own CDN (cdn-zcode.z.ai), which is plausibly official; the source is not obfuscated, and the build process only extracts and installs files with standard permissions, posing no active code execution or redirection risk beyond the trustworthiness of the vendor's release artifacts.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source_x86_64=("${pkgname}-${pkgver}-amd64::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=z-code-bin
    
      3pkgver=3.5.2
    
      4pkgrel=1
    
      5pkgdesc="ZCode - AI Agents combined with existing toolchains for planning, coding, review and deployment"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://zcode.z.ai"
    
      8license=('custom')
    
      9depends=(
    
      10  'gtk3'
    
      11  'libnotify'
    
      12  'nss'
    
      13  'libxss'
    
      14  'libxtst'
    
      15  'xdg-utils'
    
      16  'at-spi2-core'
    
      17  'util-linux'
    
      18  'libsecret'
    
      19)
    
      20optdepends=(
    
      21  'libappindicator-gtk3: for system tray icon support'
    
      22)
    
      23provides=('zcode')
    
      24conflicts=('zcode' 'zcode-bin' 'zcode-desktop-bin')
    
      25options=('!strip' '!debug')
    
      26source_x86_64=("${pkgname}-${pkgver}-amd64::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
    
      27source_aarch64=("${pkgname}-${pkgver}-arm64::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb")
    
      28sha256sums_x86_64=('00c2b3b83fb3c99dcd98d2db78f45bb3dedbc4d415c19874f5d982bc503b5ee1')
    
      29sha256sums_aarch64=('a478cdcd7924e550c799fe6a3f89cc1ae0559be5df6d5f732292266ff2771e24')
    
      30
    
      31package() {
    
      32  # Extract files from the .deb package.
    
      33  case "$CARCH" in
    
      34    x86_64)  _src="${pkgname}-${pkgver}-amd64" ;;
    
      35    aarch64) _src="${pkgname}-${pkgver}-arm64" ;;
    
      36  esac
    
      37
    
      38  bsdtar -O -xf "${srcdir}/${_src}" data.tar.xz | bsdtar -C "${pkgdir}" -xJf -
    
      39
    
      40  # Fix permissions
    
      41  chmod -R u=rwX,go=rX "${pkgdir}/opt/ZCode"
    
      42}
    
      43

Changes since previous scan

--- PKGBUILD @ 2026-07-26 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=z-code-bin
-pkgver=3.4.2
+pkgver=3.5.2
 pkgrel=1
 pkgdesc="ZCode - AI Agents combined with existing toolchains for planning, coding, review and deployment"
 arch=('x86_64' 'aarch64')
@@ -25,8 +25,8 @@
 options=('!strip' '!debug')
 source_x86_64=("${pkgname}-${pkgver}-amd64::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
 source_aarch64=("${pkgname}-${pkgver}-arm64::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb")
-sha256sums_x86_64=('b626427d9808d718967a03d1d2404872def0ac1b0c515240af16921c24d4f5c1')
-sha256sums_aarch64=('212c6fdf46330493b20f42cbe30982d90ce2f0469d54d894dea46254709725c0')
+sha256sums_x86_64=('00c2b3b83fb3c99dcd98d2db78f45bb3dedbc4d415c19874f5d982bc503b5ee1')
+sha256sums_aarch64=('a478cdcd7924e550c799fe6a3f89cc1ae0559be5df6d5f732292266ff2771e24')
 
 package() {
   # Extract files from the .deb package.

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 03:37:00	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 03:31:41	MEDIUM	1
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 15:20:42	MEDIUM	1
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 03:15:42	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2