zcode

MEDIUM

maintainer duanluan 0 votes scanned 2026-08-21 21:19:14.007822

View on AUR

Why flagged

Downloads and installs a prebuilt proprietary Electron binary (.deb) from cdn-zcode.z.ai, a non-whitelisted CDN that could be swapped; however, SHA256 checksums are provided and the host appears to be the project's own official CDN (matching the project URL domain z.ai), reducing but not eliminating supply-chain risk for an unverifiable closed-source binary.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and installs a prebuilt proprietary Electron binary (.deb) from cdn-zcode.z.ai, a non-whitelisted CDN that could be swapped; however, SHA256 checksums are provided and the host appears to be the project's own official CDN (matching the project URL domain z.ai), reducing but not eliminating supply-chain risk for an unverifiable closed-source binary.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=zcode
    
      4_pkgname=zcode
    
      5_appdir=ZCode
    
      6pkgver=3.8.1
    
      7pkgrel=1
    
      8pkgdesc='ZCode desktop app repackaged from official Linux release'
    
      9arch=('x86_64' 'aarch64')
    
      10url='https://zcode.z.ai/en'
    
      11license=('LicenseRef-Proprietary')
    
      12depends=(
    
      13  'alsa-lib'
    
      14  'at-spi2-core'
    
      15  'gtk3'
    
      16  'hicolor-icon-theme'
    
      17  'libnotify'
    
      18  'libsecret'
    
      19  'libxss'
    
      20  'libxtst'
    
      21  'nss'
    
      22  'util-linux-libs'
    
      23  'xdg-utils'
    
      24)
    
      25optdepends=(
    
      26  'libappindicator-gtk3: system tray indicator support'
    
      27)
    
      28makedepends=('libarchive')
    
      29provides=("zcode-desktop-bin=${pkgver}")
    
      30options=('!strip' '!lto')
    
      31install="${pkgname}.install"
    
      32source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
    
      33source_aarch64=("ZCode-${pkgver}-linux-arm64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb")
    
      34noextract=("ZCode-${pkgver}-linux-x64.deb" "ZCode-${pkgver}-linux-arm64.deb")
    
      35sha256sums_x86_64=('5871877629eb56f608251a95efa92bf8c2ae0645e3d67ae0dcb5c02121e45575')
    
      36sha256sums_aarch64=('bedfeb45f87ec6cfd0257b5416c30bc94397e6c7d3c82d39da08c379a8b76569')
    
      37
    
      38package() {
    
      39  local _extractdir _deb_arch
    
      40
    
      41  _extractdir="$(mktemp -d)"
    
      42  trap 'rm -rf "${_extractdir}"' EXIT
    
      43  case "${CARCH}" in
    
      44    x86_64) _deb_arch='x64' ;;
    
      45    aarch64) _deb_arch='arm64' ;;
    
      46  esac
    
      47
    
      48  bsdtar -C "${_extractdir}" -xf "${srcdir}/ZCode-${pkgver}-linux-${_deb_arch}.deb"
    
      49  bsdtar -C "${_extractdir}" -xf "${_extractdir}/data.tar.xz"
    
      50
    
      51  install -dm755 \
    
      52    "${pkgdir}/opt" \
    
      53    "${pkgdir}/usr/bin" \
    
      54    "${pkgdir}/usr/share"
    
      55
    
      56  cp -a "${_extractdir}/opt/${_appdir}" "${pkgdir}/opt/"
    
      57  cp -a "${_extractdir}/usr/share/icons" "${pkgdir}/usr/share/"
    
      58
    
      59  install -Dm644 "${_extractdir}/usr/share/applications/${_pkgname}.desktop" \
    
      60    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      61  ln -s "/opt/${_appdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      62
    
      63  chmod 0755 "${pkgdir}/opt/${_appdir}/chrome-sandbox"
    
      64
    
      65  install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSE.electron.txt" \
    
      66    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      67  install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSES.chromium.html" \
    
      68    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      69
    
      70  if [[ -f "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" ]]; then
    
      71    install -Dm644 "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" \
    
      72      "${pkgdir}/usr/share/doc/${pkgname}/changelog.gz"
    
      73  fi
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 21:19:14	Medium	3
2026-08-21 21:15:20	Medium	2