zcode
LOW
maintainer duanluan
3 votes
scanned 2026-10-06 00:13:36.889724
Why flagged
The package downloads prebuilt .deb binaries from the project's own CDN (cdn-zcode.z.ai), which is plausibly official; the source is unverifiable but matches the project domain, and the checksums are provided, reducing risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb binaries from the project's own CDN (cdn-zcode.z.ai), which is plausibly official; the source is unverifiable but matches the project domain, and the checksums are provided, reducing risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: duanluan <duanluan@outlook.com>
2
3
pkgname=zcode
4
_pkgname=zcode
5
_appdir=ZCode
6
pkgver=3.14.3
7
pkgrel=2
8
pkgdesc='ZCode desktop app repackaged from official Linux release'
9
arch=('x86_64' 'aarch64')
10
url='https://zcode.z.ai/en'
11
license=('LicenseRef-Proprietary')
12
depends=(
13
'alsa-lib'
14
'at-spi2-core'
15
'gtk3'
16
'hicolor-icon-theme'
17
'libnotify'
18
'libsecret'
19
'libxss'
20
'libxtst'
21
'nss'
22
'util-linux-libs'
23
'xdg-utils'
24
)
25
optdepends=(
26
'libappindicator-gtk3: system tray indicator support'
27
)
28
makedepends=('libarchive')
29
provides=("zcode-desktop-bin=${pkgver}")
30
options=('!strip' '!lto')
31
install="${pkgname}.install"
32
source=('zcode.desktop')
33
source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
34
source_aarch64=("ZCode-${pkgver}-linux-arm64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb")
35
noextract=("ZCode-${pkgver}-linux-x64.deb" "ZCode-${pkgver}-linux-arm64.deb")
36
sha256sums=('510fb413274334e05901d65b28df618b1fb7216d690c136ab55173f9bf1a75e6')
37
sha256sums_x86_64=('8512fb78889686c7ecdc91a609a86e6b408255a10db0c9afba0d3e377b0b5b4f')
38
sha256sums_aarch64=('18263ced23563fd4c9afcaa6971da9541126d53c81f91f0bb28c938bd9efd477')
39
40
package() {
41
local _extractdir _deb_arch
42
43
_extractdir="$(mktemp -d)"
44
trap 'rm -rf "${_extractdir}"' EXIT
45
case "${CARCH}" in
46
x86_64) _deb_arch='x64' ;;
47
aarch64) _deb_arch='arm64' ;;
48
esac
49
50
bsdtar -C "${_extractdir}" -xf "${srcdir}/ZCode-${pkgver}-linux-${_deb_arch}.deb"
51
bsdtar -C "${_extractdir}" -xf "${_extractdir}/data.tar.xz"
52
53
install -dm755 \
54
"${pkgdir}/opt" \
55
"${pkgdir}/usr/bin" \
56
"${pkgdir}/usr/share"
57
58
cp -a "${_extractdir}/opt/${_appdir}" "${pkgdir}/opt/"
59
cp -a "${_extractdir}/usr/share/icons" "${pkgdir}/usr/share/"
60
61
install -Dm644 "${srcdir}/zcode.desktop" \
62
"${pkgdir}/usr/share/applications/${_pkgname}.desktop"
63
ln -s "/opt/${_appdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
64
65
chmod 0755 "${pkgdir}/opt/${_appdir}/chrome-sandbox"
66
67
install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSE.electron.txt" \
68
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
69
install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSES.chromium.html" \
70
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
71
72
if [[ -f "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" ]]; then
73
install -Dm644 "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" \
74
"${pkgdir}/usr/share/doc/${pkgname}/changelog.gz"
75
fi
76
}
77
Changes since previous scan
--- PKGBUILD @ 2026-09-23 00:28+++ PKGBUILD @ 2026-10-06 00:13@@ -3,7 +3,7 @@ pkgname=zcode _pkgname=zcode _appdir=ZCode-pkgver=3.14.0+pkgver=3.14.3 pkgrel=2 pkgdesc='ZCode desktop app repackaged from official Linux release' arch=('x86_64' 'aarch64')@@ -34,8 +34,8 @@ source_aarch64=("ZCode-${pkgver}-linux-arm64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb") noextract=("ZCode-${pkgver}-linux-x64.deb" "ZCode-${pkgver}-linux-arm64.deb") sha256sums=('510fb413274334e05901d65b28df618b1fb7216d690c136ab55173f9bf1a75e6')-sha256sums_x86_64=('ad1c7f76d40967de74d6a8738bb7a941ed350b78c4339daecff1c9942112842a')-sha256sums_aarch64=('a98f767484dbd0128dc1ce5d8fa9cd6e1db9a3c3f8b626aa9714872af816124d')+sha256sums_x86_64=('8512fb78889686c7ecdc91a609a86e6b408255a10db0c9afba0d3e377b0b5b4f')+sha256sums_aarch64=('18263ced23563fd4c9afcaa6971da9541126d53c81f91f0bb28c938bd9efd477') package() { local _extractdir _deb_archScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 05:39:25 | Medium | 1 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 07:37:25 | Medium | 1 |
| 2026-09-22 05:36:56 | Medium | 1 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 07:34:25 | Medium | 1 |
| 2026-09-21 00:26:32 | Low | 2 |