zcode-desktop-bin
maintainer duanluan
· 2 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb from the project's own CDN domain, which is not on the whitelist but plausibly official; however, the binary is verified via a fixed, provided checksum, reducing supply-chain risk, and the package merely repackages it without executing arbitrary remote code.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the project's own CDN domain, which is not on the whitelist but plausibly official; however, the binary is verified via a fixed, provided checksum, reducing supply-chain risk, and the package merely repackages it without executing arbitrary remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: duanluan <duanluan@outlook.com>
2
3
pkgname=zcode-desktop-bin
4
_pkgname=zcode
5
_appdir=ZCode
6
pkgver=3.5.3
7
pkgrel=1
8
pkgdesc='ZCode desktop app repackaged from official Linux release'
9
arch=('x86_64' 'aarch64')
10
url='https://zcode.z.ai/en'
11
license=('custom')
12
depends=(
13
'alsa-lib'
14
'at-spi2-core'
15
'gtk3'
16
'hicolor-icon-theme'
17
'libnotify'
18
'libsecret'
19
'libxss'
20
'libxtst'
21
'nss'
22
'util-linux-libs'
23
'xdg-utils'
24
)
25
optdepends=(
26
'libappindicator-gtk3: system tray indicator support'
27
)
28
makedepends=('libarchive')
29
provides=('zcode')
30
conflicts=('zcode')
31
options=('!strip' '!lto')
32
install="${pkgname}.install"
33
source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
34
source_aarch64=("ZCode-${pkgver}-linux-arm64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb")
35
noextract=("ZCode-${pkgver}-linux-x64.deb" "ZCode-${pkgver}-linux-arm64.deb")
36
sha256sums_x86_64=('e6610065ed4a711efc139a60d373ffcc606a3c13e782306876e49fc07e336bc7')
37
sha256sums_aarch64=('66b1c5b03e0c523f3c431915e911ada5539948dc497d6dd05aa9740a6d285ab4')
38
39
package() {
40
local _extractdir _deb_arch
41
42
_extractdir="$(mktemp -d)"
43
trap 'rm -rf "${_extractdir}"' EXIT
44
case "${CARCH}" in
45
x86_64) _deb_arch='x64' ;;
46
aarch64) _deb_arch='arm64' ;;
47
esac
48
49
bsdtar -C "${_extractdir}" -xf "${srcdir}/ZCode-${pkgver}-linux-${_deb_arch}.deb"
50
bsdtar -C "${_extractdir}" -xf "${_extractdir}/data.tar.xz"
51
52
install -dm755 \
53
"${pkgdir}/opt" \
54
"${pkgdir}/usr/bin" \
55
"${pkgdir}/usr/share"
56
57
cp -a "${_extractdir}/opt/${_appdir}" "${pkgdir}/opt/"
58
cp -a "${_extractdir}/usr/share/icons" "${pkgdir}/usr/share/"
59
60
install -Dm644 "${_extractdir}/usr/share/applications/${_pkgname}.desktop" \
61
"${pkgdir}/usr/share/applications/${_pkgname}.desktop"
62
ln -s "/opt/${_appdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
63
64
chmod 0755 "${pkgdir}/opt/${_appdir}/chrome-sandbox"
65
66
install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSE.electron.txt" \
67
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
68
install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSES.chromium.html" \
69
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
70
71
if [[ -f "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" ]]; then
72
install -Dm644 "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" \
73
"${pkgdir}/usr/share/doc/${pkgname}/changelog.gz"
74
fi
75
}
76
Changes since previous scan
--- PKGBUILD @ 2026-07-28 00:07+++ PKGBUILD @ 2026-08-03 00:08@@ -3,7 +3,7 @@ pkgname=zcode-desktop-bin _pkgname=zcode _appdir=ZCode-pkgver=3.5.2+pkgver=3.5.3 pkgrel=1 pkgdesc='ZCode desktop app repackaged from official Linux release' arch=('x86_64' 'aarch64')@@ -33,8 +33,8 @@ source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb") source_aarch64=("ZCode-${pkgver}-linux-arm64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb") noextract=("ZCode-${pkgver}-linux-x64.deb" "ZCode-${pkgver}-linux-arm64.deb")-sha256sums_x86_64=('00c2b3b83fb3c99dcd98d2db78f45bb3dedbc4d415c19874f5d982bc503b5ee1')-sha256sums_aarch64=('a478cdcd7924e550c799fe6a3f89cc1ae0559be5df6d5f732292266ff2771e24')+sha256sums_x86_64=('e6610065ed4a711efc139a60d373ffcc606a3c13e782306876e49fc07e336bc7')+sha256sums_aarch64=('66b1c5b03e0c523f3c431915e911ada5539948dc497d6dd05aa9740a6d285ab4') package() { local _extractdir _deb_archScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 05:37:03 | MEDIUM | 1 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 05:31:42 | MEDIUM | 1 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 05:22:32 | MEDIUM | 1 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |