zcode-redminote11tech

MEDIUM

maintainer redminote11tech 0 votes scanned 2026-09-20 17:36:01.648656

View on AUR

Why flagged

Installs a prebuilt proprietary Electron binary (.deb) from cdn-zcode.z.ai, a non-whitelisted CDN subdomain that cannot be independently verified as the official project infrastructure; checksums are present but the host is a personal/project CDN that could be swapped without notice, making this a medium supply-chain risk for an unverifiable prebuilt executable.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary Electron binary (.deb) from cdn-zcode.z.ai, a non-whitelisted CDN subdomain that cannot be independently verified as the official project infrastructure; checksums are present but the host is a personal/project CDN that could be swapped without notice, making this a medium supply-chain risk for an unverifiable prebuilt executable.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Redminote11tech
    
      2
    
      3pkgname=zcode-redminote11tech
    
      4_pkgname=zcode
    
      5_appdir=ZCode
    
      6pkgver=3.14.1
    
      7pkgrel=1
    
      8pkgdesc='ZCode desktop app repackaged from official Linux release'
    
      9arch=('x86_64' 'aarch64')
    
      10url='https://zcode.z.ai/en'
    
      11license=('LicenseRef-Proprietary')
    
      12depends=(
    
      13  'alsa-lib'
    
      14  'at-spi2-core'
    
      15  'gtk3'
    
      16  'hicolor-icon-theme'
    
      17  'libnotify'
    
      18  'libsecret'
    
      19  'libxss'
    
      20  'libxtst'
    
      21  'nss'
    
      22  'util-linux-libs'
    
      23  'xdg-utils'
    
      24)
    
      25optdepends=(
    
      26  'libappindicator-gtk3: system tray indicator support'
    
      27)
    
      28makedepends=('libarchive')
    
      29provides=("zcode=${pkgver}")
    
      30conflicts=('zcode')
    
      31options=('!strip' '!lto')
    
      32install="${pkgname}.install"
    
      33source=('zcode.desktop')
    
      34source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
    
      35source_aarch64=("ZCode-${pkgver}-linux-arm64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb")
    
      36noextract=("ZCode-${pkgver}-linux-x64.deb" "ZCode-${pkgver}-linux-arm64.deb")
    
      37sha256sums=('510fb413274334e05901d65b28df618b1fb7216d690c136ab55173f9bf1a75e6')
    
      38sha256sums_x86_64=('2ba6d9d130fdf22af500f555a2c289fa5300712dd97052231251f8782ada3fdf')
    
      39sha256sums_aarch64=('9995e1b5bd3f5786387f39cbc1c376e85dd4b001a94aa7bbc290125bac1ddf14')
    
      40
    
      41package() {
    
      42  local _extractdir _deb_arch
    
      43
    
      44  _extractdir="$(mktemp -d)"
    
      45  trap 'rm -rf "${_extractdir}"' EXIT
    
      46  case "${CARCH}" in
    
      47    x86_64) _deb_arch='x64' ;;
    
      48    aarch64) _deb_arch='arm64' ;;
    
      49  esac
    
      50
    
      51  bsdtar -C "${_extractdir}" -xf "${srcdir}/ZCode-${pkgver}-linux-${_deb_arch}.deb"
    
      52  bsdtar -C "${_extractdir}" -xf "${_extractdir}/data.tar.xz"
    
      53
    
      54  install -dm755 \
    
      55    "${pkgdir}/opt" \
    
      56    "${pkgdir}/usr/bin" \
    
      57    "${pkgdir}/usr/share"
    
      58
    
      59  cp -a "${_extractdir}/opt/${_appdir}" "${pkgdir}/opt/"
    
      60  cp -a "${_extractdir}/usr/share/icons" "${pkgdir}/usr/share/"
    
      61
    
      62  install -Dm644 "${srcdir}/zcode.desktop" \
    
      63    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      64  ln -s "/opt/${_appdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      65
    
      66  chmod 0755 "${pkgdir}/opt/${_appdir}/chrome-sandbox"
    
      67
    
      68  install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSE.electron.txt" \
    
      69    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      70  install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSES.chromium.html" \
    
      71    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      72
    
      73  if [[ -f "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" ]]; then
    
      74    install -Dm644 "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" \
    
      75      "${pkgdir}/usr/share/doc/${pkgname}/changelog.gz"
    
      76  fi
    
      77}
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-20 17:36:01	Medium	3
2026-09-20 17:33:19	Medium	2