zcode-redminote11tech
LOW
maintainer redminote11tech
0 votes
scanned 2026-11-04 00:25:23.536954
Why flagged
The package downloads prebuilt .deb files from the project's own CDN (cdn-zcode.z.ai), which is plausibly official; the source is not executed remotely, and the build process unpacks and installs the official binary, posing minimal supply-chain risk given checksum verification.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb files from the project's own CDN (cdn-zcode.z.ai), which is plausibly official; the source is not executed remotely, and the build process unpacks and installs the official binary, posing minimal supply-chain risk given checksum verification.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:34
source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Redminote11tech
2
3
pkgname=zcode-redminote11tech
4
_pkgname=zcode
5
_appdir=ZCode
6
pkgver=3.17.1
7
pkgrel=1
8
pkgdesc='ZCode desktop app repackaged from official Linux release'
9
arch=('x86_64' 'aarch64')
10
url='https://zcode.z.ai/en'
11
license=('LicenseRef-Proprietary')
12
depends=(
13
'alsa-lib'
14
'at-spi2-core'
15
'gtk3'
16
'hicolor-icon-theme'
17
'libnotify'
18
'libsecret'
19
'libxss'
20
'libxtst'
21
'nss'
22
'util-linux-libs'
23
'xdg-utils'
24
)
25
optdepends=(
26
'libappindicator-gtk3: system tray indicator support'
27
)
28
makedepends=('libarchive')
29
provides=("zcode=${pkgver}")
30
conflicts=('zcode')
31
options=('!strip' '!lto')
32
install="${pkgname}.install"
33
source=('zcode.desktop')
34
source_x86_64=("ZCode-${pkgver}-linux-x64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-x64/ZCode-${pkgver}-linux-x64.deb")
35
source_aarch64=("ZCode-${pkgver}-linux-arm64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb")
36
noextract=("ZCode-${pkgver}-linux-x64.deb" "ZCode-${pkgver}-linux-arm64.deb")
37
sha256sums=('510fb413274334e05901d65b28df618b1fb7216d690c136ab55173f9bf1a75e6')
38
sha256sums_x86_64=('7982be1f37e9dbaed619c802d1a344b050d526bba30c7846be8c224b8306e5f1')
39
sha256sums_aarch64=('57cacf9b2cbd979081b6c517f356d079821402aca393691f0e600ddb68834e43')
40
41
package() {
42
local _extractdir _deb_arch
43
44
_extractdir="$(mktemp -d)"
45
trap 'rm -rf "${_extractdir}"' EXIT
46
case "${CARCH}" in
47
x86_64) _deb_arch='x64' ;;
48
aarch64) _deb_arch='arm64' ;;
49
esac
50
51
bsdtar -C "${_extractdir}" -xf "${srcdir}/ZCode-${pkgver}-linux-${_deb_arch}.deb"
52
bsdtar -C "${_extractdir}" -xf "${_extractdir}/data.tar.xz"
53
54
install -dm755 \
55
"${pkgdir}/opt" \
56
"${pkgdir}/usr/bin" \
57
"${pkgdir}/usr/share"
58
59
cp -a "${_extractdir}/opt/${_appdir}" "${pkgdir}/opt/"
60
cp -a "${_extractdir}/usr/share/icons" "${pkgdir}/usr/share/"
61
62
install -Dm644 "${srcdir}/zcode.desktop" \
63
"${pkgdir}/usr/share/applications/${_pkgname}.desktop"
64
ln -s "/opt/${_appdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
65
66
chmod 0755 "${pkgdir}/opt/${_appdir}/chrome-sandbox"
67
68
install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSE.electron.txt" \
69
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
70
install -Dm644 "${_extractdir}/opt/${_appdir}/LICENSES.chromium.html" \
71
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
72
73
if [[ -f "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" ]]; then
74
install -Dm644 "${_extractdir}/usr/share/doc/${_pkgname}/changelog.gz" \
75
"${pkgdir}/usr/share/doc/${pkgname}/changelog.gz"
76
fi
77
}
78
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-04 00:25@@ -3,7 +3,7 @@ pkgname=zcode-redminote11tech _pkgname=zcode _appdir=ZCode-pkgver=3.16.3+pkgver=3.17.1 pkgrel=1 pkgdesc='ZCode desktop app repackaged from official Linux release' arch=('x86_64' 'aarch64')@@ -35,8 +35,8 @@ source_aarch64=("ZCode-${pkgver}-linux-arm64.deb::https://cdn-zcode.z.ai/zcode/electron/releases/${pkgver}/linux-arm64/ZCode-${pkgver}-linux-arm64.deb") noextract=("ZCode-${pkgver}-linux-x64.deb" "ZCode-${pkgver}-linux-arm64.deb") sha256sums=('510fb413274334e05901d65b28df618b1fb7216d690c136ab55173f9bf1a75e6')-sha256sums_x86_64=('128132b195977fd0a8c8a6c295cf42fe159222d7a5c5efefd8b5f00ef88ab8b6')-sha256sums_aarch64=('338e91013125ee49f665f1dc3a07af09518b05f53f9a5a359de4572009c660e2')+sha256sums_x86_64=('7982be1f37e9dbaed619c802d1a344b050d526bba30c7846be8c224b8306e5f1')+sha256sums_aarch64=('57cacf9b2cbd979081b6c517f356d079821402aca393691f0e600ddb68834e43') package() { local _extractdir _deb_archScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-04 00:25:23 | Low | 2 |
| 2026-11-03 00:01:00 | Low | 2 |
| 2026-11-02 22:03:11 | Medium | 1 |
| 2026-11-02 00:26:00 | Low | 2 |
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 23:54:04 | Medium | 1 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 05:36:55 | Medium | 1 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 15:25:12 | Medium | 1 |