zed-i18n-bin

LOW

maintainer Alex3236 1 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package installs a prebuilt .deb from a GitHub release of a community-localized Zed editor; while the host is not whitelisted, the source is verifiable via checksum and the payload is a standard desktop application with no obfuscated or remote code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt .deb from a GitHub release of a community-localized Zed editor; while the host is not whitelisted, the source is verifiable via checksum and the payload is a standard desktop application with no obfuscated or remote code execution.

PKGBUILD

      1# Maintainer: Alex3236 <me@alex3236.moe>
    
      2
    
      3pkgname=zed-i18n-bin
    
      4pkgver=1.22.0+i18n.1
    
      5pkgrel=1
    
      6pkgdesc="Localized build of the Zed editor (community i18n release)"
    
      7arch=('x86_64')
    
      8url="https://github.com/LI-NA/zed-i18n"
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11    'alsa-lib'          # libasound.so.2
    
      12    'gcc-libs'          # libgcc_s.so.1, libstdc++.so.6
    
      13    'glib2'             # libgio-2.0, libglib-2.0, libgobject-2.0
    
      14    'glibc'
    
      15    'hicolor-icon-theme'
    
      16    'libx11'            # libX11-xcb.so.1
    
      17    'libxcb'
    
      18    'libxkbcommon'
    
      19    'libxkbcommon-x11'
    
      20    'vulkan-icd-loader' # dlopen'd by wgpu for GPU rendering
    
      21)
    
      22optdepends=(
    
      23    'git: Git integration'
    
      24    'vulkan-driver: GPU acceleration'
    
      25)
    
      26
    
      27# An alternative to the other Zed packages, not a companion: they all install
    
      28# the same editor, so only one may be present. The provided zed version is the
    
      29# upstream release this build is based on (pkgver minus the +i18n suffix).
    
      30provides=("zed=${pkgver%%+*}" 'zed-i18n')
    
      31conflicts=('zed' 'zed-bin' 'zed-git' 'zed-preview-bin' 'zed-i18n')
    
      32options=('!debug' '!strip')
    
      33
    
      34# Upstream tags are "v<zed version>-i18n.<n>" while the deb (and hence pkgver)
    
      35# uses "1.22.0+i18n.1", matching the deb's control Version field.
    
      36_tag="v${pkgver/+i18n./-i18n.}"
    
      37
    
      38source=("${pkgname}-${pkgver}.deb::https://github.com/LI-NA/zed-i18n/releases/download/${_tag}/zed-i18n-linux-x86_64.deb")
    
      39sha256sums=('5116eb38758937b6c4e8f96e5064dc107458bf619744b1b0dcb4d8d737c1ee12')
    
      40
    
      41package() {
    
      42    cd "$srcdir"
    
      43
    
      44    # .deb is an ar archive holding control.tar.gz and data.tar.xz
    
      45    rm -rf root
    
      46    mkdir root
    
      47    bsdtar -xf "${pkgname}-${pkgver}.deb" -C root
    
      48    bsdtar -xf root/data.tar.xz -C "$pkgdir"
    
      49
    
      50    # Upstream bundles nine shared libraries which RPATH ($ORIGIN/../lib) loads
    
      51    # in preference to the system copies. All of them exist in the repos and the
    
      52    # binary only needs GLIBC <= 2.30 / GLIBCXX <= 3.4.29, so drop them: the
    
      53    # bundled libxkbcommon is built against older X11 protocol headers, lacks
    
      54    # the dead_hamza keysym and fails to parse the system Compose file.
    
      55    rm -rf "$pkgdir/usr/lib/zed-i18n/lib"
    
      56
    
      57    # Arch's name for Zed's CLI is zeditor, because /usr/bin/zed belongs to
    
      58    # zfs-utils (ZED, the ZFS Event Daemon).
    
      59    mv "$pkgdir/usr/bin/zed-i18n" "$pkgdir/usr/bin/zeditor"
    
      60
    
      61    # The launcher is written for a dpkg install: it blocks upstream's bundled
    
      62    # install.sh uninstaller and disables in-app updates. Keep that logic, but
    
      63    # correct the distro-specific user-visible strings for Arch.
    
      64    sed -i \
    
      65        -e 's|sudo apt remove zed-i18n|sudo pacman -R zed-i18n-bin|' \
    
      66        -e 's|This Zed i18n build was installed as a Debian package\.|This Zed i18n build was installed as an Arch package.|' \
    
      67        -e 's|Zed i18n was installed as a Debian package\. Download the latest package from https://github.com/LI-NA/zed-i18n/releases/latest to update\.|Zed i18n was installed as an Arch package. Update it with pacman -Syu or your AUR helper.|' \
    
      68        "$pkgdir/usr/bin/zeditor"
    
      69
    
      70    # Point the menu entry at the installed command name. The icon name stays as
    
      71    # shipped, since the window's app_id is dev.zed-i18n.Zed and a matching
    
      72    # desktop file name is what associates the two.
    
      73    sed -i \
    
      74        -e 's|^Exec=zed-i18n|Exec=zeditor|' \
    
      75        -e 's|^TryExec=zed-i18n|TryExec=zeditor|' \
    
      76        "$pkgdir/usr/share/applications/dev.zed-i18n.Zed.desktop"
    
      77}
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	Low	2