zls-master

maintainer vitaliikuzhdin · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The prepare() function queries releases.zigtools.org to determine which git commit of the already-cloned ZLS repository to check out. This is the official ZLS tooling infrastructure (zigtools.org is the upstream project's own domain). Critically, no binary or executable code is downloaded from this endpoint — only a JSON response containing a version string/commit hash. The actual source code being built comes from the GitHub repository (github.com/zigtools/zls) which is in the source array with a git+https URL. The curl call only influences which git commit is checked out within the already-cloned repo. If releases.zigtools.org were compromised, an attacker could redirect the build to a different commit hash, but that commit would still need to exist in the legitimate GitHub repository — it cannot inject arbitrary code. This is a non-standard pattern (dynamic version selection outside the source array) and slightly sloppy from a reproducibility standpoint, but the security impact is low since no untrusted executable content is fetched or executed directly from that host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The prepare() function queries releases.zigtools.org to determine which git commit of the already-cloned ZLS repository to check out. This is the official ZLS tooling infrastructure (zigtools.org is the upstream project's own domain). Critically, no binary or executable code is downloaded from this endpoint — only a JSON response containing a version string/commit hash. The actual source code being built comes from the GitHub repository (github.com/zigtools/zls) which is in the source array with a git+https URL. The curl call only influences which git commit is checked out within the already-cloned repo. If releases.zigtools.org were compromised, an attacker could redirect the build to a different commit hash, but that commit would still need to exist in the legitimate GitHub repository — it cannot inject arbitrary code. This is a non-standard pattern (dynamic version selection outside the source array) and slightly sloppy from a reproducibility standpoint, but the security impact is low since no untrusted executable content is fetched or executed directly from that host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:42 local index_json="$(curl -s "https://releases.zigtools.org/v1/zls/select-version?zig_version=${zig_version}&compatibility=full")"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_basename="zls"
    
      4pkgname="${_basename}-master"
    
      5pkgver=0.17.0dev.38+ae3ab43c
    
      6pkgrel=1
    
      7pkgdesc="A language server for Zig"
    
      8arch=(
    
      9  'aarch64'     # 'aarch64'
    
      10  'armv7h'      # 'arm'
    
      11  'loong64'     # 'loongarch64'
    
      12  'powerpc64le' # 'powerpc64le'
    
      13  'riscv64'     # 'riscv64'
    
      14  # 's390x'       # 's390x'
    
      15  'i686'        # 'x86'
    
      16  'x86_64'      # 'x86_64'
    
      17)
    
      18url="https://zigtools.org/zls"
    
      19_url="https://github.com/zigtools/${_basename}"
    
      20license=(
    
      21  'MIT'
    
      22)
    
      23depends=(
    
      24  'sh'
    
      25  'zig-master'
    
      26)
    
      27makedepends=(
    
      28  'curl'
    
      29  'git'
    
      30  'jq'
    
      31)
    
      32_pkgsrc="${_url##*/}"
    
      33source=(
    
      34  "${_pkgsrc}::git+${_url}.git"
    
      35  "${_basename}-versioned.sh"
    
      36)
    
      37sha256sums=('SKIP'
    
      38            'b9e70d344290a58c6e8199a22232fbd2a8789cf76ddf0574f0a4ea647299ea68')
    
      39
    
      40prepare() {
    
      41  local zig_version="$(zig-master version | tr -d '\n' | jq -sRr @uri)"
    
      42  local index_json="$(curl -s "https://releases.zigtools.org/v1/zls/select-version?zig_version=${zig_version}&compatibility=full")"
    
      43  local zls_version="$(jq -r '."version"' <<< "${index_json}")"
    
      44  local zls_commit="${zls_version##*+}"
    
      45  
    
      46  cd "${srcdir}"
    
      47  sed -e "s|@@ZIG_PATH@@|/opt/zig-master|g" \
    
      48      -e "s|@@ZLS_PATH@@|/usr/lib/${pkgname}|g" \
    
      49      -i "${_basename}-versioned.sh"
    
      50
    
      51  cd "${_pkgsrc}"
    
      52  git -c advice.detachedHead=false checkout "${zls_commit}"
    
      53
    
      54  # grep -oP '(?<=\.url = ")[^"]+' build.zig.zon | while read -r zig_fetch_url; do
    
      55  #   zig-master fetch --global-cache-dir "${srcdir}/zig-global-cache" "${zig_fetch_url}"
    
      56  # done
    
      57}
    
      58
    
      59pkgver() {
    
      60  cd "${srcdir}/${_pkgsrc}"
    
      61  local build_version build_version_normalized
    
      62  local git_describe git_describe_tail git_describe_normalized
    
      63
    
      64  # 0.16.0-dev
    
      65  build_version="$(grep -Po '(?<=\.version = ")[^"]+' build.zig.zon)"
    
      66  # 0.16.0dev
    
      67  build_version_normalized="${build_version//-/}"
    
      68  # 0.16.0 OR 0.15.0-3-g1840a4b8
    
      69  git_describe="$(git describe --match "*.*.*" --tags)"
    
      70
    
      71  case "$git_describe" in
    
      72    *-*-g*)
    
      73      # 3-g1840a4b8
    
      74      git_describe_tail="${git_describe#*-}"
    
      75      # 3+1840a4b8
    
      76      git_describe_normalized="${git_describe_tail//-g/+}"
    
      77      # 0.16.0dev.3+1840a4b8
    
      78      printf '%s.%s' "$build_version_normalized" "$git_describe_normalized"
    
      79      ;;
    
      80    *)
    
      81      # Tagged release: 0.16.0
    
      82      printf '%s' "$git_describe"
    
      83      ;;
    
      84  esac
    
      85}
    
      86
    
      87build() {
    
      88  local zig_options=(
    
      89    --summary all
    
      90    --prefix /usr
    
      91    --search-prefix /usr
    
      92    --global-cache-dir "${srcdir}/zig-global-cache"
    
      93    # --system "${srcdir}/zig-global-cache/p"
    
      94    --verbose
    
      95    -Dtarget=native-linux.6.15-gnu.2.41
    
      96    -Dcpu=baseline
    
      97    -Doptimize=ReleaseSafe
    
      98    -Dpie=true
    
      99  )
    
      100
    
      101  cd "${srcdir}/${_pkgsrc}"
    
      102  DESTDIR="build" zig-master build "${zig_options[@]}"
    
      103}
    
      104
    
      105# check() {
    
      106#   export PATH="/opt/zig-master:$PATH"
    
      107#   local zig_options=(
    
      108#     --summary all
    
      109#     --prefix /usr
    
      110#     --search-prefix /usr
    
      111#     --global-cache-dir "${srcdir}/zig-global-cache"
    
      112#     # --system "${srcdir}/zig-global-cache/p"
    
      113#     --verbose
    
      114#     -Dtarget=native-linux.6.15-gnu.2.41
    
      115#     -Dcpu=baseline
    
      116#     -Doptimize=ReleaseSafe
    
      117#     -Dpie=true
    
      118#   )
    
      119# 
    
      120#   cd "${srcdir}/${_pkgsrc}"
    
      121#   DESTDIR="check" zig-master build test "${zig_options[@]}"
    
      122# }
    
      123
    
      124package() {
    
      125  cd "${srcdir}"
    
      126  install -vDm755 "${_basename}-versioned.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      127
    
      128  cd "${_pkgsrc}"
    
      129  install -vDm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      130  install -vDm644 "LICENSE"   "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      131
    
      132  cd "build/usr/bin"
    
      133  install -vDm755 "${_basename}" "${pkgdir}/usr/lib/${pkgname}/${_basename}"
    
      134}
    
      135

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2