zls0.11-bin
maintainer vitaliikuzhdin
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads prebuilt binaries from the project's own official build domain (zigtools.org), which hosts the legitimate ZLS release artifacts; although the minisig checksum is skipped, the source is not from a swappable or untrusted host like a personal file locker, and the project maintains control over its release infrastructure, making the supply-chain risk low.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's own official build domain (zigtools.org), which hosts the legitimate ZLS release artifacts; although the minisig checksum is skipped, the source is not from a swappable or untrusted host like a personal file locker, and the project maintains control over its release infrastructure, making the supply-chain risk low.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:35
source_aarch64=("https://builds.zigtools.org/${_basename}-linux-aarch64-${pkgver}.tar.xz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
2
3
_basename="zls"
4
pkgver=0.11.0
5
_pkgver="${pkgver%.*}"
6
pkgrel=2
7
8
_pkgname="${_basename}${_pkgver}"
9
pkgname="${_pkgname}-bin"
10
pkgdesc="A language server for Zig"
11
arch=(
12
'aarch64'
13
# 'armv7h'
14
'i686'
15
# 'powerpc64le'
16
# 'riscv64'
17
'x86_64'
18
)
19
url="https://zigtools.org/zls"
20
license=('MIT')
21
depends=(
22
'sh'
23
"zig${_pkgver}"
24
)
25
makedepends=(
26
'minisign'
27
)
28
provides=(
29
"${_pkgname}"
30
)
31
conflicts=(
32
"${_pkgname}"
33
)
34
source=("${_basename}-versioned.sh")
35
source_aarch64=("https://builds.zigtools.org/${_basename}-linux-aarch64-${pkgver}.tar.xz"
36
"https://builds.zigtools.org/${_basename}-linux-aarch64-${pkgver}.tar.xz.minisig")
37
# source_armv7h=("https://builds.zigtools.org/${_basename}-linux-armv7a-${pkgver}.tar.xz"
38
# "https://builds.zigtools.org/${_basename}-linux-armv7a-${pkgver}.tar.xz.minisig")
39
source_i686=("https://builds.zigtools.org/${_basename}-linux-x86-${pkgver}.tar.xz"
40
"https://builds.zigtools.org/${_basename}-linux-x86-${pkgver}.tar.xz.minisig")
41
# source_powerpc64le=("https://builds.zigtools.org/${_basename}-linux-powerpc64le-${pkgver}.tar.xz"
42
# "https://builds.zigtools.org/${_basename}-linux-powerpc64le-${pkgver}.tar.xz.minisig")
43
# source_riscv64=("https://builds.zigtools.org/${_basename}-linux-riscv64-${pkgver}.tar.xz"
44
# "https://builds.zigtools.org/${_basename}-linux-riscv64-${pkgver}.tar.xz.minisig")
45
source_x86_64=("https://builds.zigtools.org/${_basename}-linux-x86_64-${pkgver}.tar.xz"
46
"https://builds.zigtools.org/${_basename}-linux-x86_64-${pkgver}.tar.xz.minisig")
47
sha256sums=('b9e70d344290a58c6e8199a22232fbd2a8789cf76ddf0574f0a4ea647299ea68')
48
sha256sums_aarch64=('43184d2d324b27d2f18b72818676b367e6633264a0f4d74d1249b8a0824d1e1c'
49
'SKIP')
50
sha256sums_i686=('580e8de3980778dc77aa0a77fb60efc0c71a17e12987f43379b326fc4c5dcf6c'
51
'SKIP')
52
sha256sums_x86_64=('bd65d0cd79e83395b98035991b100821589b07ed8716fb2a44b1e234c9167f3f'
53
'SKIP')
54
55
if [ "${CARCH}" = 'aarch64' ]; then _arch=aarch64;
56
elif [ "${CARCH}" = 'armv7h' ]; then _arch=armv7a;
57
elif [ "${CARCH}" = 'i686' ]; then _arch=x86;
58
elif [ "${CARCH}" = 'powerpc64le' ]; then _arch=powerpc64le;
59
elif [ "${CARCH}" = 'riscv64' ]; then _arch=riscv64;
60
elif [ "${CARCH}" = 'x86_64' ]; then _arch=x86_64;
61
else _arch=DUMMY;
62
fi
63
64
verify() {
65
# https://zigtools.org/zls/releases/0.11.0/
66
local zls_minisign="RWR+9B91GBZ0zOjh6Lr17+zKf5BoSuFvrx2xSeDE57uIYvnKBGmMjOex"
67
68
minisign -V \
69
-P "${zls_minisign}" \
70
-m "${_basename}-linux-${_arch}-${pkgver}.tar.xz"
71
}
72
73
prepare() {
74
cd "${srcdir}"
75
sed -e "s|@@ZIG_PATH@@|/opt/zig${_pkgver}|g" \
76
-e "s|@@ZLS_PATH@@|/usr/lib/${_pkgname}|g" \
77
-i "${_basename}-versioned.sh"
78
}
79
80
package() {
81
cd "${srcdir}"
82
install -vDm755 "${_basename}-versioned.sh" "${pkgdir}/usr/bin/${_pkgname}"
83
install -vDm755 "${_basename}" "${pkgdir}/usr/lib/${_pkgname}/${_basename}"
84
install -vDm644 "README.md" "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
85
install -vDm644 "LICENSE" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
86
}
87
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |