zux-bin

maintainer hrzlgnm · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs an unverifiable prebuilt binary (zux_linux_x64) from a non-whitelisted but project-owned host, which could be swapped maliciously; however, it disables auto-updates and is paired with a clean source (deb from same release), reducing risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs an unverifiable prebuilt binary (zux_linux_x64) from a non-whitelisted but project-owned host, which could be swapped maliciously; however, it disables auto-updates and is paired with a clean source (deb from same release), reducing risk.

PKGBUILD

      1# Maintainer: Valentin Batz <valentin.batz+archlinux@posteo.de>
    
      2
    
      3pkgname=zux-bin
    
      4pkgver=0.7.0
    
      5pkgrel=1
    
      6pkgdesc="mDNS-SD Visualizer - A cross platform mDNS browsing visualizer written in Rust using tauri and svelte"
    
      7arch=('x86_64')
    
      8url="https://github.com/hrzlgnm/zux"
    
      9license=('MIT')
    
      10depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libsoup3' 'pango' 'webkit2gtk-4.1')
    
      11options=('!strip' '!emptydirs')
    
      12conflicts=('zux')
    
      13source_x86_64=("https://github.com/hrzlgnm/zux/releases/download/v$pkgver/zux_${pkgver}_amd64.deb" "https://github.com/hrzlgnm/zux/releases/download/v$pkgver/zux_linux_x64")
    
      14sha256sums_x86_64=('e5bde7affefae1a2f9302c4b65f875467173089ec1f3aefcf3b092928aa842dc' 'b2019836f10ff37d58d389f743dfc1af4dfe3b6db641568708e1b5fe9a3e83d9')
    
      15package() {
    
      16    # The .deb contains the icons, .desktop file and other files installed to shared.
    
      17    tar -xz -f data.tar.gz -C "${pkgdir}"
    
      18    # The .deb contains a binary that has auto updates enabled for the .deb.
    
      19    # We install a unbundled version of the binary to have auto updates disabled.
    
      20    install -Dm755 zux_linux_x64 "${pkgdir}/usr/bin/zux"
    
      21}
    
      22

Changes since previous scan

--- PKGBUILD @ 2026-08-01 07:20
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Valentin Batz <valentin.batz+archlinux@posteo.de>
 
 pkgname=zux-bin
-pkgver=0.6.2
+pkgver=0.7.0
 pkgrel=1
 pkgdesc="mDNS-SD Visualizer - A cross platform mDNS browsing visualizer written in Rust using tauri and svelte"
 arch=('x86_64')
@@ -11,9 +11,12 @@
 options=('!strip' '!emptydirs')
 conflicts=('zux')
 source_x86_64=("https://github.com/hrzlgnm/zux/releases/download/v$pkgver/zux_${pkgver}_amd64.deb" "https://github.com/hrzlgnm/zux/releases/download/v$pkgver/zux_linux_x64")
-sha256sums_x86_64=('9b2af230a2dfb408d2aa27be3048266048882021e027e234acfa6e4698eef898' '209d1e0e58469c46229fdcc99b7cb166776c697f9be4ae5d935101ee76b6518d')
+sha256sums_x86_64=('e5bde7affefae1a2f9302c4b65f875467173089ec1f3aefcf3b092928aa842dc' 'b2019836f10ff37d58d389f743dfc1af4dfe3b6db641568708e1b5fe9a3e83d9')
 package() {
+    # The .deb contains the icons, .desktop file and other files installed to shared.
     tar -xz -f data.tar.gz -C "${pkgdir}"
+    # The .deb contains a binary that has auto updates enabled for the .deb.
+    # We install a unbundled version of the binary to have auto updates disabled.
     install -Dm755 zux_linux_x64 "${pkgdir}/usr/bin/zux"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 11:20:22	MEDIUM	2
2026-08-01 07:20:18	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 23:19:22	LOW	2
2026-07-31 17:18:23	LOW	2
2026-07-31 15:18:17	LOW	2
2026-07-31 11:17:50	MEDIUM	2
2026-07-31 07:17:22	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 23:17:02	LOW	2
2026-07-30 21:16:48	LOW	2