zig-dev-bin 1:0.15.0_dev.643.gdc6ffc28b-2
A general-purpose programming language and toolchain for maintaining robust, optimal, and reusable software
config.json file.
/v1/packages/zig-dev-bin/versions SHAs are authoritative.
Metadata
Relations
Make dependencies
Conflicts
Provides
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| 588815d35271head | verified | 2026-11-05 16:07 | 12 |
Head findings
risky-tool
in
PKGBUILD'curl' is invoked - this fetches/executes external code outside alpm's control.
if ! curl -sS "https://ziglang.org/download/index.json" -o "$index_file"; then
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
echo "Successfully downloaded version index (date: $(buildhelper print-date))" >&2;
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local index_file="$(fetch_version_index)";
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local newver="$(pkgver)";
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local newurl="$(buildhelper print-url)";
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local expected_hash="$(buildhelper print-hash)"
risky-tool
in
PKGBUILD'curl' is invoked - this fetches/executes external code outside alpm's control.
curl -Ss "$newurl" -o "$newfile";
risky-tool
in
PKGBUILD'curl' is invoked - this fetches/executes external code outside alpm's control.
curl -Ss "$newurl_sig" -o "$newfile_sig";
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local actual_hash="$(sha256sum "$newfile" | grep -oE '^\w+')"
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cd "${srcdir}/zig-${CARCH}-linux-$(original_pkgver)"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
missing_docs+=("stdlib[$(basename "$stdlib_file")]");command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cd "${srcdir}/zig-${CARCH}-linux-$(original_pkgver)"Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.