ahwoo-bin

MEDIUM

maintainer frostyarchtide 0 votes scanned 2026-10-21 13:33:41.814798

View on AUR

Why flagged

Downloads a prebuilt binary tarball from a non-whitelisted personal/project host (neutrino.ahwoo.com) with SKIP'd checksums; the package does implement its own SHA256 verification against a version.json from a second host (install.ahwoo.com), but both sources are unverifiable and could be silently swapped together, making this an unverifiable prebuilt executable from a potentially swappable host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=('Ahwoo.tar.gz::https://neutrino.ahwoo.com/download/linux'
PKGBUILD:11 'version.json::https://install.ahwoo.com/linux-x64/tar/version.json')

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): Downloads a prebuilt binary tarball from a non-whitelisted personal/project host (neutrino.ahwoo.com) with SKIP'd checksums; the package does implement its own SHA256 verification against a version.json from a second host (install.ahwoo.com), but both sources are unverifiable and could be silently swapped together, making this an unverifiable prebuilt executable from a potentially swappable host.

PKGBUILD

2 offending line(s) highlighted

      1pkgname=ahwoo-bin
    
      2pkgver=2026.10.17.1348
    
      3pkgrel=2
    
      4pkgdesc='Launcher for Ahwoo games'
    
      5arch=('x86_64')
    
      6url='https://neutrino.ahwoo.com'
    
      7license=('LicenseRef-custom')
    
      8depends=('glibc' 'bash' 'fontconfig')
    
      9source=('Ahwoo.tar.gz::https://neutrino.ahwoo.com/download/linux'
    
      10	    'ahwoo.png::https://neutrino.ahwoo.com/favicon.png'
    
      11	    'version.json::https://install.ahwoo.com/linux-x64/tar/version.json')
    
      12sha256sums=('SKIP'
    
      13		    'SKIP'
    
      14		    'SKIP')
    
      15options=(!strip)
    
      16
    
      17pkgver() {
    
      18	awk -F'"' '/version/ {print $4}' version.json
    
      19}
    
      20
    
      21prepare() {
    
      22	cd "$srcdir"
    
      23
    
      24	printf "\033[1;34m  ->\033[0m\033[1m Validating Ahwoo.tar.gz...\n"
    
      25
    
      26	local expected_sha
    
      27	local actual_sha
    
      28	expected_sha=$(awk -F'"' '/sha256/ {print $4}' version.json)
    
      29	actual_sha=$(sha256sum "$srcdir/Ahwoo.tar.gz" | cut -d' ' -f1)
    
      30
    
      31	if [ "$expected_sha" != "$actual_sha" ]; then
    
      32		printf "\033[1;31m==> ERROR:\033[0m\033[1m Ahwoo.tar.gz did not pass the validity check!\033[0m\n" >&2
    
      33		printf "    \033[1mExpected:\033[0m\033[1m %s\033[0m\n" "$expected_sha" >&2
    
      34		printf "    \033[1mActual:\033[0m\033[1m   %s\033[0m\n" "$actual_sha" >&2
    
      35		return 1
    
      36	fi
    
      37
    
      38	printf "\033[1;32m==>\033[0m\033[1m Checksum verified successfully\033[0m\n"
    
      39}
    
      40
    
      41package() {
    
      42	cd "$srcdir/ahwoo"
    
      43
    
      44	install -d "$pkgdir/usr/bin"
    
      45	install -d "$pkgdir/usr/lib/ahwoo"
    
      46
    
      47	install -Dm755 ahwoo "$pkgdir/usr/lib/ahwoo/"
    
      48	install -Dm644 libHarfBuzzSharp.so "$pkgdir/usr/lib/ahwoo/"
    
      49	install -Dm644 libSkiaSharp.so "$pkgdir/usr/lib/ahwoo/"
    
      50	cp -r Service "$pkgdir/usr/lib/ahwoo/"
    
      51	cp -r libexec "$pkgdir/usr/lib/ahwoo/"
    
      52
    
      53	install -Dm644 "$srcdir/ahwoo.png" "$pkgdir/usr/share/pixmaps/ahwoo.png"
    
      54
    
      55	install -Dm755 /dev/stdin "$pkgdir/usr/bin/ahwoo" << 'EOF'
    
      56#!/usr/bin/sh
    
      57export AHWOO_DISABLE_BOOTSTRAPPER_AUTO_UPDATE=1
    
      58exec /usr/lib/ahwoo/ahwoo "$@"
    
      59EOF
    
      60
    
      61	install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/ahwoo.desktop" << 'EOF'
    
      62[Desktop Entry]
    
      63Type=Application
    
      64Name=Ahwoo
    
      65Comment=Launcher for Ahwoo games
    
      66Exec=/usr/bin/ahwoo
    
      67Icon=ahwoo
    
      68Categories=Game;Launcher;
    
      69Terminal=false
    
      70EOF
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 13:33:41	Medium	3
2026-10-21 13:31:17	Medium	3