alderon-games-launcher-bin

LOW

maintainer RiDDiX 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from the official vendor's CDN (alderongames.com) to extract and install it; this is normal for binary packages, and the source host, while not whitelisted, is plausibly official and the payload is not obfuscated or executed remotely.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official vendor's CDN (alderongames.com) to extract and install it; this is normal for binary packages, and the source host, while not whitelisted, is plausibly official and the payload is not obfuscated or executed remotely.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("$_pkgname-$pkgver.deb::https://launcher-cdn.alderongames.com/AlderonGamesLauncher-${pkgver}.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: riddix <github@egu-rel.de>
    
      2
    
      3pkgname=alderon-games-launcher-bin
    
      4_pkgname=alderon-games-launcher
    
      5pkgver=1.3.57
    
      6pkgrel=1
    
      7pkgdesc="Alderon Games Launcher (Path of Titans)"
    
      8arch=('x86_64')
    
      9url="https://alderongames.com"
    
      10license=('LicenseRef-alderon-proprietary')
    
      11depends=(
    
      12  'gtk3'
    
      13  'libnotify'
    
      14  'nss'
    
      15  'libxss'
    
      16  'libxtst'
    
      17  'xdg-utils'
    
      18  'at-spi2-core'
    
      19  'util-linux-libs'
    
      20  'libsecret'
    
      21)
    
      22optdepends=('libappindicator-gtk3: tray icon support')
    
      23provides=("$_pkgname=$pkgver")
    
      24conflicts=("$_pkgname")
    
      25options=('!strip' '!debug')
    
      26source=("$_pkgname-$pkgver.deb::https://launcher-cdn.alderongames.com/AlderonGamesLauncher-${pkgver}.deb")
    
      27sha256sums=('7da2bb0b80f7cf53c347265ada949d9155aa346066f1dfa403e44c5f2401835a')
    
      28
    
      29package() {
    
      30  cd "$srcdir"
    
      31  bsdtar -xf "$_pkgname-$pkgver.deb"
    
      32  bsdtar -xf data.tar.xz -C "$pkgdir"
    
      33
    
      34  install -d "$pkgdir/opt"
    
      35  mv "$pkgdir/opt/Alderon Games Launcher" "$pkgdir/opt/$_pkgname"
    
      36
    
      37  # The launcher picks its update provider by shelling out to `dpkg -l` and
    
      38  # `rpm -q`. On Arch both fail, a variable ends up undefined, and the next
    
      39  # line throws silently inside the main process — no window, no log, nothing.
    
      40  # This shim makes the rpm probe succeed so the RpmUpdater branch is taken.
    
      41  # Actual updates still go through pacman; the shim just unblocks startup.
    
      42  install -d "$pkgdir/opt/$_pkgname/shims"
    
      43  cat > "$pkgdir/opt/$_pkgname/shims/rpm" <<EOF
    
      44#!/bin/sh
    
      45if [ "\$1" = "-q" ] && [ "\$2" = "$_pkgname" ]; then
    
      46  echo "$_pkgname-$pkgver-$pkgrel"
    
      47  exit 0
    
      48fi
    
      49exit 1
    
      50EOF
    
      51  chmod 755 "$pkgdir/opt/$_pkgname/shims/rpm"
    
      52
    
      53  install -d "$pkgdir/usr/bin"
    
      54  cat > "$pkgdir/usr/bin/$_pkgname" <<EOF
    
      55#!/bin/sh
    
      56export PATH="/opt/$_pkgname/shims:\$PATH"
    
      57exec "/opt/$_pkgname/$_pkgname" --ozone-platform=x11 "\$@"
    
      58EOF
    
      59  chmod 755 "$pkgdir/usr/bin/$_pkgname"
    
      60
    
      61  sed -i "s|\"/opt/Alderon Games Launcher/$_pkgname\"|/usr/bin/$_pkgname|" \
    
      62    "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      63
    
      64  rm -rf "$pkgdir/usr/share/doc"
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2