altirra

maintainer imcb · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

piracy

Why flagged The package downloads Atari firmware ROMs (ATARIBAS.ROM, ATARIOSB.ROM, ATARIOSB.ROM, ATARIXL.ROM, 5200.ROM) from a third-party Czech host (atari.vjetnam.cz). These are proprietary Atari ROM images that are copyrighted by Atari/Infogrames/Atari SA — distributing them without a license constitutes piracy. The ROMs themselves are data files, not directly executed code on the host system (they run inside the emulator), so the supply-chain risk is lower than an executed binary, but the piracy concern is clear and definitive. The emulator itself (Altirra) is fetched from the official virtualdub.org host with checksums, which is fine. The piracy flag applies because the PKGBUILD automates the download and installation of proprietary firmware ROMs that are not freely redistributable.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 'http://atari.vjetnam.cz/dow/emuROMs.zip'
PKGBUILD:23 source_x86_64=("https://www.virtualdub.org/downloads/Altirra-${pkgver}.zip")

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 82%): The package downloads Atari firmware ROMs (ATARIBAS.ROM, ATARIOSB.ROM, ATARIOSB.ROM, ATARIXL.ROM, 5200.ROM) from a third-party Czech host (atari.vjetnam.cz). These are proprietary Atari ROM images that are copyrighted by Atari/Infogrames/Atari SA — distributing them without a license constitutes piracy. The ROMs themselves are data files, not directly executed code on the host system (they run inside the emulator), so the supply-chain risk is lower than an executed binary, but the piracy concern is clear and definitive. The emulator itself (Altirra) is fetched from the official virtualdub.org host with checksums, which is fine. The piracy flag applies because the PKGBUILD automates the download and installation of proprietary firmware ROMs that are not freely redistributable.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: imcb <irismessage@protonmail.com>
    
      2pkgname='altirra'
    
      3pkgver=4.40
    
      4pkgrel=1
    
      5pkgdesc='An 8-bit Atari computer emulator, on Wine'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://www.virtualdub.org/altirra.html'
    
      8license=('GPL-2.0-only')
    
      9depends=(
    
      10    'bash'
    
      11    'wine'
    
      12    'wine-mono'
    
      13)
    
      14optdepends=('wine-gecko: HTML help pages support')
    
      15provides=('altirra')
    
      16source=(
    
      17    'http://atari.vjetnam.cz/dow/emuROMs.zip'
    
      18    'altirra'
    
      19    'altirra.desktop'
    
      20    'altirra.png'
    
      21    'application-altirra.xml'
    
      22)
    
      23source_x86_64=("https://www.virtualdub.org/downloads/Altirra-${pkgver}.zip")
    
      24source_aarch64=("https://www.virtualdub.org/downloads/Altirra-${pkgver}-ARM64.zip")
    
      25sha256sums=('f6bebc7d367d59dd1789fd17450c9a4eb329c27a5b5345f42d4854f412a45221'
    
      26            'c6aab8083ed7e68c82ffc5b74497a87610f5f11a218ec42fe67fcf827d5a62c0'
    
      27            '713b375c8467da838f4c4c9f1eca2a947aecc6c429161bc67eeedecc7c81b620'
    
      28            '5319fd88751fa886683d955976ed74eb266e9ea462ae77431b6a6c457ce42dc1'
    
      29            'cd3a40e290d999912767a70ffc8e4185019290251b350f887f4a2fa972b6c96b')
    
      30sha256sums_x86_64=('8b0be7d81211a97d4633d6c8fdb85f446aa874ebd1e2d82f3aa6b7e41eb42c87')
    
      31sha256sums_aarch64=('f85562886d885f5a6b5d5073d1536a374cc0dd427aa8ccd40b2235a3cb9da63d')
    
      32
    
      33package() {
    
      34    _dest="${pkgdir}/opt/${pkgname}"
    
      35    _share="${pkgdir}/usr/share"
    
      36    _bin="${pkgdir}/usr/bin"
    
      37
    
      38    _exe_dest='Altirra64.exe'
    
      39    local _exe
    
      40    case $CARCH in
    
      41        'x86_64')
    
      42        _exe='Altirra64.exe'
    
      43        ;;
    
      44        'aarch64')
    
      45        _exe='AltirraARM64.exe'
    
      46        ;;
    
      47    esac
    
      48
    
      49    # windows executable
    
      50    install -D -m644 "${_exe}" "${_dest}/${_exe_dest}"
    
      51    # windows program files
    
      52    # omits extras/
    
      53    install -D -m644 -t "${_dest}" 'Additions.atr' 'Altirra.chm'
    
      54
    
      55    # shell script
    
      56    install -D -t "${_dest}" 'altirra'
    
      57    # firmware roms
    
      58    mv 'atari5200.rom' '5200.ROM'
    
      59    install -D -m644 -t "${_dest}/roms/" '5200.ROM' 'ATARIBAS.ROM' 'ATARIOSB.ROM' 'ATARIXL.ROM'
    
      60    # desktop entry
    
      61    install -D -m644 -t "${_share}/applications" "${pkgname}.desktop"
    
      62    install -D -m644 -t "${_share}/pixmaps" "${pkgname}.png"
    
      63    install -D -m644 -t "${_share}/mime/packages" "application-${pkgname}.xml"
    
      64    # PATH symlink
    
      65    install -d "${_bin}"
    
      66    ln -s "/opt/${pkgname}/${pkgname}" "${_bin}/${pkgname}"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2