artix-launcher

maintainer jonas_alv · 1 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged Downloads a prebuilt AppImage binary from launch.artix.com with SKIP'd checksum; while the domain appears to be the official Artix Games launcher infrastructure, the SKIP'd checksum means the binary cannot be verified and could be silently swapped, and the AppImage is extracted and run during prepare(), making this a medium-risk unverifiable prebuilt executable install.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("${pkgname}-${pkgver}.AppImage::https://launch.artix.com/latest/${_appimage}")

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads a prebuilt AppImage binary from launch.artix.com with SKIP'd checksum; while the domain appears to be the official Artix Games launcher infrastructure, the SKIP'd checksum means the binary cannot be verified and could be silently swapped, and the AppImage is extracted and run during prepare(), making this a medium-risk unverifiable prebuilt executable install.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: @jonasalv github
    
      2pkgname=artix-launcher
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="Artix Games Launcher"
    
      6arch=('x86_64')
    
      7url="https://artix.com/"
    
      8license=('custom')
    
      9depends=('fuse2' 'zlib' 'hicolor-icon-theme')
    
      10provides=('artix-launcher')
    
      11conflicts=('artix-launcher')
    
      12options=('!strip')
    
      13
    
      14_appimage="Artix_Games_Launcher-x86_64.AppImage"
    
      15source=("${pkgname}-${pkgver}.AppImage::https://launch.artix.com/latest/${_appimage}")
    
      16sha256sums=('SKIP')
    
      17
    
      18prepare() {
    
      19    cd "${srcdir}"
    
      20    chmod +x "${pkgname}-${pkgver}.AppImage"
    
      21    ./${pkgname}-${pkgver}.AppImage --appimage-extract
    
      22}
    
      23
    
      24package() {
    
      25    cd "${srcdir}"
    
      26    install -Dm755 "${pkgname}-${pkgver}.AppImage" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
    
      27    
    
      28    install -d "${pkgdir}/usr/bin"
    
      29    ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/artix-launcher"
    
      30    
    
      31    cd squashfs-root
    
      32    
    
      33    _desktop=$(find . -maxdepth 1 -name "*.desktop" -print -quit)
    
      34    install -Dm644 "${_desktop}" "${pkgdir}/usr/share/applications/artix-launcher.desktop"
    
      35    
    
      36    sed -i "s|^Exec=.*|Exec=/usr/bin/artix-launcher|g" "${pkgdir}/usr/share/applications/artix-launcher.desktop"
    
      37    sed -i "s|^Icon=.*|Icon=artix-launcher|g" "${pkgdir}/usr/share/applications/artix-launcher.desktop"
    
      38    
    
      39    _icon=$(find . -maxdepth 1 \( -name "*.png" -o -name "*.svg" \) -print -quit)
    
      40    if [ -n "$_icon" ]; then
    
      41        _ext="${_icon##*.}"
    
      42        install -Dm644 "${_icon}" "${pkgdir}/usr/share/pixmaps/artix-launcher.${_ext}"
    
      43    fi
    
      44}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	3
2026-08-17 00:18:29	MEDIUM	3
2026-08-16 00:03:42	MEDIUM	3
2026-08-15 00:26:13	MEDIUM	3
2026-08-14 00:03:41	MEDIUM	3
2026-08-13 00:17:07	MEDIUM	3
2026-08-12 00:27:08	MEDIUM	3
2026-08-11 11:22:31	MEDIUM	3
2026-08-11 11:21:04	MEDIUM	3