astralrinth-app-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This package downloads and installs a prebuilt binary (.deb) from a personal/self-hosted Gitea instance (git.astralium.su) maintained by 'didirus', which is not the official Modrinth infrastructure or any well-known mirror. The binary (ModrinthApp) is extracted and installed directly to /opt and executed. While sha512sums are present providing integrity checking against tampering in transit, the trust anchor is entirely the maintainer's personal server — if that host is compromised or the maintainer is malicious, users would execute arbitrary code. This is a classic supply-chain concern for a binary-only AUR package from an unofficial personal host. The cheaper model's MEDIUM rating is correct: this is a real (if not clearly malicious) supply-chain risk due to the combination of an executed binary and a non-official hosting location.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "AstralRinth_App_${pkgver}_amd64.deb::https://git.astralium.su/didirus/AstralRinth/releases/download/AR-${pkgver}/AstralRinth%20App_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): This package downloads and installs a prebuilt binary (.deb) from a personal/self-hosted Gitea instance (git.astralium.su) maintained by 'didirus', which is not the official Modrinth infrastructure or any well-known mirror. The binary (ModrinthApp) is extracted and installed directly to /opt and executed. While sha512sums are present providing integrity checking against tampering in transit, the trust anchor is entirely the maintainer's personal server — if that host is compromised or the maintainer is malicious, users would execute arbitrary code. This is a classic supply-chain concern for a binary-only AUR package from an unofficial personal host. The cheaper model's MEDIUM rating is correct: this is a real (if not clearly malicious) supply-chain risk due to the combination of an executed binary and a non-official hosting location.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=astralrinth-app-bin
    
      2pkgver=0.10.304
    
      3pkgrel=1
    
      4pkgdesc="A fork of the Modrinth Launcher developed by didirus"
    
      5arch=('x86_64')
    
      6url="https://git.astralium.su/didirus/AstralRinth"
    
      7license=('GPL-3.0-only')
    
      8depends=('openssl-1.1' 'dbus' 'freetype2' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'libsoup3' 'webkit2gtk-4.1' 'libgl' 'libpulse' 'libx11' 'libxcursor' 'libxext' 'libxxf86vm')
    
      9optdepends=('xorg-xrandr: for older Minecraft versions')
    
      10options=('!strip' '!emptydirs' '!debug')
    
      11conflicts=('modrinth-app-bin' 'modrinth-app-git' 'modrinth-app' 'astralrinth-bin')
    
      12install=${pkgname}.install
    
      13
    
      14source=(
    
      15  "AstralRinth_App_${pkgver}_amd64.deb::https://git.astralium.su/didirus/AstralRinth/releases/download/AR-${pkgver}/AstralRinth%20App_${pkgver}_amd64.deb"
    
      16  "astralrinth-app"
    
      17  "astralrinth-file-extensions.xml"
    
      18)
    
      19
    
      20sha512sums=(
    
      21  '2a1747e7a70bdf467f77211827fa855b0d5c6d25e2675406cf77a5dc8f11be43f2b8df72cedc90936b924e5279441fd0c88dafc486183e29db16b6d75fbee98f'
    
      22  '9bd0a35204fb4bae20b0bec5382410556ce4eb3649c95b44fb6b4f852ac71526bace6a457d5f3e7c84e7959d24f9dc2a0c746af783d79c5d635b834991cec35a'
    
      23  '38fedb2532850677ff638d5c7e20fbc78efc18b5deb26f77dfcc079b42f48f16473f0a27d7af183ef02ad3cd94729c86249bdac60b2bc1b25b47a1ebd2ba0c0d'
    
      24)
    
      25
    
      26prepare() {
    
      27  bsdtar -xf "${srcdir}/AstralRinth_App_${pkgver}_amd64.deb"
    
      28  tar -xf data.tar.*
    
      29}
    
      30
    
      31package() {
    
      32  cd "$srcdir"
    
      33  install -Dm755 "usr/bin/ModrinthApp" "${pkgdir}/opt/astralrinth-app/astralrinth-app"
    
      34  install -Dm755 "astralrinth-app" "${pkgdir}/usr/bin/astralrinth-app"
    
      35  install -Dm644 "astralrinth-file-extensions.xml" "${pkgdir}/usr/share/mime/packages/astralrinth-file-extensions.xml"
    
      36  install -Dm644 "usr/share/applications/AstralRinth App.desktop" "${pkgdir}/usr/share/applications/astralrinth-app.desktop"
    
      37  sed -i -e 's|Exec=ModrinthApp|Exec=astralrinth-app %u|' -e 's|Icon=ModrinthApp|Icon=astralrinth-app|' "${pkgdir}/usr/share/applications/astralrinth-app.desktop"
    
      38  install -Dm644 "usr/share/icons/hicolor/128x128/apps/ModrinthApp.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/astralrinth-app.png"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2