astrobox-creator-console
MEDIUM
maintainer WaiJade
0 votes
scanned 2026-08-30 15:43:17.210043
Why flagged
The package downloads a prebuilt Arch Linux package from GitHub releases via multiple proxy mirrors, which introduces a supply-chain risk if any mirror or the source is compromised, despite checksum verification.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt Arch Linux package from GitHub releases via multiple proxy mirrors, which introduces a supply-chain risk if any mirror or the source is compromised, despite checksum verification.
PKGBUILD
1
# Maintainer: WaiJade <waijade@outlook.com>
2
3
pkgname=astrobox-creator-console
4
pkgver=0.3.0
5
pkgrel=1
6
pkgdesc="AstroBox CreatorConsole - all-in-one creator console for the AstroBox ecosystem"
7
arch=('x86_64')
8
url="https://github.com/AstralSightStudios/AstroBoxCreatorConsole"
9
license=('AGPL-3.0')
10
options=('!debug')
11
depends=(
12
'webkit2gtk-4.1'
13
'gtk3'
14
'libx11'
15
'gcc-libs'
16
'glibc'
17
'zlib'
18
'bzip2'
19
'libxcb'
20
'libxkbcommon'
21
'dbus'
22
'libsecret'
23
'libsoup3'
24
'gstreamer'
25
'gst-plugins-base'
26
'libepoxy'
27
'atk'
28
'at-spi2-core'
29
'cairo'
30
'pango'
31
'gdk-pixbuf2'
32
'harfbuzz'
33
'hicolor-icon-theme'
34
'desktop-file-utils'
35
'shared-mime-info'
36
)
37
makedepends=('curl')
38
39
prepare() {
40
local _base="AstralSightStudios/AstroBoxCreatorConsole/releases/download/v${pkgver}/AstroBoxCreatorConsole-${pkgver}-x86_64.pkg.tar.zst"
41
local _file="AstroBoxCreatorConsole-${pkgver}-x86_64.pkg.tar.zst"
42
local _expected="32bba98eb4ad3e7d8e748f4db837e236d3b2d62c745273af2b8a722dfb5073e6"
43
local _mirrors=(
44
"https://github.com/${_base}|GitHub"
45
"https://ghfast.top/https://github.com/${_base}|ghfast"
46
"https://ghproxy.com/https://github.com/${_base}|ghproxy"
47
"https://gh-proxy.com/https://github.com/${_base}|ghproxy2"
48
"https://ghproxy.net/https://github.com/${_base}|ghproxy3"
49
"https://ghgo.xyz/https://github.com/${_base}|ghgo"
50
"https://gh.ddlc.top/https://github.com/${_base}|ghddl"
51
)
52
53
echo "==> Testing download mirrors..."
54
local _best_url="" _best_time="999" _best_name=""
55
local _tmpdir
56
_tmpdir=$(mktemp -d)
57
58
for i in "${!_mirrors[@]}"; do
59
local _entry="${_mirrors[$i]}"
60
local _url="${_entry%%|*}"
61
local _name="${_entry##*|}"
62
(
63
local _result
64
_result=$(curl -sI --max-time 5 -o /dev/null -w "%{time_total} %{http_code}" "$_url" 2>/dev/null) || true
65
echo "${_result} ${_name} ${_url}" > "$_tmpdir/$i"
66
) &
67
done
68
wait
69
70
for i in "${!_mirrors[@]}"; do
71
local _time _code _name _url
72
read _time _code _name _url < "$_tmpdir/$i" 2>/dev/null || continue
73
if [[ "$_code" =~ ^(200|301|302) ]]; then
74
printf " %-12s % 6ss (%s)\n" "$_name" "$_time" "$_code"
75
if awk "BEGIN{exit !($_time < $_best_time)}" 2>/dev/null; then
76
_best_time="$_time"
77
_best_url="$_url"
78
_best_name="$_name"
79
fi
80
else
81
printf " %-12s failed (%s)\n" "$_name" "$_code"
82
fi
83
done
84
rm -rf "$_tmpdir"
85
86
if [ -z "$_best_url" ]; then
87
error "All mirrors failed"
88
return 1
89
fi
90
91
msg "Best mirror: $_best_name (${_best_time}s)"
92
msg "Downloading $_file..."
93
curl -L --progress-bar -o "$srcdir/$_file" "$_best_url"
94
95
msg "Verifying checksum..."
96
local _real
97
_real=$(sha256sum "$srcdir/$_file" | awk '{print $1}')
98
if [ "$_real" != "$_expected" ]; then
99
error "Checksum mismatch: got $_real"
100
return 1
101
fi
102
msg "Checksum OK"
103
104
msg "Extracting..."
105
bsdtar -xf "$srcdir/$_file" -C "$srcdir"
106
rm -f "$srcdir/$_file"
107
rm -f "$srcdir/.BUILDINFO" "$srcdir/.MTREE" "$srcdir/.PKGINFO"
108
}
109
110
package() {
111
cd "$srcdir"
112
cp -a . "$pkgdir"
113
rm -f "$pkgdir/.BUILDINFO" "$pkgdir/.MTREE" "$pkgdir/.PKGINFO"
114
}
115
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-30 15:43:17 | Medium | 2 |