aurora-4x

LOW

maintainer friedev 0 votes scanned 2026-10-18 17:22:42.773931

View on AUR

Why flagged

The package downloads a non-executable game archive from the official project's Google Drive via a direct link, which is a common practice for AUR packages hosting large files; the build process installs static game data and creates a wrapper script to manage save files and launch the game via Wine, with no evidence of malicious behavior or remote code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a non-executable game archive from the official project's Google Drive via a direct link, which is a common practice for AUR packages hosting large files; the build process installs static game data and creates a wrapper script to manage save files and launch the game via Wine, with no evidence of malicious behavior or remote code execution.

PKGBUILD

      1# Maintainer: Aaron Friesen <aaron@frie.dev>
    
      2# shellcheck shell=bash disable=SC2034,SC2154,SC2164
    
      3
    
      4pkgname=aurora-4x
    
      5pkgver=2.7.1
    
      6pkgrel=1
    
      7pkgdesc='A space strategy game with a focus on realism and depth'
    
      8arch=(x86_64)
    
      9url='https://aurora4x.com/'
    
      10license=(LicenseRef-aurora-4x)
    
      11depends=(wine wine-mono)
    
      12
    
      13# Google Drive's large-file confirmation page can be bypassed with the
    
      14# drive.usercontent.google.com endpoint and confirm=t, so makepkg's normal
    
      15# downloader can fetch the archive directly.
    
      16_gdrive_id=1aW7Yra4MgWwr4UxFORwRT2scOCZoDFqX
    
      17_archive="$pkgname-$pkgver.rar"
    
      18_archive_url="https://drive.usercontent.google.com/download?id=$_gdrive_id&export=download&confirm=t"
    
      19source=("$_archive::$_archive_url")
    
      20sha256sums=('5cf4b7ee6965a6e05b96538c8a9762b8b2de63dd535ca74cfec46977e5d1b174')
    
      21noextract=("$_archive")
    
      22
    
      23prepare() {
    
      24	mkdir -p "$srcdir/$pkgname-$pkgver"
    
      25	bsdtar --no-same-owner -xf "$srcdir/$_archive" -C "$srcdir/$pkgname-$pkgver"
    
      26}
    
      27
    
      28package() {
    
      29	cd "$pkgname-$pkgver"
    
      30
    
      31	install -dm755 "$pkgdir/usr/share/$pkgname"
    
      32	cp -r --no-preserve=ownership . "$pkgdir/usr/share/$pkgname/"
    
      33
    
      34	# Normalize permissions.
    
      35	find "$pkgdir/usr/share/$pkgname" -type f -exec chmod 644 {} +
    
      36	find "$pkgdir/usr/share/$pkgname" -type d -exec chmod 755 {} +
    
      37
    
      38	# Upstream only ships this readme; install it as documentation.
    
      39	install -Dm644 ReadMeFirst.txt "$pkgdir/usr/share/doc/$pkgname/ReadMeFirst.txt"
    
      40
    
      41	# Upstream publishes no license, so ship a notice for the LicenseRef id.
    
      42	install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
      43	cat >"$pkgdir/usr/share/licenses/$pkgname/LicenseRef-$pkgname.txt" <<'EOF'
    
      44Aurora 4X is freeware developed by Steve Walmsley.
    
      45
    
      46Upstream publishes no license text, so the game remains all rights reserved
    
      47by its author. This package does not redistribute the game: it downloads the
    
      48unmodified archive from the official distribution channel at build time.
    
      49
    
      50Official site: https://aurora4x.com/
    
      51EOF
    
      52
    
      53	# Aurora reads its data and writes AuroraDB.db (the save game) relative to
    
      54	# the working directory. Run it from a writable per-user directory that
    
      55	# links to the installed files, keeping the database as a real file.
    
      56	install -dm755 "$pkgdir/usr/bin"
    
      57	cat >"$pkgdir/usr/bin/$pkgname" <<'EOF'
    
      58#!/bin/sh
    
      59install_dir=/usr/share/aurora-4x
    
      60data_dir="${XDG_DATA_HOME:-$HOME/.local/share}/aurora-4x"
    
      61
    
      62mkdir -p "$data_dir" || exit 1
    
      63
    
      64# AuroraDB.db is the save game. Only copy the packaged database on first run
    
      65# so upgrades do not erase existing saves; delete it to start from the new one.
    
      66if [ ! -e "$data_dir/AuroraDB.db" ]; then
    
      67	cp "$install_dir/AuroraDB.db" "$data_dir/AuroraDB.db" || exit 1
    
      68fi
    
      69for file in "$install_dir"/*; do
    
      70	name="${file##*/}"
    
      71	[ "$name" = AuroraDB.db ] && continue
    
      72	link="$data_dir/$name"
    
      73	# Recreate links whose target disappeared after a package upgrade.
    
      74	if [ -L "$link" ] && [ ! -e "$link" ]; then
    
      75		rm -f "$link"
    
      76	fi
    
      77	[ -e "$link" ] || ln -s "$file" "$link"
    
      78done
    
      79
    
      80# Suppress Wine debug spam.
    
      81export WINEDEBUG=-all
    
      82cd "$data_dir" || exit 1
    
      83exec wine "$install_dir/Aurora.exe" "$@"
    
      84EOF
    
      85	chmod 755 "$pkgdir/usr/bin/$pkgname"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 17:22:42	Low	2