azimuth-bin
MEDIUM
maintainer vitaliikuzhdin
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt snap binaries from api.snapcraft.io, which are unverifiable executables; while the host is legitimate, the lack of access to build-from-source and reliance on signed snaps from a third-party store introduces a supply-chain risk if the snap were compromised.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:45
"https://api.snapcraft.io/api/v1/snaps/download/0rVgBoeGw5Noxnc0XGWZiy0nfd3yKw2g_136.snap"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt snap binaries from api.snapcraft.io, which are unverifiable executables; while the host is legitimate, the lack of access to build-from-source and reliance on signed snaps from a third-party store introduces a supply-chain risk if the snap were compromised.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
2
3
_pkgname="azimuth"
4
pkgname="${_pkgname}-bin"
5
pkgver=1.0.4
6
_commit="32f98f1d0b49956e499cf73b6fdde8fd9f1110fc" # 1.0.4
7
pkgrel=1
8
pkgdesc="A metroidvania with vector graphics"
9
arch=(
10
'aarch64'
11
'armv7h'
12
'x86_64'
13
)
14
url="https://mdsteele.games/azimuth/"
15
_url="https://github.com/mdsteele/${_pkgname}"
16
license=(
17
'GPL-3.0-or-later'
18
)
19
depends=(
20
'glibc'
21
'hicolor-icon-theme'
22
'libglvnd'
23
'sdl2'
24
)
25
makedepends=(
26
'squashfs-tools'
27
)
28
provides=(
29
"${_pkgname}"
30
)
31
conflicts=(
32
"${_pkgname}"
33
)
34
_pkgsrc="${_pkgname}-${pkgver}"
35
source=(
36
"${_pkgsrc}-README.md::${_url}/raw/${_commit}/README.md"
37
"${_pkgsrc}-LICENSE::${_url}/raw/${_commit}/LICENSE"
38
"${_pkgsrc}-icon_32x32.png::${_url}/raw/${_commit}/data/icons/icon_32x32.png"
39
"${_pkgsrc}-icon_48x48.png::${_url}/raw/${_commit}/data/icons/icon_48x48.png"
40
"${_pkgsrc}-icon_64x64.png::${_url}/raw/${_commit}/data/icons/icon_64x64.png"
41
"${_pkgsrc}-icon_128x128.png::${_url}/raw/${_commit}/data/icons/icon_128x128.png"
42
)
43
# https://askubuntu.com/a/1196449
44
source_aarch64=(
45
"https://api.snapcraft.io/api/v1/snaps/download/0rVgBoeGw5Noxnc0XGWZiy0nfd3yKw2g_136.snap"
46
)
47
source_armv7h=(
48
"https://api.snapcraft.io/api/v1/snaps/download/0rVgBoeGw5Noxnc0XGWZiy0nfd3yKw2g_137.snap"
49
)
50
source_x86_64=(
51
"https://api.snapcraft.io/api/v1/snaps/download/0rVgBoeGw5Noxnc0XGWZiy0nfd3yKw2g_135.snap"
52
)
53
b2sums=('6b32cc3f889eec20d189957e3fd9dfa9be6ee61a6318116b5c9822dbfa0c0ac73a7812d1973e59c784a966960248ba8bd9dbccda92bd89da1a8ed0359102359c'
54
'ab7e38fc42fb6686add7393ecc3c7ec622cc0d72d0304ded3e56c2f96dc8433c584520896a30c037affa44461ecccfaf3ffa4a97a7e050e8ed0ec4c592caa45c'
55
'cc5ff44a6be3e704fe8ed7c4449b195915a5ddebccfa034b2d9ed498b860c9a31785f702362419ffc7136e743089a743d92a68a4c96b50fc25f23ef47de54501'
56
'9b198f7003d652fc6d32c945f8c7c45b2c760de5017c79eb25db3b8f79d83679e8988c98ff7e87bcc4c8c1325f702c940b0cb037a51c9d3edcb821cf9c870e1e'
57
'4e20fcd941f4f07f05b7c15f645b1219860301f108b2c5a3d621a0841c42fe86b8bba8964cbf27d0175c94d4f343b82b54ca63d6a100299c573fa1ba0dc01e5c'
58
'06ddb3297921db0779be520d2e033796fbacaf7955535b9ec652517255ae9a43689f0a1d124e561ad65bb341098f7a243de92ffa1bccb9fc5e34e05f50dbd31e')
59
b2sums_aarch64=('632dd8c54ea8bcd64f3047a124868959972121f2faa5263801488140863e9ba560bd90e1cd4445a6452539228244df2fb24f88217d7011bddfce6b1c3d8ed45a')
60
b2sums_armv7h=('26e9981e17388bc558422fe91dd2d1a8a187c75edf9809edfdf7a45dd8a425d6163601aff064b23a35bebf02a756094c11b751b55b4258b5f4bb4a773c27c70a')
61
b2sums_x86_64=('9b37b375d246e776e4eafc2d4959b272a8ae8d531e31e0f2f1fd8e1065369c0a3028366806c0a791c5a07a71c81a0bf0dc8e45772ecc5c7767c315964445667d')
62
63
prepare() {
64
local source_array="source_${CARCH}[0]"
65
local source_url="${!source_array}"
66
local source_artifact="${source_url##*/}"
67
68
cd "${srcdir}"
69
unsquashfs -f -d "${srcdir}/${source_artifact%.snap}" "${source_artifact}"
70
71
cd "${source_artifact%.snap}/meta/gui"
72
sed -e "s|^Icon=.*|Icon=${_pkgname}|g" \
73
-i "${_pkgname}.desktop"
74
}
75
76
package() {
77
local source_array="source_${CARCH}[0]"
78
local source_url="${!source_array}"
79
local source_artifact="${source_url##*/}"
80
81
cd "${srcdir}"
82
install -vDm644 "${_pkgsrc}-README.md" "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
83
install -vDm644 "${_pkgsrc}-LICENSE" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
84
85
for _icon in 32x32 48x48 64x64 128x128; do
86
install -vDm644 "${_pkgsrc}-icon_${_icon}.png" \
87
"${pkgdir}/usr/share/icons/hicolor/${_icon}/apps/${_pkgname}.png"
88
done
89
90
cd "${srcdir}/${source_artifact%.snap}"
91
install -vDm755 "Azimuth" "${pkgdir}/usr/bin/${_pkgname}"
92
93
cd "meta/gui"
94
install -vDm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
95
}
96
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |