azimuth-bin

maintainer vitaliikuzhdin · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt snap binaries from api.snapcraft.io, which are unverifiable executables; while the host is legitimate, the lack of access to build-from-source and reliance on signed snaps from a third-party store introduces a supply-chain risk if the snap were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:45 "https://api.snapcraft.io/api/v1/snaps/download/0rVgBoeGw5Noxnc0XGWZiy0nfd3yKw2g_136.snap"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt snap binaries from api.snapcraft.io, which are unverifiable executables; while the host is legitimate, the lack of access to build-from-source and reliance on signed snaps from a third-party store introduces a supply-chain risk if the snap were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_pkgname="azimuth"
    
      4pkgname="${_pkgname}-bin"
    
      5pkgver=1.0.4
    
      6_commit="32f98f1d0b49956e499cf73b6fdde8fd9f1110fc" # 1.0.4
    
      7pkgrel=1
    
      8pkgdesc="A metroidvania with vector graphics"
    
      9arch=(
    
      10  'aarch64'
    
      11  'armv7h'
    
      12  'x86_64'
    
      13)
    
      14url="https://mdsteele.games/azimuth/"
    
      15_url="https://github.com/mdsteele/${_pkgname}"
    
      16license=(
    
      17  'GPL-3.0-or-later'
    
      18)
    
      19depends=(
    
      20  'glibc'
    
      21  'hicolor-icon-theme'
    
      22  'libglvnd'
    
      23  'sdl2'
    
      24)
    
      25makedepends=(
    
      26  'squashfs-tools'
    
      27)
    
      28provides=(
    
      29  "${_pkgname}"
    
      30)
    
      31conflicts=(
    
      32  "${_pkgname}"
    
      33)
    
      34_pkgsrc="${_pkgname}-${pkgver}"
    
      35source=(
    
      36  "${_pkgsrc}-README.md::${_url}/raw/${_commit}/README.md"
    
      37  "${_pkgsrc}-LICENSE::${_url}/raw/${_commit}/LICENSE"
    
      38  "${_pkgsrc}-icon_32x32.png::${_url}/raw/${_commit}/data/icons/icon_32x32.png"
    
      39  "${_pkgsrc}-icon_48x48.png::${_url}/raw/${_commit}/data/icons/icon_48x48.png"
    
      40  "${_pkgsrc}-icon_64x64.png::${_url}/raw/${_commit}/data/icons/icon_64x64.png"
    
      41  "${_pkgsrc}-icon_128x128.png::${_url}/raw/${_commit}/data/icons/icon_128x128.png"
    
      42)
    
      43# https://askubuntu.com/a/1196449
    
      44source_aarch64=(
    
      45  "https://api.snapcraft.io/api/v1/snaps/download/0rVgBoeGw5Noxnc0XGWZiy0nfd3yKw2g_136.snap"
    
      46)
    
      47source_armv7h=(
    
      48  "https://api.snapcraft.io/api/v1/snaps/download/0rVgBoeGw5Noxnc0XGWZiy0nfd3yKw2g_137.snap"
    
      49)
    
      50source_x86_64=(
    
      51  "https://api.snapcraft.io/api/v1/snaps/download/0rVgBoeGw5Noxnc0XGWZiy0nfd3yKw2g_135.snap"
    
      52)
    
      53b2sums=('6b32cc3f889eec20d189957e3fd9dfa9be6ee61a6318116b5c9822dbfa0c0ac73a7812d1973e59c784a966960248ba8bd9dbccda92bd89da1a8ed0359102359c'
    
      54        'ab7e38fc42fb6686add7393ecc3c7ec622cc0d72d0304ded3e56c2f96dc8433c584520896a30c037affa44461ecccfaf3ffa4a97a7e050e8ed0ec4c592caa45c'
    
      55        'cc5ff44a6be3e704fe8ed7c4449b195915a5ddebccfa034b2d9ed498b860c9a31785f702362419ffc7136e743089a743d92a68a4c96b50fc25f23ef47de54501'
    
      56        '9b198f7003d652fc6d32c945f8c7c45b2c760de5017c79eb25db3b8f79d83679e8988c98ff7e87bcc4c8c1325f702c940b0cb037a51c9d3edcb821cf9c870e1e'
    
      57        '4e20fcd941f4f07f05b7c15f645b1219860301f108b2c5a3d621a0841c42fe86b8bba8964cbf27d0175c94d4f343b82b54ca63d6a100299c573fa1ba0dc01e5c'
    
      58        '06ddb3297921db0779be520d2e033796fbacaf7955535b9ec652517255ae9a43689f0a1d124e561ad65bb341098f7a243de92ffa1bccb9fc5e34e05f50dbd31e')
    
      59b2sums_aarch64=('632dd8c54ea8bcd64f3047a124868959972121f2faa5263801488140863e9ba560bd90e1cd4445a6452539228244df2fb24f88217d7011bddfce6b1c3d8ed45a')
    
      60b2sums_armv7h=('26e9981e17388bc558422fe91dd2d1a8a187c75edf9809edfdf7a45dd8a425d6163601aff064b23a35bebf02a756094c11b751b55b4258b5f4bb4a773c27c70a')
    
      61b2sums_x86_64=('9b37b375d246e776e4eafc2d4959b272a8ae8d531e31e0f2f1fd8e1065369c0a3028366806c0a791c5a07a71c81a0bf0dc8e45772ecc5c7767c315964445667d')
    
      62
    
      63prepare() {
    
      64  local source_array="source_${CARCH}[0]"
    
      65  local source_url="${!source_array}"
    
      66  local source_artifact="${source_url##*/}"
    
      67
    
      68  cd "${srcdir}"
    
      69  unsquashfs -f -d "${srcdir}/${source_artifact%.snap}" "${source_artifact}"
    
      70
    
      71  cd "${source_artifact%.snap}/meta/gui"
    
      72  sed -e "s|^Icon=.*|Icon=${_pkgname}|g" \
    
      73      -i "${_pkgname}.desktop"
    
      74}
    
      75
    
      76package() {
    
      77  local source_array="source_${CARCH}[0]"
    
      78  local source_url="${!source_array}"
    
      79  local source_artifact="${source_url##*/}"
    
      80
    
      81  cd "${srcdir}"
    
      82  install -vDm644 "${_pkgsrc}-README.md" "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
    
      83  install -vDm644 "${_pkgsrc}-LICENSE"   "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      84
    
      85  for _icon in 32x32 48x48 64x64 128x128; do
    
      86    install -vDm644 "${_pkgsrc}-icon_${_icon}.png" \
    
      87      "${pkgdir}/usr/share/icons/hicolor/${_icon}/apps/${_pkgname}.png"
    
      88  done
    
      89
    
      90  cd "${srcdir}/${source_artifact%.snap}"
    
      91  install -vDm755 "Azimuth" "${pkgdir}/usr/bin/${_pkgname}"
    
      92
    
      93  cd "meta/gui"
    
      94  install -vDm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2