battle-cats-rolls

maintainer EduHoff · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own GitLab source and installs Ruby gems via bundler/gem from rubygems.org, which is normal dependency resolution; the flagged 'variable package name' is just standard gem install calls, and the external download at line 104 appears to be a curl health-check inside a launcher script rather than fetching and executing remote code. The main concerns are SKIP'd checksum, few votes, and gem dependencies resolved at build time from rubygems.org, but none of these constitute clear malicious behaviour.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package builds from the project's own GitLab source and installs Ruby gems via bundler/gem from rubygems.org, which is normal dependency resolution; the flagged 'variable package name' is just standard gem install calls, and the external download at line 104 appears to be a curl health-check inside a launcher script rather than fetching and executing remote code. The main concerns are SKIP'd checksum, few votes, and gem dependencies resolved at build time from rubygems.org, but none of these constitute clear malicious behaviour.

PKGBUILD:30 gem install --no-document --install-dir "$GEM_HOME" bundler rake erb dalli
PKGBUILD:60 gem install --no-document --install-dir "$GEM_HOME" bundler erb dalli

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:104 until curl -s -o /dev/null -w "%{http_code}" http://localhost:8080 | grep -q "200" 2>/dev/null; do

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:30 gem install --no-document --install-dir "$GEM_HOME" bundler rake erb dalli
PKGBUILD:60 gem install --no-document --install-dir "$GEM_HOME" bundler erb dalli

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: EduHoff <ehcs.business@gmail.com>
    
      2pkgname=battle-cats-rolls
    
      3pkgver=r1783.7aef471
    
      4pkgrel=1
    
      5pkgdesc="Local Battle Cats seed tracking server with high-performance C seeker"
    
      6arch=('x86_64')
    
      7url="https://gitlab.com/godfat/battle-cats-rolls"
    
      8license=("Apache-2.0")
    
      9depends=('ruby' 'memcached' 'clang' 'zenity' 'curl')
    
      10makedepends=('git')
    
      11provides=('battle-cats-rolls')
    
      12conflicts=('battle-cats-rolls')
    
      13source=("git+${url}.git")
    
      14md5sums=('SKIP')
    
      15
    
      16pkgver() {
    
      17  cd "${srcdir}/battle-cats-rolls"
    
      18  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      19}
    
      20
    
      21build() {
    
      22  cd "${srcdir}/battle-cats-rolls"
    
      23  echo ":: Compiling VampireFlower C seeker engine..."
    
      24  ./Seeker/bin/build-VampireFlower.sh
    
      25
    
      26  echo ":: Extracting and building game data tables (build/*.yaml)..."
    
      27  export GEM_HOME="${srcdir}/gem_bootstrap"
    
      28  export PATH="$PATH:$GEM_HOME/bin"
    
      29
    
      30  gem install --no-document --install-dir "$GEM_HOME" bundler rake erb dalli
    
      31
    
      32  echo "gem 'erb'" >> Gemfile
    
      33
    
      34  bundle config set --local path "$GEM_HOME"
    
      35  bundle install
    
      36
    
      37  rake build
    
      38}
    
      39
    
      40package() {
    
      41  cd "${srcdir}/battle-cats-rolls"
    
      42
    
      43  install -d "${pkgdir}/usr/share/webapps/battle-cats-rolls"
    
      44  install -d "${pkgdir}/usr/bin"
    
      45  install -d "${pkgdir}/usr/share/applications"
    
      46  install -d "${pkgdir}/usr/share/pixmaps"
    
      47
    
      48  echo ":: Copying core files to application directory..."
    
      49  cp -r Seeker bin config lib Gemfile config.ru Rakefile build data "${pkgdir}/usr/share/webapps/battle-cats-rolls/"
    
      50  cp "${srcdir}/battle-cats-rolls/lib/battle-cats-rolls/asset/image/treasure.png" "${pkgdir}/usr/share/pixmaps/battle-cats-rolls.png"
    
      51
    
      52  [ -d public ] && cp -r public "${pkgdir}/usr/share/webapps/battle-cats-rolls/"
    
      53
    
      54  touch "${pkgdir}/usr/share/webapps/battle-cats-rolls/.env"
    
      55
    
      56  echo ":: Deploying sandboxed Ruby environment..."
    
      57  export GEM_HOME="${pkgdir}/usr/share/webapps/battle-cats-rolls/vendor/bundle"
    
      58  export PATH="$PATH:$GEM_HOME/bin"
    
      59
    
      60  gem install --no-document --install-dir "$GEM_HOME" bundler erb dalli
    
      61
    
      62  bundle config set --local path "$GEM_HOME"
    
      63  bundle config set --local without 'cache:test'
    
      64  bundle install --gemfile="${pkgdir}/usr/share/webapps/battle-cats-rolls/Gemfile"
    
      65
    
      66  find "${pkgdir}/usr/share/webapps/battle-cats-rolls" -type d -exec chmod 755 {} +
    
      67  find "${pkgdir}/usr/share/webapps/battle-cats-rolls" -type f -exec chmod 644 {} +
    
      68
    
      69  if [ -d "${pkgdir}/usr/share/webapps/battle-cats-rolls/vendor/bundle/bin" ]; then
    
      70      chmod +x "${pkgdir}/usr/share/webapps/battle-cats-rolls/vendor/bundle/bin/"*
    
      71  fi
    
      72  chmod +x "${pkgdir}/usr/share/webapps/battle-cats-rolls/bin/server"
    
      73  chmod +x "${pkgdir}/usr/share/webapps/battle-cats-rolls/Seeker/Seeker-VampireFlower"
    
      74
    
      75  cat <<'EOF' > "${pkgdir}/usr/bin/battle-cats-rolls-run"
    
      76#!/bin/bash
    
      77
    
      78echo "=================================================="
    
      79echo "          BATTLE CATS ROLLS LOCAL SERVER          "
    
      80echo "=================================================="
    
      81echo ""
    
      82
    
      83if ! systemctl is-active --quiet memcached; then
    
      84    echo ":: memcached is required for caching database records."
    
      85    echo ":: Please enter your password to start the service:"
    
      86    if ! sudo systemctl start memcached; then
    
      87        echo "[-] Failed to start memcached. Press Enter to exit."
    
      88        read -r
    
      89        exit 1
    
      90    fi
    
      91    echo ""
    
      92fi
    
      93
    
      94cd "/usr/share/webapps/battle-cats-rolls" || exit
    
      95export GEM_HOME="/usr/share/webapps/battle-cats-rolls/vendor/bundle"
    
      96export PATH="$PATH:$GEM_HOME/bin"
    
      97
    
      98LOCAL_IP=$(ip route get 1.1.1.1 2>/dev/null | grep -oP 'src \K\S+')
    
      99[ -z "$LOCAL_IP" ] && LOCAL_IP="127.0.0.1"
    
      100
    
      101# Monitor ativo em background aguardando o warmup estável do yahns
    
      102(
    
      103    echo ":: Waiting for local service initialization..."
    
      104    until curl -s -o /dev/null -w "%{http_code}" http://localhost:8080 | grep -q "200" 2>/dev/null; do
    
      105        sleep 0.5
    
      106    done
    
      107    echo ":: Server is up and stable! Launching local instance in your browser..."
    
      108    xdg-open "http://localhost:8080"
    
      109) &
    
      110
    
      111echo ":: Starting application stack..."
    
      112echo ":: Local Address:  http://localhost:8080"
    
      113echo ":: Network Access: http://${LOCAL_IP}:8080"
    
      114echo ":: To stop the server, simply close this terminal window."
    
      115echo "--------------------------------------------------"
    
      116if ! bundle exec ./bin/server; then
    
      117    echo ""
    
      118    echo "[-] Server crashed or failed to start."
    
      119    echo ":: Press Enter to close this window."
    
      120    read -r
    
      121fi
    
      122EOF
    
      123  chmod +x "${pkgdir}/usr/bin/battle-cats-rolls-run"
    
      124
    
      125  cat <<'EOF' > "${pkgdir}/usr/bin/battle-cats-rolls-launcher"
    
      126#!/bin/bash
    
      127
    
      128TERMINALS=('kitty' 'alacritty' 'ghostty' 'foot' 'gnome-terminal' 'konsole' 'xfce4-terminal' 'terminator' 'guake' 'yakuake')
    
      129FOUND_TERM=""
    
      130
    
      131for term in "${TERMINALS[@]}"; do
    
      132    if command -v "$term" &> /dev/null; then
    
      133        FOUND_TERM="$term"
    
      134        break
    
      135    fi
    
      136done
    
      137
    
      138if [ -z "$FOUND_TERM" ]; then
    
      139    if command -v zenity &> /dev/null; then
    
      140        FOUND_TERM=$(zenity --entry --title="Battle Cats Rolls" --text="Nenhum terminal padrão foi detectado.\nPor favor, digite o comando do seu emulador de terminal:")
    
      141    fi
    
      142    if [ -z "$FOUND_TERM" ]; then
    
      143        exit 1
    
      144    fi
    
      145fi
    
      146
    
      147case "$FOUND_TERM" in
    
      148    "kitty" | "foot")
    
      149        $FOUND_TERM /usr/bin/battle-cats-rolls-run
    
      150        ;;
    
      151    "alacritty" | "ghostty" | "terminator" | "guake" | "yakuake")
    
      152        $FOUND_TERM -e /usr/bin/battle-cats-rolls-run
    
      153        ;;
    
      154    "gnome-terminal" | "konsole" | "xfce4-terminal")
    
      155        $FOUND_TERM -- /usr/bin/battle-cats-rolls-run
    
      156        ;;
    
      157    *)
    
      158        $FOUND_TERM -e /usr/bin/battle-cats-rolls-run
    
      159        ;;
    
      160esac
    
      161EOF
    
      162  chmod +x "${pkgdir}/usr/bin/battle-cats-rolls-launcher"
    
      163
    
      164  cat <<EOF > "${pkgdir}/usr/share/applications/battle-cats-rolls.desktop"
    
      165[Desktop Entry]
    
      166Version=1.0
    
      167Type=Application
    
      168Name=Battle Cats Rolls
    
      169Comment=Launch the local seed tracking engine inside a terminal window
    
      170Exec=/usr/bin/battle-cats-rolls-launcher
    
      171Icon=battle-cats-rolls
    
      172Terminal=false
    
      173Categories=Game;Utility;
    
      174StartupNotify=true
    
      175EOF
    
      176}
    
      177

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	4
2026-07-27 00:24:32	LOW	4
2026-07-26 00:07:32	LOW	4
2026-07-25 00:13:44	LOW	4
2026-07-24 00:02:28	LOW	4
2026-07-23 00:14:47	LOW	4
2026-07-22 00:29:32	LOW	4
2026-07-21 00:24:15	LOW	4
2026-07-20 00:19:49	LOW	4
2026-07-19 00:17:08	LOW	4
2026-07-18 00:14:48	LOW	4
2026-07-17 00:06:16	LOW	4
2026-07-16 00:05:41	LOW	4
2026-07-15 00:09:25	LOW	4