betasharp-git

LOW

maintainer tomast1337 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

Builds from the project's own git repository on git.gay (a legitimate Gitea forge), compiles with dotnet, and installs normally; the non-whitelisted host is plausibly the project's own infrastructure, and no unverifiable prebuilt binaries or obfuscated payloads are present. The SKIP'd checksums on a git source and a bundled desktop file are standard for VCS packages and pose minimal risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Builds from the project's own git repository on git.gay (a legitimate Gitea forge), compiles with dotnet, and installs normally; the non-whitelisted host is plausibly the project's own infrastructure, and no unverifiable prebuilt binaries or obfuscated payloads are present. The SKIP'd checksums on a git source and a bundled desktop file are standard for VCS packages and pose minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("$pkgname::git+https://git.gay/betasharp-official/betasharp.git#branch=main"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nicolas Vyčas Nery <vycasnicolas@gmail.com>
    
      2pkgname=betasharp-git
    
      3pkgver=r1160.g6033c372
    
      4pkgrel=2
    
      5pkgdesc="Enhanced recreation of Minecraft Beta 1.7.3 (launcher, client, server)"
    
      6arch=('x86_64')
    
      7url="https://git.gay/betasharp-official/betasharp"
    
      8license=('MIT')
    
      9depends=('gtk3' 'webkit2gtk-4.1')
    
      10makedepends=('dotnet-sdk' 'git')
    
      11provides=('betasharp')
    
      12conflicts=('betasharp')
    
      13source=("$pkgname::git+https://git.gay/betasharp-official/betasharp.git#branch=main"
    
      14        "betasharp.desktop")
    
      15sha256sums=('SKIP'
    
      16            'SKIP')
    
      17
    
      18pkgver() {
    
      19    cd "$pkgname"
    
      20    printf "r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      21}
    
      22
    
      23build() {
    
      24    cd "$pkgname"
    
      25    export DOTNET_CLI_TELEMETRY_OPTOUT=1
    
      26    export DOTNET_NOLOGO=1
    
      27    dotnet publish BetaSharp.Launcher \
    
      28        --configuration Release \
    
      29        --runtime linux-x64 \
    
      30        --self-contained true \
    
      31        --output publish
    
      32}
    
      33
    
      34package() {
    
      35    cd "$pkgname"
    
      36
    
      37    install -dm755 "$pkgdir/usr/lib/betasharp"
    
      38    cp -r publish/. "$pkgdir/usr/lib/betasharp/"
    
      39    find "$pkgdir/usr/lib/betasharp" -type f -exec chmod 644 {} \;
    
      40    chmod 755 "$pkgdir/usr/lib/betasharp/BetaSharp.Launcher"
    
      41    chmod 755 "$pkgdir/usr/lib/betasharp/Client/BetaSharp.Client"
    
      42    chmod 755 "$pkgdir/usr/lib/betasharp/Server/BetaSharp.Server"
    
      43
    
      44    # Launcher writes the downloaded game jar next to its own binary
    
      45    # (AppContext.BaseDirectory/Client|Server), which is read-only under
    
      46    # /usr/lib. Stage a per-user writable copy in XDG_DATA_HOME and run
    
      47    # from there instead; re-stage whenever the installed version changes.
    
      48    install -dm755 "$pkgdir/usr/bin"
    
      49    cat > "$pkgdir/usr/bin/betasharp" <<EOF
    
      50#!/bin/sh
    
      51set -e
    
      52PKGVER="$pkgver-$pkgrel"
    
      53DEST="\${XDG_DATA_HOME:-\$HOME/.local/share}/betasharp"
    
      54STAMP="\$DEST/.installed-version"
    
      55if [ ! -f "\$STAMP" ] || [ "\$(cat "\$STAMP")" != "\$PKGVER" ]; then
    
      56    mkdir -p "\$DEST"
    
      57    cp -rf /usr/lib/betasharp/. "\$DEST/"
    
      58    echo "\$PKGVER" > "\$STAMP"
    
      59fi
    
      60cd "\$DEST"
    
      61exec "\$DEST/BetaSharp.Launcher" "\$@"
    
      62EOF
    
      63    chmod 755 "$pkgdir/usr/bin/betasharp"
    
      64
    
      65    install -Dm644 "$srcdir/betasharp.desktop" \
    
      66        "$pkgdir/usr/share/applications/betasharp.desktop"
    
      67    install -Dm644 BetaSharp.Launcher/logo.png \
    
      68        "$pkgdir/usr/share/pixmaps/betasharp.png"
    
      69
    
      70    install -Dm644 LICENSE.md \
    
      71        "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2