boosteroid
maintainer dj_pask
· 9 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a .deb and its MD5 from the official boosteroid.com domain, verifies the checksum and version, then extracts and installs it; this is a normal build process for a proprietary binary from the project's official source, not a supply-chain risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a .deb and its MD5 from the official boosteroid.com domain, verifies the checksum and version, then extracts and installs it; this is a normal build process for a proprietary binary from the project's official source, not a supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
"${_custom_name}.deb::https://boosteroid.com/linux/installer/boosteroid-install-x64.deb"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dj_pask
2
# former maintainer: envolution
3
# Contributor: Felix Braun <hazzl@falix.de>
4
# Contributor: Laurinyecz Zalán <laurinyeczzalan@gmail.com>
5
# Contributor: Ernesto Castellotti <mail@ernestocastellotti.it>
6
# shellcheck shell=bash disable=SC2034,SC2154
7
# 14.04.2026 dj_pask new mantainer
8
9
pkgname=boosteroid
10
pkgver=1.10.22
11
pkgrel=1
12
pkgdesc="Boosteroid client desktop"
13
arch=('x86_64')
14
url="https://boosteroid.com/downloads"
15
license=('custom')
16
options=(!debug)
17
depends=("libva" "libvdpau" "libxcb" "traceroute" "ocl-icd" "pcre2" "libxi" "xcb-util-wm" "xcb-util-image" "xcb-util-renderutil" "xcb-util-keysyms" "xcb-util-keysyms" "fontconfig" "alsa-lib" "pulseaudio-alsa")
18
makedepends=("binutils" "tar" "coreutils" "wget")
19
20
_custom_name="${pkgname^}-${pkgver}-${CARCH}"
21
22
# Set Mozilla as curl useragent to circumvent 403 using curl
23
DLAGENTS=("https::/usr/bin/curl -A 'Mozilla' -fLC - --retry 3 --retry-delay 3 -o %o %u")
24
25
source=(
26
"${_custom_name}.deb::https://boosteroid.com/linux/installer/boosteroid-install-x64.deb"
27
"${_custom_name}.md5::https://boosteroid.com/linux/installer/boosteroid-install-x64.md5"
28
boosteroid.sh
29
)
30
md5sums=('8b568c6b6eb6b72148c2615b705241e6'
31
'3ae22a527747a4dde6bb2652e9cdca15'
32
'033cc5b68298d0fe7d36887b5db6f200')
33
noextract=("${_custom_name}.deb")
34
35
prepare() {
36
#prep deb file for installation
37
msg2 "Decompressing Debian package..."
38
ar xv "${_custom_name}.deb" >/dev/null
39
#tar -xf data.tar.bz2 >/dev/null
40
tar -xf data.tar.xz >/dev/null
41
tar -xf control.tar.gz >/dev/null
42
43
#Versioning confirmation and MD5 verification
44
local _version
45
_version=$(grep -oP "Version: \K[0-9.]+" ./control)
46
msg2 "Detected Debian package version ${_version} ..."
47
msg2 "PKGBUILD package version ${pkgver} ..."
48
[ "${_version}" != "${pkgver}" ] && exit 1
49
msg2 "Checking boosteroid accompanied archive md5 against downloaded installer..."
50
md5sum -c "${_custom_name}.md5" >/dev/null
51
52
#this is the system desktop, which later becomes obsolete as the binary creates a user version in $HOME
53
msg2 "Customising desktop file..."
54
sed -i "s/Exec=.*/Exec=\/usr\/bin\/${pkgname}/g" usr/share/applications/Boosteroid.desktop
55
sed -i "s/Icon=.*/Icon=\/usr\/share\/icons\/hicolor\/scalable\/apps\/${pkgname}.svg/g" usr/share/applications/Boosteroid.desktop
56
}
57
58
package() {
59
install -dm755 "$pkgdir"/usr/bin
60
install -dm755 "$pkgdir"/usr/share/icons/hicolor/scalable/apps
61
install -dm755 "$pkgdir"/usr/share/{applications,icons/Boosteroid,licenses/Boosteroid}
62
install -m755 "opt/BoosteroidGamesS.R.L./bin/Boosteroid" "$pkgdir"/usr/bin/"$pkgname".bin #Isolate the binary for our wrapper boosteroid.sh
63
install -m755 boosteroid.sh "$pkgdir"/usr/bin/"${pkgname^}" #The program binary creates a user desktop file pointing to /usr/bin/Boosteroid
64
ln -s "${pkgname^}" "$pkgdir"/usr/bin/"${pkgname}" #we link to /usr/bin/boosteroid
65
install -m644 usr/share/applications/Boosteroid.desktop "$pkgdir"/usr/share/applications/Boosteroid.desktop
66
install -m644 usr/share/icons/Boosteroid/icon.svg "$pkgdir"/usr/share/icons/hicolor/scalable/apps/boosteroid.svg
67
install -m644 opt/BoosteroidGamesS.R.L./bin/ToU.txt "$pkgdir"/usr/share/licenses/Boosteroid/ToU.txt
68
}
69
70
# vim:set ts=2 sw=2 et:
71
Changes since previous scan
--- PKGBUILD @ 2026-07-31 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -7,7 +7,7 @@ # 14.04.2026 dj_pask new mantainer pkgname=boosteroid-pkgver=1.10.14+pkgver=1.10.22 pkgrel=1 pkgdesc="Boosteroid client desktop" arch=('x86_64')@@ -27,8 +27,8 @@ "${_custom_name}.md5::https://boosteroid.com/linux/installer/boosteroid-install-x64.md5" boosteroid.sh )-md5sums=('0c7815d4834bb187fe20cc90109468b8'- '535e750288ded71a82cf84b5b7cfec2f'+md5sums=('8b568c6b6eb6b72148c2615b705241e6'+ '3ae22a527747a4dde6bb2652e9cdca15' '033cc5b68298d0fe7d36887b5db6f200') noextract=("${_custom_name}.deb") Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 15:18:17 | MEDIUM | 1 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |