boosteroid

LOW

maintainer dj_pask 9 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a .deb and its MD5 from the official boosteroid.com domain, verifies the checksum and version, then extracts and installs it; this is a normal build process for a proprietary binary from the project's official source, not a supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a .deb and its MD5 from the official boosteroid.com domain, verifies the checksum and version, then extracts and installs it; this is a normal build process for a proprietary binary from the project's official source, not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "${_custom_name}.deb::https://boosteroid.com/linux/installer/boosteroid-install-x64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dj_pask
    
      2# former maintainer: envolution
    
      3# Contributor: Felix Braun <hazzl@falix.de>
    
      4# Contributor: Laurinyecz Zalán <laurinyeczzalan@gmail.com>
    
      5# Contributor: Ernesto Castellotti <mail@ernestocastellotti.it>
    
      6# shellcheck shell=bash disable=SC2034,SC2154
    
      7# 14.04.2026 dj_pask new mantainer
    
      8
    
      9pkgname=boosteroid
    
      10pkgver=1.10.22
    
      11pkgrel=1
    
      12pkgdesc="Boosteroid client desktop"
    
      13arch=('x86_64')
    
      14url="https://boosteroid.com/downloads"
    
      15license=('custom')
    
      16options=(!debug)
    
      17depends=("libva" "libvdpau" "libxcb" "traceroute" "ocl-icd" "pcre2" "libxi" "xcb-util-wm" "xcb-util-image" "xcb-util-renderutil" "xcb-util-keysyms" "xcb-util-keysyms" "fontconfig" "alsa-lib" "pulseaudio-alsa")
    
      18makedepends=("binutils" "tar" "coreutils" "wget")
    
      19
    
      20_custom_name="${pkgname^}-${pkgver}-${CARCH}"
    
      21
    
      22# Set Mozilla as curl useragent to circumvent 403 using curl
    
      23DLAGENTS=("https::/usr/bin/curl -A 'Mozilla' -fLC - --retry 3 --retry-delay 3 -o %o %u")
    
      24
    
      25source=(
    
      26  "${_custom_name}.deb::https://boosteroid.com/linux/installer/boosteroid-install-x64.deb"
    
      27  "${_custom_name}.md5::https://boosteroid.com/linux/installer/boosteroid-install-x64.md5"
    
      28  boosteroid.sh
    
      29)
    
      30md5sums=('8b568c6b6eb6b72148c2615b705241e6'
    
      31         '3ae22a527747a4dde6bb2652e9cdca15'
    
      32         '033cc5b68298d0fe7d36887b5db6f200')
    
      33noextract=("${_custom_name}.deb")
    
      34
    
      35prepare() {
    
      36  #prep deb file for installation
    
      37  msg2 "Decompressing Debian package..."
    
      38  ar xv "${_custom_name}.deb" >/dev/null
    
      39  #tar -xf data.tar.bz2 >/dev/null
    
      40  tar -xf data.tar.xz >/dev/null
    
      41  tar -xf control.tar.gz >/dev/null
    
      42
    
      43  #Versioning confirmation and MD5 verification
    
      44  local _version
    
      45  _version=$(grep -oP "Version: \K[0-9.]+" ./control)
    
      46  msg2 "Detected Debian package version ${_version} ..."
    
      47  msg2 "PKGBUILD package version ${pkgver} ..."
    
      48  [ "${_version}" != "${pkgver}" ] && exit 1
    
      49  msg2 "Checking boosteroid accompanied archive md5 against downloaded installer..."
    
      50  md5sum -c "${_custom_name}.md5" >/dev/null
    
      51
    
      52  #this is the system desktop, which later becomes obsolete as the binary creates a user version in $HOME
    
      53  msg2 "Customising desktop file..."
    
      54  sed -i "s/Exec=.*/Exec=\/usr\/bin\/${pkgname}/g" usr/share/applications/Boosteroid.desktop
    
      55  sed -i "s/Icon=.*/Icon=\/usr\/share\/icons\/hicolor\/scalable\/apps\/${pkgname}.svg/g" usr/share/applications/Boosteroid.desktop
    
      56}
    
      57
    
      58package() {
    
      59  install -dm755 "$pkgdir"/usr/bin
    
      60  install -dm755 "$pkgdir"/usr/share/icons/hicolor/scalable/apps
    
      61  install -dm755 "$pkgdir"/usr/share/{applications,icons/Boosteroid,licenses/Boosteroid}
    
      62  install -m755 "opt/BoosteroidGamesS.R.L./bin/Boosteroid" "$pkgdir"/usr/bin/"$pkgname".bin #Isolate the binary for our wrapper boosteroid.sh
    
      63  install -m755 boosteroid.sh "$pkgdir"/usr/bin/"${pkgname^}"                               #The program binary creates a user desktop file pointing to /usr/bin/Boosteroid
    
      64  ln -s "${pkgname^}" "$pkgdir"/usr/bin/"${pkgname}"                                        #we link to /usr/bin/boosteroid
    
      65  install -m644 usr/share/applications/Boosteroid.desktop "$pkgdir"/usr/share/applications/Boosteroid.desktop
    
      66  install -m644 usr/share/icons/Boosteroid/icon.svg "$pkgdir"/usr/share/icons/hicolor/scalable/apps/boosteroid.svg
    
      67  install -m644 opt/BoosteroidGamesS.R.L./bin/ToU.txt "$pkgdir"/usr/share/licenses/Boosteroid/ToU.txt
    
      68}
    
      69
    
      70# vim:set ts=2 sw=2 et:
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2