burgerspace

maintainer kleintux · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source tarball is fetched from a personal/unofficial OVH hosting domain (gvlsywt.cluster051.hosting.ovh.net) rather than the canonical upstream source. BurgerSpace is a known open-source game originally hosted on perso.b2b2c.ca by Peter Hyman, and this domain has no obvious connection to the official project. The compiled source is executed, so if the tarball were silently substituted on that host, it would result in arbitrary code execution during build. The sha512sum provides some integrity protection against tampering in transit, but does not protect against the host owner replacing the file with a new malicious tarball (the checksum would then mismatch, but the risk of undetected substitution remains if the checksum is also updated in the PKGBUILD). This is a genuine supply-chain concern: executed compiled source from an unofficial personal host, not the canonical upstream.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("http://gvlsywt.cluster051.hosting.ovh.net/dev/${pkgname}-${pkgver}.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source tarball is fetched from a personal/unofficial OVH hosting domain (gvlsywt.cluster051.hosting.ovh.net) rather than the canonical upstream source. BurgerSpace is a known open-source game originally hosted on perso.b2b2c.ca by Peter Hyman, and this domain has no obvious connection to the official project. The compiled source is executed, so if the tarball were silently substituted on that host, it would result in arbitrary code execution during build. The sha512sum provides some integrity protection against tampering in transit, but does not protect against the host owner replacing the file with a new malicious tarball (the checksum would then mismatch, but the risk of undetected substitution remains if the checksum is also updated in the PKGBUILD). This is a genuine supply-chain concern: executed compiled source from an unofficial personal host, not the canonical upstream.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kleintux <reg-archlinux AT klein DOT tuxli DOT ch> 
    
      2#Contributor : fpaskali <paskali2005 at gmail>
    
      3
    
      4pkgname=burgerspace
    
      5pkgver=1.10.0
    
      6pkgrel=2
    
      7pkgdesc="A hamburger-smashing video game"
    
      8arch=('any')
    
      9url="http://gvlsywt.cluster051.hosting.ovh.net/dev/burgerspace.html"
    
      10license=('GPL')
    
      11depends=('sdl2' 'sdl2_image' 'sdl2_mixer' 'sdl2_mixer' 'sdl2_gfx' 'libflatzebra')
    
      12source=("http://gvlsywt.cluster051.hosting.ovh.net/dev/${pkgname}-${pkgver}.tar.gz")
    
      13sha512sums=('7ce6fa48829414ff7a48cb038b87842112c18829769105f34a842bffcfe99072ed6201ba3772f98efd115b8ffd9de0d1d15dc9f8b80a5f978f5763b72a358d8c')
    
      14
    
      15build() {
    
      16  cd "$pkgname-$pkgver"
    
      17
    
      18  ./configure --prefix=/usr
    
      19  make
    
      20}
    
      21
    
      22package() {
    
      23  cd "$pkgname-$pkgver"
    
      24
    
      25  make DESTDIR="$pkgdir/" install
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2