cactus-client

MEDIUM

maintainer rXelelo 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

This PKGBUILD downloads and installs a prebuilt binary (DDNet executable) from a personal/unofficial host (dw.cactuss.top) rather than building from source or pulling from an official upstream release mirror. The binary is executed directly by users. While a sha256sum is provided, it only guards against accidental corruption — if the host operator replaces the tarball with a new one at the same URL and updates the PKGBUILD, or if the host is compromised, users would execute arbitrary code. The host 'cactuss.top' appears to be a personal/community site for this DDRaceNetwork mod, not an established official vendor. Additionally, there is a version mismatch bug: the wrapper script hardcodes version 1.14 while the package is 1.15, and the icon is installed to the wrong path relative to what the desktop file references — but these are correctness issues, not security ones. The core concern is a prebuilt binary from a non-official personal host, which is a genuine medium-severity supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://dw.cactuss.top/$_version/Cactus-$_version-public-linux_x86_64.tar.xz" "cactus-client.png")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads and installs a prebuilt binary (DDNet executable) from a personal/unofficial host (dw.cactuss.top) rather than building from source or pulling from an official upstream release mirror. The binary is executed directly by users. While a sha256sum is provided, it only guards against accidental corruption — if the host operator replaces the tarball with a new one at the same URL and updates the PKGBUILD, or if the host is compromised, users would execute arbitrary code. The host 'cactuss.top' appears to be a personal/community site for this DDRaceNetwork mod, not an established official vendor. Additionally, there is a version mismatch bug: the wrapper script hardcodes version 1.14 while the package is 1.15, and the icon is installed to the wrong path relative to what the desktop file references — but these are correctness issues, not security ones. The core concern is a prebuilt binary from a non-official personal host, which is a genuine medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rain Xelelo <rxelelo@outlook.com>
    
      2
    
      3pkgname=cactus-client
    
      4pkgver=1.15
    
      5pkgrel=1
    
      6# allow testing locally a release candidate using pkgver like '19.3rc3'
    
      7_version=${pkgver/rc/-rc}
    
      8pkgdesc="A DDRaceNetwork modification adding new feauters"
    
      9arch=('x86_64')
    
      10url="https://cactuss.top//"
    
      11license=()
    
      12depends=('freetype2' 'opusfile' 'curl' 'glew' 'wavpack' 'ffmpeg' 'libnotify' 'miniupnpc' 'sqlite' 'mariadb-libs' 'vulkan-icd-loader')
    
      13checkdepends=('gmock')
    
      14optdepends=('ddnet-maps-git: All the maps used on the official DDNet Servers.'
    
      15            'discord-game-sdk: Enable rich presence in Discord desktop client.')
    
      16backup=('usr/share/ddnet/data/autoexec_server.cfg')
    
      17
    
      18source=("https://dw.cactuss.top/$_version/Cactus-$_version-public-linux_x86_64.tar.xz" "cactus-client.png")
    
      19sha256sums=('70b5afcdbf7f8ec875780391b2238a29dec3fc2c420bc72f7dbfaf86d56f397b'
    
      20            '8508552983950820bd5c8829bd43e714a4a958a084211dc1a8be6619f8d0b742')
    
      21
    
      22prepare() {
    
      23    mkdir -p cactus
    
      24    bsdtar -xf "Cactus-$_version-public-linux_x86_64.tar.xz" -C cactus
    
      25    chmod +x cactus/Cactus-$_version-public-linux_x86_64/DDNet
    
      26}
    
      27
    
      28
    
      29package() {
    
      30    install -dm0755 "$pkgdir/opt"
    
      31    install -dm0755 "$pkgdir/usr/bin"
    
      32    install -dm0755 "$pkgdir/usr/share/applications"
    
      33    cp -a cactus "$pkgdir/opt/$pkgname"
    
      34    cat > "$pkgdir/usr/bin/cactus-client"  << EOF
    
      35#!/bin/bash
    
      36exec /opt/cactus-client/Cactus-1.14-public-linux_x86_64/DDNet
    
      37EOF
    
      38    chmod +x $pkgdir/usr/bin/cactus-client
    
      39    cat > "$pkgdir/usr/share/applications/cactus-client.desktop"  << EOF
    
      40[Desktop Entry]
    
      41Version=1.14
    
      42Name=Cactus Client
    
      43StartupNotify=true
    
      44TryExec=cactus-client
    
      45Exec=cactus-client
    
      46Terminal=false
    
      47Icon=/opt/cactus-client/cactus-client.png
    
      48Type=Application
    
      49Categories=Game
    
      50EOF
    
      51    install -Dm0644 "$srcdir/cactus-client.png" "$pkgdir/opt/cactus-client/cactus-client.png"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2