cactus-client

maintainer rXelelo · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt binary (DDNet executable) from a personal/unofficial host (dw.cactuss.top) rather than building from source or pulling from an official upstream release mirror. The binary is executed directly by users. While a sha256sum is provided, it only guards against accidental corruption — if the host operator replaces the tarball with a new one at the same URL and updates the PKGBUILD, or if the host is compromised, users would execute arbitrary code. The host 'cactuss.top' appears to be a personal/community site for this DDRaceNetwork mod, not an established official vendor. Additionally, there is a version mismatch bug: the wrapper script hardcodes version 1.14 while the package is 1.15, and the icon is installed to the wrong path relative to what the desktop file references — but these are correctness issues, not security ones. The core concern is a prebuilt binary from a non-official personal host, which is a genuine medium-severity supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://dw.cactuss.top/$_version/Cactus-$_version-public-linux_x86_64.tar.xz" "cactus-client.png")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads and installs a prebuilt binary (DDNet executable) from a personal/unofficial host (dw.cactuss.top) rather than building from source or pulling from an official upstream release mirror. The binary is executed directly by users. While a sha256sum is provided, it only guards against accidental corruption — if the host operator replaces the tarball with a new one at the same URL and updates the PKGBUILD, or if the host is compromised, users would execute arbitrary code. The host 'cactuss.top' appears to be a personal/community site for this DDRaceNetwork mod, not an established official vendor. Additionally, there is a version mismatch bug: the wrapper script hardcodes version 1.14 while the package is 1.15, and the icon is installed to the wrong path relative to what the desktop file references — but these are correctness issues, not security ones. The core concern is a prebuilt binary from a non-official personal host, which is a genuine medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rain Xelelo <rxelelo@outlook.com>
    
      2
    
      3pkgname=cactus-client
    
      4pkgver=1.15
    
      5pkgrel=1
    
      6# allow testing locally a release candidate using pkgver like '19.3rc3'
    
      7_version=${pkgver/rc/-rc}
    
      8pkgdesc="A DDRaceNetwork modification adding new feauters"
    
      9arch=('x86_64')
    
      10url="https://cactuss.top//"
    
      11license=()
    
      12depends=('freetype2' 'opusfile' 'curl' 'glew' 'wavpack' 'ffmpeg' 'libnotify' 'miniupnpc' 'sqlite' 'mariadb-libs' 'vulkan-icd-loader')
    
      13checkdepends=('gmock')
    
      14optdepends=('ddnet-maps-git: All the maps used on the official DDNet Servers.'
    
      15            'discord-game-sdk: Enable rich presence in Discord desktop client.')
    
      16backup=('usr/share/ddnet/data/autoexec_server.cfg')
    
      17
    
      18source=("https://dw.cactuss.top/$_version/Cactus-$_version-public-linux_x86_64.tar.xz" "cactus-client.png")
    
      19sha256sums=('70b5afcdbf7f8ec875780391b2238a29dec3fc2c420bc72f7dbfaf86d56f397b'
    
      20            '8508552983950820bd5c8829bd43e714a4a958a084211dc1a8be6619f8d0b742')
    
      21
    
      22prepare() {
    
      23    mkdir -p cactus
    
      24    bsdtar -xf "Cactus-$_version-public-linux_x86_64.tar.xz" -C cactus
    
      25    chmod +x cactus/Cactus-$_version-public-linux_x86_64/DDNet
    
      26}
    
      27
    
      28
    
      29package() {
    
      30    install -dm0755 "$pkgdir/opt"
    
      31    install -dm0755 "$pkgdir/usr/bin"
    
      32    install -dm0755 "$pkgdir/usr/share/applications"
    
      33    cp -a cactus "$pkgdir/opt/$pkgname"
    
      34    cat > "$pkgdir/usr/bin/cactus-client"  << EOF
    
      35#!/bin/bash
    
      36exec /opt/cactus-client/Cactus-1.14-public-linux_x86_64/DDNet
    
      37EOF
    
      38    chmod +x $pkgdir/usr/bin/cactus-client
    
      39    cat > "$pkgdir/usr/share/applications/cactus-client.desktop"  << EOF
    
      40[Desktop Entry]
    
      41Version=1.14
    
      42Name=Cactus Client
    
      43StartupNotify=true
    
      44TryExec=cactus-client
    
      45Exec=cactus-client
    
      46Terminal=false
    
      47Icon=/opt/cactus-client/cactus-client.png
    
      48Type=Application
    
      49Categories=Game
    
      50EOF
    
      51    install -Dm0644 "$srcdir/cactus-client.png" "$pkgdir/opt/cactus-client/cactus-client.png"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2