cheatengine-bin

maintainer lapsus · 3 votes · scanned 2026-08-18 15:40:04.149666

MEDIUM

Why flagged curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:128 curl -fsSL https://cheatengine.org/downloads.php |

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("CheatEngineLinux${pkgver/./}.zip::https://cheatengine.org/download/CheatEngineLinux${pkgver/./}.zip"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2pkgname=cheatengine-bin
    
      3pkgver=7.7
    
      4pkgrel=3
    
      5pkgdesc="Memory scanner/debugger for game hacking and reverse engineering"
    
      6arch=('x86_64')
    
      7url="https://cheatengine.org"
    
      8license=('LicenseRef-CheatEngine')
    
      9depends=('qt6-base' 'libx11' 'glibc')
    
      10makedepends=('python')
    
      11provides=('cheatengine')
    
      12conflicts=('cheatengine')
    
      13options=('!strip' '!debug')
    
      14source=("CheatEngineLinux${pkgver/./}.zip::https://cheatengine.org/download/CheatEngineLinux${pkgver/./}.zip"
    
      15        "user-overlay.lua")
    
      16sha256sums=('1e3c312061a270e67c67cf215cc1640027270bdea66fd2793dd156414992f6d4'
    
      17            '7b0341d55bb5e16d473783eb7a5ab29552e3a91ab3f9a3f0aa9f79cebafe29c5')
    
      18
    
      19_instdir="usr/lib/cheatengine"
    
      20
    
      21package() {
    
      22    install -dm755 "${pkgdir}/${_instdir}"
    
      23
    
      24    # Main binaries
    
      25    install -Dm755 cheatengine-x86_64 "${pkgdir}/${_instdir}/cheatengine-x86_64"
    
      26    install -Dm755 tutorial-x86_64 "${pkgdir}/${_instdir}/tutorial-x86_64"
    
      27    install -Dm755 gtutorial-x86_64 "${pkgdir}/${_instdir}/gtutorial-x86_64"
    
      28
    
      29    # Bundled shared libraries (RUNPATH=$ORIGIN + dlopen from CWD)
    
      30    for lib in libQt6Pas.so.6 liblua53.so libtcc-64.so libtcc-64-windows.so libtcc-32.so libtcc-32-windows.so libtcc-arm64.so \
    
      31               libcrypt.so.1.1.0 libcrypto.so.1.1 libssl.so.1.1 \
    
      32               libceapi.so libceserver-extension_x86_64_linux.so libceserver-extension_x86_linux.so libceserver-extension_i386_linux.so; do
    
      33        install -Dm755 "$lib" "${pkgdir}/${_instdir}/$lib"
    
      34    done
    
      35
    
      36    # Data files and scripts
    
      37    for dir in autorun Extensions languages badassets lua include; do
    
      38        cp -r --no-preserve=ownership "$dir" "${pkgdir}/${_instdir}/"
    
      39    done
    
      40
    
      41    find "${pkgdir}/${_instdir}"/{autorun,Extensions,languages,badassets,lua,include} \
    
      42         -type d -exec chmod 755 {} +
    
      43    find "${pkgdir}/${_instdir}"/{autorun,Extensions,languages,badassets,lua,include} \
    
      44         -type f -exec chmod 644 {} +
    
      45    find "${pkgdir}/${_instdir}"/{autorun,Extensions,languages,badassets,lua,include} \
    
      46         -type f -name '*.so' -exec chmod 755 {} +
    
      47
    
      48    # Config and data files
    
      49    install -Dm644 main.lua "${pkgdir}/${_instdir}/main.lua"
    
      50    install -Dm644 "${srcdir}/user-overlay.lua" "${pkgdir}/${_instdir}/user-overlay.lua"
    
      51    install -Dm644 defines.lua "${pkgdir}/${_instdir}/defines.lua"
    
      52    install -Dm644 celua.txt "${pkgdir}/${_instdir}/celua.txt"
    
      53    install -Dm644 readme-linux.txt "${pkgdir}/${_instdir}/readme-linux.txt"
    
      54
    
      55    # License
    
      56    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      57
    
      58    # Launcher: CE resolves its content dir from /proc/self/exe (symlinks
    
      59    # cannot relocate it) and dlopens some libs CWD-relative, so it runs from
    
      60    # a per-user dir whose CWD-shadowed main.lua (user-overlay.lua) provides
    
      61    # per-user autorun scripts on top of the read-only packaged tree.
    
      62    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/cheatengine" <<'EOF'
    
      63#!/bin/sh
    
      64pkgdir=/usr/lib/cheatengine
    
      65userdir="${XDG_DATA_HOME:-$HOME/.local/share}/cheatengine"
    
      66
    
      67if mkdir -p "$userdir/autorun" 2>/dev/null; then
    
      68    # .so symlinks for CWD-relative dlopen; never touch user-placed files/links
    
      69    for lib in "$pkgdir"/*.so*; do
    
      70        dest="$userdir/${lib##*/}"
    
      71        [ ! -e "$dest" ] && [ ! -L "$dest" ] && ln -s "$lib" "$dest"
    
      72    done
    
      73    # drop our own symlinks left dangling by an upstream lib removal
    
      74    for link in "$userdir"/*.so*; do
    
      75        if [ -L "$link" ] && [ ! -e "$link" ]; then
    
      76            case "$(readlink "$link")" in "$pkgdir"/*) rm -f "$link";; esac
    
      77        fi
    
      78    done
    
      79    if [ ! -e "$userdir/main.lua" ] && [ ! -L "$userdir/main.lua" ]; then
    
      80        ln -s "$pkgdir/user-overlay.lua" "$userdir/main.lua"
    
      81    fi
    
      82    if [ "$(readlink "$userdir/main.lua" 2>/dev/null)" = "$pkgdir/user-overlay.lua" ]; then
    
      83        # our overlay main.lua re-runs the autorun scan with user precedence
    
      84        cd "$userdir" && exec "$pkgdir/cheatengine-x86_64" NOAUTORUN "$@"
    
      85    elif [ -f "$userdir/main.lua" ]; then
    
      86        # user-authored main.lua: upstream shadow semantics, native autorun
    
      87        cd "$userdir" && exec "$pkgdir/cheatengine-x86_64" "$@"
    
      88    fi
    
      89fi
    
      90# unusable user dir: stock packaged behavior
    
      91cd "$pkgdir" || exit 1
    
      92exec ./cheatengine-x86_64 "$@"
    
      93EOF
    
      94
    
      95    # Desktop entry
    
      96    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/cheatengine.desktop" <<'EOF'
    
      97[Desktop Entry]
    
      98Name=Cheat Engine
    
      99Comment=Memory scanner/debugger for game hacking and reverse engineering
    
      100Exec=cheatengine
    
      101Icon=cheatengine
    
      102Terminal=false
    
      103Type=Application
    
      104Categories=Development;Debugger;
    
      105EOF
    
      106
    
      107    # Extract largest 128x128 PNG from binary (Lazarus-embedded app icon)
    
      108    python3 -c "
    
      109import struct
    
      110with open('cheatengine-x86_64','rb') as f: d=f.read()
    
      111m,p,best=b'\x89PNG\r\n\x1a\n',0,None
    
      112while True:
    
      113    p=d.find(m,p)
    
      114    if p<0: break
    
      115    e=d.find(b'IEND',p)
    
      116    if e>0:
    
      117        sz=e-p+8; c=d[p:p+sz]
    
      118        w,h=struct.unpack('>II',c[16:24])
    
      119        if w==128 and h==128 and (not best or sz>best[1]):
    
      120            best=(p,sz)
    
      121    p+=8
    
      122open('icon.png','wb').write(d[best[0]:best[0]+best[1]])
    
      123"
    
      124    install -Dm644 icon.png "${pkgdir}/usr/share/pixmaps/cheatengine.png"
    
      125}
    
      126
    
      127latestver() {
    
      128    curl -fsSL https://cheatengine.org/downloads.php |
    
      129        grep -aoP 'Download Cheat Engine \K[0-9]+(\.[0-9]+)+(?= For Linux)'
    
      130}
    
      131

Changes since previous scan

--- PKGBUILD @ 2026-07-04 00:27
+++ PKGBUILD @ 2026-08-18 15:40
@@ -1,7 +1,7 @@
 # Maintainer: Yakov Till <yakov.till@gmail.com>
 pkgname=cheatengine-bin
 pkgver=7.7
-pkgrel=1
+pkgrel=3
 pkgdesc="Memory scanner/debugger for game hacking and reverse engineering"
 arch=('x86_64')
 url="https://cheatengine.org"
@@ -11,14 +11,14 @@
 provides=('cheatengine')
 conflicts=('cheatengine')
 options=('!strip' '!debug')
-source=("CheatEngineLinux${pkgver/./}.zip::https://cheatengine.org/download/CheatEngineLinux${pkgver/./}.zip")
-sha256sums=('2effe9608015567372ccc95ed056564ffeed7d8290238e6378115b2e211dd7ae')
+source=("CheatEngineLinux${pkgver/./}.zip::https://cheatengine.org/download/CheatEngineLinux${pkgver/./}.zip"
+        "user-overlay.lua")
+sha256sums=('1e3c312061a270e67c67cf215cc1640027270bdea66fd2793dd156414992f6d4'
+            '7b0341d55bb5e16d473783eb7a5ab29552e3a91ab3f9a3f0aa9f79cebafe29c5')
 
 _instdir="usr/lib/cheatengine"
 
 package() {
-    cd "CheatEngineLinux${pkgver/./}"
-
     install -dm755 "${pkgdir}/${_instdir}"
 
     # Main binaries
@@ -27,9 +27,9 @@
     install -Dm755 gtutorial-x86_64 "${pkgdir}/${_instdir}/gtutorial-x86_64"
 
     # Bundled shared libraries (RUNPATH=$ORIGIN + dlopen from CWD)
-    for lib in libQt6Pas.so.6 liblua53.so libtcc-64.so libtcc-64-windows.so libtcc-arm64.so \
+    for lib in libQt6Pas.so.6 liblua53.so libtcc-64.so libtcc-64-windows.so libtcc-32.so libtcc-32-windows.so libtcc-arm64.so \
                libcrypt.so.1.1.0 libcrypto.so.1.1 libssl.so.1.1 \
-               libceapi.so libceserver-extension_x86_64_linux.so; do
+               libceapi.so libceserver-extension_x86_64_linux.so libceserver-extension_x86_linux.so libceserver-extension_i386_linux.so; do
         install -Dm755 "$lib" "${pkgdir}/${_instdir}/$lib"
     done
 
@@ -47,20 +47,48 @@
 
     # Config and data files
     install -Dm644 main.lua "${pkgdir}/${_instdir}/main.lua"
+    install -Dm644 "${srcdir}/user-overlay.lua" "${pkgdir}/${_instdir}/user-overlay.lua"
     install -Dm644 defines.lua "${pkgdir}/${_instdir}/defines.lua"
     install -Dm644 celua.txt "${pkgdir}/${_instdir}/celua.txt"
-    install -Dm644 commonmodulelist.txt "${pkgdir}/${_instdir}/commonmodulelist.txt"
-    install -Dm644 donottrace.txt "${pkgdir}/${_instdir}/donottrace.txt"
-    install -Dm644 dependencies.txt "${pkgdir}/${_instdir}/dependencies.txt"
-    install -Dm644 ce.runtimeconfig.json "${pkgdir}/${_instdir}/ce.runtimeconfig.json"
+    install -Dm644 readme-linux.txt "${pkgdir}/${_instdir}/readme-linux.txt"
 
     # License
     install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 
-    # Wrapper script (binary dlopen's libs from CWD with relative paths)
+    # Launcher: CE resolves its content dir from /proc/self/exe (symlinks
+    # cannot relocate it) and dlopens some libs CWD-relative, so it runs from
+    # a per-user dir whose CWD-shadowed main.lua (user-overlay.lua) provides
+    # per-user autorun scripts on top of the read-only packaged tree.
     install -Dm755 /dev/stdin "${pkgdir}/usr/bin/cheatengine" <<'EOF'
 #!/bin/sh
-cd /usr/lib/cheatengine || exit 1
+pkgdir=/usr/lib/cheatengine
+userdir="${XDG_DATA_HOME:-$HOME/.local/share}/cheatengine"
+
+if mkdir -p "$userdir/autorun" 2>/dev/null; then
+    # .so symlinks for CWD-relative dlopen; never touch user-placed files/links
+    for lib in "$pkgdir"/*.so*; do
+        dest="$userdir/${lib##*/}"
+        [ ! -e "$dest" ] && [ ! -L "$dest" ] && ln -s "$lib" "$dest"
+    done
+    # drop our own symlinks left dangling by an upstream lib removal
+    for link in "$userdir"/*.so*; do
+        if [ -L "$link" ] && [ ! -e "$link" ]; then
+            case "$(readlink "$link")" in "$pkgdir"/*) rm -f "$link";; esac
+        fi
+    done
+    if [ ! -e "$userdir/main.lua" ] && [ ! -L "$userdir/main.lua" ]; then
+        ln -s "$pkgdir/user-overlay.lua" "$userdir/main.lua"
+    fi
+    if [ "$(readlink "$userdir/main.lua" 2>/dev/null)" = "$pkgdir/user-overlay.lua" ]; then
+        # our overlay main.lua re-runs the autorun scan with user precedence
+        cd "$userdir" && exec "$pkgdir/cheatengine-x86_64" NOAUTORUN "$@"
+    elif [ -f "$userdir/main.lua" ]; then
+        # user-authored main.lua: upstream shadow semantics, native autorun
+        cd "$userdir" && exec "$pkgdir/cheatengine-x86_64" "$@"
+    fi
+fi
+# unusable user dir: stock packaged behavior
+cd "$pkgdir" || exit 1
 exec ./cheatengine-x86_64 "$@"
 EOF
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 15:40:04	MEDIUM	2
2026-07-05 00:27:08	CLEAN	3
2026-07-04 21:15:10	MEDIUM	2
2026-07-04 00:27:25	LOW	3
2026-07-03 00:17:07	LOW	3
2026-07-02 18:47:07	LOW	3
2026-07-02 00:22:12	LOW	3
2026-07-01 00:30:02	LOW	3
2026-06-30 00:15:06	LOW	3
2026-06-29 00:20:06	LOW	3
2026-06-28 00:09:41	LOW	3
2026-06-27 00:00:51	LOW	3
2026-06-26 00:27:06	LOW	3
2026-06-25 00:08:41	LOW	3
2026-06-24 00:08:06	LOW	3
2026-06-23 00:13:55	LOW	3
2026-06-22 00:29:40	LOW	3
2026-06-21 00:26:06	LOW	4
2026-06-20 00:50:07	LOW	4
2026-06-20 00:18:46	MEDIUM	3