chromapper-dev-bin

maintainer WasabiThumbs · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source files and a patch from a non-whitelisted host, but builds a known project (ChroMapper) and includes checksums for all downloaded files except a local Python script; the risk is low as the downloaded content is verifiable and the build process is transparent.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads source files and a patch from a non-whitelisted host, but builds a known project (ChroMapper) and includes checksums for all downloaded files except a local Python script; the risk is low as the downloaded content is verifiable and the build process is transparent.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://cm.topc.at/nix/${_stable}/Linux.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Xavier Pedraza <xpedraza542@gmail.com>
    
      2_stable=892
    
      3_build=975
    
      4_base=chromapper
    
      5pkgname="${_base}-dev-bin"
    
      6pkgver=0.14.975
    
      7pkgrel=1
    
      8pkgdesc='Unity-based map editor for Beat Saber (binary, dev)'
    
      9arch=(x86_64)
    
      10url='https://github.com/Caeden117/ChroMapper/'
    
      11license=('GPL-2.0-only')
    
      12provides=("${_base}=${pkgver}")
    
      13conflicts=("${_base}" "${_base}-dev" "${_base}-bin")
    
      14options=(!strip)
    
      15depends=(glibc libgcc)
    
      16makedepends=(python3 xdelta3)
    
      17noextract=("${_stable}.patch")
    
      18source=(
    
      19    "https://cm.topc.at/nix/${_stable}/Linux.tar.gz"
    
      20    "https://cm.topc.at/nix/${_build}/${_stable}.patch"
    
      21    "https://cm.topc.at/cm.svg"
    
      22    "apply-patch.py"
    
      23)
    
      24sha256sums=(
    
      25    "f4c4f2199a8b4fed4c5cd296105232b5f8ef013ab51a0f402421613352e5ae5c" 
    
      26    "42ad9dbdee0b7cf92cef12c29ff6dc988b572e5315cf55d0eb591342db847289"
    
      27    "533bdae8c7e95a94a4941a01de5f0ee94684ac2119d7297e4f5abe950ec64e80"
    
      28    "SKIP"
    
      29)
    
      30
    
      31build() {
    
      32	# Create desktop entry
    
      33	cd "${srcdir}"
    
      34	echo "[Desktop Entry]" >> "${pkgname}.desktop"
    
      35	echo "Type=Application" >> "${pkgname}.desktop"
    
      36	echo "Version=${pkgver}" >> "${pkgname}.desktop"
    
      37	echo "Exec=/usr/bin/${pkgname}" >> "${pkgname}.desktop"
    
      38	echo "Name=ChroMapper" >> "${pkgname}.desktop"
    
      39	echo "Comment=${pkgdesc}" >> "${pkgname}.desktop"
    
      40	echo "Icon=${_base}" >> "${pkgname}.desktop"
    
      41	echo "Terminal=false" >> "${pkgname}.desktop"
    
      42	echo "Categories=Utility;Game;" >> "${pkgname}.desktop"
    
      43
    
      44	# Apply patches
    
      45	echo "Applying patches..."
    
      46	python3 apply-patch.py
    
      47}
    
      48
    
      49package() {
    
      50	install -dm755 "${pkgdir}/opt/${_base}"
    
      51	cd "${srcdir}/chromapper"
    
      52	cp -rt "${pkgdir}/opt/${_base}" *
    
      53    chmod +x "${pkgdir}/opt/${_base}/ChroMapper"
    
      54	install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      55	install -Dm644 "${srcdir}/cm.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${_base}.svg"
    
      56	install -dm755 "${pkgdir}/usr/bin"
    
      57	ln -s "/opt/${_base}/ChroMapper" "${pkgdir}/usr/bin/${pkgname}"	
    
      58}
    
      59
    
      60

Changes since previous scan

--- PKGBUILD @ 2026-07-17 00:06
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,10 +1,10 @@
 # Maintainer: Xavier Pedraza <xpedraza542@gmail.com>
 _stable=892
-_build=970
+_build=975
 _base=chromapper
 pkgname="${_base}-dev-bin"
-pkgver=0.14.970
-pkgrel=2
+pkgver=0.14.975
+pkgrel=1
 pkgdesc='Unity-based map editor for Beat Saber (binary, dev)'
 arch=(x86_64)
 url='https://github.com/Caeden117/ChroMapper/'
@@ -23,7 +23,7 @@
 )
 sha256sums=(
     "f4c4f2199a8b4fed4c5cd296105232b5f8ef013ab51a0f402421613352e5ae5c" 
-    "3dc8342659642be266122f203338077f98167e51633aee62e2f37a78ea49155e"
+    "42ad9dbdee0b7cf92cef12c29ff6dc988b572e5315cf55d0eb591342db847289"
     "533bdae8c7e95a94a4941a01de5f0ee94684ac2119d7297e4f5abe950ec64e80"
     "SKIP"
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 19:55:55	MEDIUM	1
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2