chromapper-dev-bin

MEDIUM

maintainer WasabiThumbs 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt Linux tarball and a patch file from a non-standard, non-whitelisted host (cm.topc.at) which is not the project's official release infrastructure, posing a supply-chain risk if the source were swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://cm.topc.at/nix/${_stable}/Linux.tar.gz"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Linux tarball and a patch file from a non-standard, non-whitelisted host (cm.topc.at) which is not the project's official release infrastructure, posing a supply-chain risk if the source were swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Xavier Pedraza <xpedraza542@gmail.com>
    
      2_stable=892
    
      3_build=996
    
      4_base=chromapper
    
      5pkgname="${_base}-dev-bin"
    
      6pkgver="0.14.${_build}"
    
      7pkgrel=1
    
      8pkgdesc='Unity-based map editor for Beat Saber (binary, dev)'
    
      9arch=(x86_64)
    
      10url='https://github.com/Caeden117/ChroMapper/'
    
      11license=('GPL-2.0-only')
    
      12provides=("${_base}=${pkgver}")
    
      13conflicts=("${_base}" "${_base}-dev" "${_base}-bin")
    
      14options=(!strip)
    
      15depends=(glibc libgcc)
    
      16makedepends=(python3 xdelta3)
    
      17noextract=("${_stable}.patch")
    
      18source=(
    
      19    "https://cm.topc.at/nix/${_stable}/Linux.tar.gz"
    
      20    "https://cm.topc.at/nix/${_build}/${_stable}.patch"
    
      21    "https://cm.topc.at/cm.svg"
    
      22    "apply-patch.py"
    
      23)
    
      24sha256sums=(
    
      25    "f4c4f2199a8b4fed4c5cd296105232b5f8ef013ab51a0f402421613352e5ae5c" 
    
      26    "212a0e837dcf6bee792ffd6682e00b5d3ca7551cb41beda18cf7ad161ec24122"
    
      27    "533bdae8c7e95a94a4941a01de5f0ee94684ac2119d7297e4f5abe950ec64e80"
    
      28    "SKIP"
    
      29)
    
      30
    
      31build() {
    
      32	# Create desktop entry
    
      33	cd "${srcdir}"
    
      34	echo "[Desktop Entry]" >> "${pkgname}.desktop"
    
      35	echo "Type=Application" >> "${pkgname}.desktop"
    
      36	echo "Version=${pkgver}" >> "${pkgname}.desktop"
    
      37	echo "Exec=/usr/bin/${pkgname}" >> "${pkgname}.desktop"
    
      38	echo "Name=ChroMapper" >> "${pkgname}.desktop"
    
      39	echo "Comment=${pkgdesc}" >> "${pkgname}.desktop"
    
      40	echo "Icon=${_base}" >> "${pkgname}.desktop"
    
      41	echo "Terminal=false" >> "${pkgname}.desktop"
    
      42	echo "Categories=Utility;Game;" >> "${pkgname}.desktop"
    
      43
    
      44	# Apply patches
    
      45	echo "Applying patches..."
    
      46	python3 apply-patch.py
    
      47}
    
      48
    
      49package() {
    
      50	install -dm755 "${pkgdir}/opt/${_base}"
    
      51	cd "${srcdir}/chromapper"
    
      52	cp -rt "${pkgdir}/opt/${_base}" *
    
      53    chmod +x "${pkgdir}/opt/${_base}/ChroMapper"
    
      54	install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      55	install -Dm644 "${srcdir}/cm.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${_base}.svg"
    
      56	install -dm755 "${pkgdir}/usr/bin"
    
      57	ln -s "/opt/${_base}/ChroMapper" "${pkgdir}/usr/bin/${pkgname}"	
    
      58}
    
      59
    
      60

Changes since previous scan

--- PKGBUILD @ 2026-10-28 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
 # Maintainer: Xavier Pedraza <xpedraza542@gmail.com>
 _stable=892
-_build=984
+_build=996
 _base=chromapper
 pkgname="${_base}-dev-bin"
 pkgver="0.14.${_build}"
@@ -23,7 +23,7 @@
 )
 sha256sums=(
     "f4c4f2199a8b4fed4c5cd296105232b5f8ef013ab51a0f402421613352e5ae5c" 
-    "8a88f90819deeda504063a7618cb2979c5d94d801ef24700687258460ba51642"
+    "212a0e837dcf6bee792ffd6682e00b5d3ca7551cb41beda18cf7ad161ec24122"
     "533bdae8c7e95a94a4941a01de5f0ee94684ac2119d7297e4f5abe950ec64e80"
     "SKIP"
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 19:50:31	Medium	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2