chromapper-dev-bin

LOW

maintainer WasabiThumbs 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads source and patch files from a non-whitelisted host, but these are used to build and patch the application legitimately; the final installed binaries are derived from verifiable sources with provided checksums, and no unreviewed remote code is executed.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source and patch files from a non-whitelisted host, but these are used to build and patch the application legitimately; the final installed binaries are derived from verifiable sources with provided checksums, and no unreviewed remote code is executed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://cm.topc.at/nix/${_stable}/Linux.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Xavier Pedraza <xpedraza542@gmail.com>
    
      2_stable=892
    
      3_build=984
    
      4_base=chromapper
    
      5pkgname="${_base}-dev-bin"
    
      6pkgver="0.14.${_build}"
    
      7pkgrel=1
    
      8pkgdesc='Unity-based map editor for Beat Saber (binary, dev)'
    
      9arch=(x86_64)
    
      10url='https://github.com/Caeden117/ChroMapper/'
    
      11license=('GPL-2.0-only')
    
      12provides=("${_base}=${pkgver}")
    
      13conflicts=("${_base}" "${_base}-dev" "${_base}-bin")
    
      14options=(!strip)
    
      15depends=(glibc libgcc)
    
      16makedepends=(python3 xdelta3)
    
      17noextract=("${_stable}.patch")
    
      18source=(
    
      19    "https://cm.topc.at/nix/${_stable}/Linux.tar.gz"
    
      20    "https://cm.topc.at/nix/${_build}/${_stable}.patch"
    
      21    "https://cm.topc.at/cm.svg"
    
      22    "apply-patch.py"
    
      23)
    
      24sha256sums=(
    
      25    "f4c4f2199a8b4fed4c5cd296105232b5f8ef013ab51a0f402421613352e5ae5c" 
    
      26    "8a88f90819deeda504063a7618cb2979c5d94d801ef24700687258460ba51642"
    
      27    "533bdae8c7e95a94a4941a01de5f0ee94684ac2119d7297e4f5abe950ec64e80"
    
      28    "SKIP"
    
      29)
    
      30
    
      31build() {
    
      32	# Create desktop entry
    
      33	cd "${srcdir}"
    
      34	echo "[Desktop Entry]" >> "${pkgname}.desktop"
    
      35	echo "Type=Application" >> "${pkgname}.desktop"
    
      36	echo "Version=${pkgver}" >> "${pkgname}.desktop"
    
      37	echo "Exec=/usr/bin/${pkgname}" >> "${pkgname}.desktop"
    
      38	echo "Name=ChroMapper" >> "${pkgname}.desktop"
    
      39	echo "Comment=${pkgdesc}" >> "${pkgname}.desktop"
    
      40	echo "Icon=${_base}" >> "${pkgname}.desktop"
    
      41	echo "Terminal=false" >> "${pkgname}.desktop"
    
      42	echo "Categories=Utility;Game;" >> "${pkgname}.desktop"
    
      43
    
      44	# Apply patches
    
      45	echo "Applying patches..."
    
      46	python3 apply-patch.py
    
      47}
    
      48
    
      49package() {
    
      50	install -dm755 "${pkgdir}/opt/${_base}"
    
      51	cd "${srcdir}/chromapper"
    
      52	cp -rt "${pkgdir}/opt/${_base}" *
    
      53    chmod +x "${pkgdir}/opt/${_base}/ChroMapper"
    
      54	install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      55	install -Dm644 "${srcdir}/cm.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${_base}.svg"
    
      56	install -dm755 "${pkgdir}/usr/bin"
    
      57	ln -s "/opt/${_base}/ChroMapper" "${pkgdir}/usr/bin/${pkgname}"	
    
      58}
    
      59
    
      60

Changes since previous scan

--- PKGBUILD @ 2026-09-12 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,6 +1,6 @@
 # Maintainer: Xavier Pedraza <xpedraza542@gmail.com>
 _stable=892
-_build=983
+_build=984
 _base=chromapper
 pkgname="${_base}-dev-bin"
 pkgver="0.14.${_build}"
@@ -23,7 +23,7 @@
 )
 sha256sums=(
     "f4c4f2199a8b4fed4c5cd296105232b5f8ef013ab51a0f402421613352e5ae5c" 
-    "cb39f1be21bf9fd63cdc4c52597977c932be87e825e4dcac725a2d10165a29aa"
+    "8a88f90819deeda504063a7618cb2979c5d94d801ef24700687258460ba51642"
     "533bdae8c7e95a94a4941a01de5f0ee94684ac2119d7297e4f5abe950ec64e80"
     "SKIP"
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 07:11:01	Medium	1
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 03:20:13	Medium	1
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2