chronocraft

maintainer Refreeze5911 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows executable (ChronoCraft.exe) from a CloudFront CDN URL (dtlod8orn734n.cloudfront.net) with checksum SKIP'd, then extracts and executes its contents. CloudFront is a legitimate CDN service, but this specific distribution URL is not the official game website (chronocraftgame.com) and cannot be independently verified as the canonical upstream source. The SKIP checksum means any tampering or substitution of the binary would go undetected. The extracted content is then installed and executed as a Java application. Additionally, a bundled JRE from BellSoft (a third-party OpenJDK vendor) is used, though that source does have a proper checksum. The combination of: (1) unverified executable from an unofficial/unverifiable CDN endpoint, (2) SKIP'd checksum, (3) chmod -R 777 on installed files, and (4) 'Unofficial' installer label constitutes a genuine medium-severity supply-chain concern — not clearly malicious but a real risk of delivering tampered code.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("https://dtlod8orn734n.cloudfront.net/ChronoCraft.exe"
PKGBUILD:26 "https://download.bell-sw.com/java/8u352+8/bellsoft-jre8u352+8-linux-amd64-full.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt Windows executable (ChronoCraft.exe) from a CloudFront CDN URL (dtlod8orn734n.cloudfront.net) with checksum SKIP'd, then extracts and executes its contents. CloudFront is a legitimate CDN service, but this specific distribution URL is not the official game website (chronocraftgame.com) and cannot be independently verified as the canonical upstream source. The SKIP checksum means any tampering or substitution of the binary would go undetected. The extracted content is then installed and executed as a Java application. Additionally, a bundled JRE from BellSoft (a third-party OpenJDK vendor) is used, though that source does have a proper checksum. The combination of: (1) unverified executable from an unofficial/unverifiable CDN endpoint, (2) SKIP'd checksum, (3) chmod -R 777 on installed files, and (4) 'Unofficial' installer label constitutes a genuine medium-severity supply-chain concern — not clearly malicious but a real risk of delivering tampered code.

PKGBUILD

2 offending line(s) highlighted

      1# This is an example PKGBUILD file. Use this as a start to creating your own,
    
      2# and remove these comments. For more information, see 'man PKGBUILD'.
    
      3
    
      4# Maintainer: FlawCra <moritz.fuessel@flawcra.cc>
    
      5pkgname=chronocraft
    
      6pkgver=1.0.0
    
      7pkgrel=1
    
      8epoch=
    
      9pkgdesc="Unofficial ChronoCraft installer"
    
      10arch=('any')
    
      11url="https://chronocraftgame.com"
    
      12license=('unknown')
    
      13groups=()
    
      14depends=('libnet' 'gtk3' 'gtk2' 'at-spi2-core' 'java-runtime' 'ffmpeg4.4')
    
      15makedepends=('p7zip')
    
      16checkdepends=()
    
      17optdepends=()
    
      18provides=()
    
      19conflicts=()
    
      20replaces=()
    
      21backup=()
    
      22options=()
    
      23install='.INSTALL'
    
      24changelog=
    
      25source=("https://dtlod8orn734n.cloudfront.net/ChronoCraft.exe"
    
      26        "https://download.bell-sw.com/java/8u352+8/bellsoft-jre8u352+8-linux-amd64-full.tar.gz"
    
      27		"chronocraft.png"
    
      28		"chronocraft.desktop")
    
      29noextract=()
    
      30md5sums=("SKIP"
    
      31		 "8a9822dc330e310937773377121cc7aa"
    
      32		 "222d6c1a0fd15fd810848fc8fdb1ebb2"
    
      33		 "936f0e48084ea908a5f3830aa5079d15")
    
      34validpgpkeys=()
    
      35
    
      36package() {
    
      37	7z x $srcdir/ChronoCraft.exe -y -o$srcdir/tmp
    
      38	rm -rf $srcdir/tmp/bin/java/* $srcdir/tmp/\$PLUGINSDIR $srcdir/tmp/ChronoCraft.ico $srcdir/tmp/ChronoCraft.bat
    
      39	mv $srcdir/jre*-full/* $srcdir/tmp/bin/java/
    
      40	chmod +x $srcdir/tmp/bin/java/bin/java
    
      41	cat <<EOT >> $srcdir/tmp/chronocraft
    
      42#!/bin/sh
    
      43cd bin
    
      44java/bin/java -jar ProjectXY.jar
    
      45EOT
    
      46	chmod +x $srcdir/tmp/chronocraft
    
      47	mkdir -p $pkgdir/usr/share/chronocraft
    
      48	mv $srcdir/tmp/* $pkgdir/usr/share/chronocraft
    
      49	chmod -R 777 $pkgdir/usr/share/chronocraft
    
      50	install -D -m644 "$srcdir/chronocraft.desktop" "$pkgdir/usr/share/applications/chronocraft.desktop"
    
      51	install -D -m644 "$srcdir/chronocraft.png" "$pkgdir/usr/share/pixmaps/chronocraft.png"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2