cider-studio-bin

maintainer ifwerez · 0 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package downloads a pre-built binary from a non-standard, untrusted host (ifwerez.ru) with unverifiable checksums (SKIP), creating a supply-chain risk if the host is compromised or malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://ifwerez.ru/git/rez/cider/releases/download/${pkgver}/cider-${pkgver}-linux-x86_64"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a pre-built binary from a non-standard, untrusted host (ifwerez.ru) with unverifiable checksums (SKIP), creating a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: rez <rez@ifwerez.ru>
    
      2pkgname=cider-studio-bin
    
      3pkgver=2.4.0
    
      4pkgrel=1
    
      5pkgdesc="run & control roblox studio advancedly on linux (pre-built binary)"
    
      6arch=('x86_64')
    
      7url="https://ifwerez.ru/git/rez/cider"
    
      8license=('MIT')
    
      9depends=('sdl2' 'libgl' 'zlib' 'xz' 'curl' 'cabextract' 'wine')
    
      10source=("https://ifwerez.ru/git/rez/cider/releases/download/${pkgver}/cider-${pkgver}-linux-x86_64"
    
      11        "cider.png::https://ifwerez.ru/git/rez/cider/raw/branch/main/src/resources/cider.png")
    
      12sha256sums=('SKIP'
    
      13            'SKIP')
    
      14
    
      15package() {
    
      16    install -Dm755 "cider-${pkgver}-linux-x86_64" "${pkgdir}/usr/bin/cider"
    
      17
    
      18    install -Dm644 cider.png \
    
      19        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/cider.png"
    
      20
    
      21    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/cider.desktop" <<EOF
    
      22[Desktop Entry]
    
      23Name=Cider
    
      24Comment=run & control roblox studio advancedly on linux
    
      25Exec=cider %U
    
      26Type=Application
    
      27Icon=cider
    
      28Categories=Game;Development;
    
      29StartupWMClass=cider
    
      30EOF
    
      31
    
      32    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/roblox-studio.desktop" <<EOF
    
      33[Desktop Entry]
    
      34Name=Roblox Studio
    
      35Comment=guess what this is
    
      36Exec=cider %U
    
      37Type=Application
    
      38Icon=cider
    
      39Categories=Game;Development;
    
      40MimeType=application/x-roblox-rbxl;application/x-roblox-rbxlx;application/x-roblox-rbxm;application/x-roblox-rbxmx;x-scheme-handler/roblox-studio;x-scheme-handler/roblox-studio-auth;
    
      41StartupWMClass=RobloxStudioBeta.exe
    
      42EOF
    
      43
    
      44    install -Dm644 /dev/stdin "${pkgdir}/usr/share/mime/packages/cider-mimetypes.xml" <<EOF
    
      45<?xml version="1.0" encoding="UTF-8"?>
    
      46<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
    
      47  <mime-type type="application/x-roblox-rbxl"><comment>Roblox Place</comment><glob pattern="*.rbxl"/></mime-type>
    
      48  <mime-type type="application/x-roblox-rbxlx"><comment>Roblox Place XML</comment><glob pattern="*.rbxlx"/></mime-type>
    
      49  <mime-type type="application/x-roblox-rbxm"><comment>Roblox Model</comment><glob pattern="*.rbxm"/></mime-type>
    
      50  <mime-type type="application/x-roblox-rbxmx"><comment>Roblox Model XML</comment><glob pattern="*.rbxmx"/></mime-type>
    
      51</mime-info>
    
      52EOF
    
      53}
    
      54 
    
      55

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,14 +1,14 @@
 # Maintainer: rez <rez@ifwerez.ru>
 pkgname=cider-studio-bin
-pkgver=2.1.0
+pkgver=2.4.0
 pkgrel=1
 pkgdesc="run & control roblox studio advancedly on linux (pre-built binary)"
 arch=('x86_64')
-url="https://github.com/ifwerez/cider"
+url="https://ifwerez.ru/git/rez/cider"
 license=('MIT')
 depends=('sdl2' 'libgl' 'zlib' 'xz' 'curl' 'cabextract' 'wine')
-source=("https://github.com/ifwerez/cider/releases/download/${pkgver}/cider-${pkgver}-linux-x86_64"
-        "cider.png::https://github.com/ifwerez/cider/raw/main/src/resources/cider.png")
+source=("https://ifwerez.ru/git/rez/cider/releases/download/${pkgver}/cider-${pkgver}-linux-x86_64"
+        "cider.png::https://ifwerez.ru/git/rez/cider/raw/branch/main/src/resources/cider.png")
 sha256sums=('SKIP'
             'SKIP')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 00:03:42	MEDIUM	2
2026-08-15 00:26:13	MEDIUM	2
2026-08-14 00:03:41	MEDIUM	2
2026-08-13 00:17:07	MEDIUM	2
2026-08-12 21:24:53	MEDIUM	2
2026-07-31 00:14:10	CLEAN	0
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 15:14:11	MEDIUM	2
2026-07-20 13:14:10	MEDIUM	2