cirno-catch-frog

maintainer yuna0x0 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary (a Godot game executable) from a personal CDN (cdn.yuna0x0.com) controlled by the maintainer. However, it does use PGP signature verification via validpgpkeys with a specific key fingerprint, and both the zip and icon have sha256 and b2 checksums (with SKIP only for the .sig files, which is correct behavior — signatures are verified, not checksummed). The PGP signing mitigates the supply-chain risk significantly: even if the CDN were compromised, an attacker would need the maintainer's private key to produce a valid signature. The remaining concern is that the trust anchor is the maintainer's own key, so this is a self-signed distribution model rather than a third-party-verified one. This is a common pattern for indie/personal projects on the AUR. The binary is executed (Godot game), so it's not pure data. Overall this is a mild supply-chain concern — a personal host with self-signed PGP — but the checksums and signature verification are present and correct, making it lower risk than a bare binary download with SKIP checksums. Rating medium is defensible but borderline; the PGP verification keeps it from being a clear medium.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 https://cdn.yuna0x0.com/projects/${pkgname}/releases/v${pkgver}/CirnoCatchFrog-Linux_${arch}-${pkgver}.zip{,.sig}

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary (a Godot game executable) from a personal CDN (cdn.yuna0x0.com) controlled by the maintainer. However, it does use PGP signature verification via validpgpkeys with a specific key fingerprint, and both the zip and icon have sha256 and b2 checksums (with SKIP only for the .sig files, which is correct behavior — signatures are verified, not checksummed). The PGP signing mitigates the supply-chain risk significantly: even if the CDN were compromised, an attacker would need the maintainer's private key to produce a valid signature. The remaining concern is that the trust anchor is the maintainer's own key, so this is a self-signed distribution model rather than a third-party-verified one. This is a common pattern for indie/personal projects on the AUR. The binary is executed (Godot game), so it's not pure data. Overall this is a mild supply-chain concern — a personal host with self-signed PGP — but the checksums and signature verification are present and correct, making it lower risk than a bare binary download with SKIP checksums. Rating medium is defensible but borderline; the PGP verification keeps it from being a clear medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yuna0x0 <yuna@yuna0x0.com>
    
      2pkgname=cirno-catch-frog
    
      3pkgver=1.0.3
    
      4pkgrel=11
    
      5pkgdesc="Touhou fan game made with Godot. Let's help Cirno catch frogs!"
    
      6arch=('x86_64')
    
      7url="https://yuna0x0.itch.io/cirno-catch-frog"
    
      8license=('custom')
    
      9makedepends=('gendesk')
    
      10options=(!strip)
    
      11source=(
    
      12	https://cdn.yuna0x0.com/projects/${pkgname}/releases/v${pkgver}/CirnoCatchFrog-Linux_${arch}-${pkgver}.zip{,.sig}
    
      13	https://cdn.yuna0x0.com/projects/${pkgname}/releases/v${pkgver}/${pkgname}_icon.png{,.sig}
    
      14)
    
      15validpgpkeys=(
    
      16	'9EA1CC0896ABCA3D01CB68DFA28E81CED15846E6' # yuna0x0 <yuna@yuna0x0.com>
    
      17)
    
      18sha256sums=('c2c51cd5dcd591a4f5dee6e80e9e480e09a19719a4e8202db79517d2092d4963'
    
      19	'SKIP'
    
      20	'1f8ffa3dee9b46a9115ae90efd9cc12b5d66ec6bf3049c4e9ff010f1dd711c82'
    
      21	'SKIP')
    
      22b2sums=('3ac177a4f27e59d0684d95f7e53a989c34b3231a8af2d69fd3540d452864f08a70e6cceab1134b084c1674fd85faa67748e7e8d3d1012d27e49b06dc994a6c86'
    
      23	'SKIP'
    
      24	'0f076a1583302b2b3c2062626bf120b9c25b2c7c862e37389e1187faf82614352abcf37d037c2fe95bdd682ffccdd7e1ea46de931dabd308c5f925c05dc9561a'
    
      25	'SKIP')
    
      26
    
      27prepare() {
    
      28	gendesk -n -f --pkgname "${pkgname}" --pkgdesc "${pkgdesc}" --name "Cirno Catch Frog" --categories "Game"
    
      29}
    
      30
    
      31package() {
    
      32	install -D -t "${pkgdir}/opt/${pkgname}/" CirnoCatchFrog-Linux_${arch}-${pkgver}/*
    
      33	install -d "${pkgdir}/usr/bin/"
    
      34	ln -sf "/opt/${pkgname}/CirnoCatchFrog.${arch}" "${pkgdir}/usr/bin/${pkgname}"
    
      35
    
      36	install -Dm644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/com.yuna0x0.CirnoCatchFrog.desktop"
    
      37	install -Dm644 "${pkgname}_icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2