clangen-bin

LOW

maintainer anjanaya 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a PyInstaller bundle from the project's own API domain, which is not on the whitelist but plausibly official; the bundle is not executed during build, and the installation is self-contained with no obfuscated code or remote execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a PyInstaller bundle from the project's own API domain, which is not on the whitelist but plausibly official; the bundle is not executed during build, and the installation is self-contained with no obfuscated code or remote execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgname}-${pkgver}.tar.xz::https://clangen.io/api/v1/Update/Channels/stable/Releases/v${pkgver}/Artifacts/linux2.35"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Guru <anjanaya@gmail.com>
    
      2pkgname=clangen-bin
    
      3_pkgname=clangen
    
      4pkgver=0.13.4
    
      5pkgrel=1
    
      6pkgdesc="Warrior Cats fan game (PyInstaller bundle)"
    
      7arch=('x86_64')
    
      8url="https://clangen.io"
    
      9license=('MPL-2.0' 'CC-BY-NC-4.0')
    
      10depends=('glibc')
    
      11provides=('clangen')
    
      12conflicts=('clangen')
    
      13source=("${pkgname}-${pkgver}.tar.xz::https://clangen.io/api/v1/Update/Channels/stable/Releases/v${pkgver}/Artifacts/linux2.35"
    
      14        "LICENSE.md::https://raw.githubusercontent.com/ClanGenOfficial/clangen/development/LICENSE.md"
    
      15        "clangen.desktop")
    
      16sha256sums=('49cd5f5bbc2c353c0ea972a86bfcce979402e81d4f642b7937232a27c7baa7b3'
    
      17            'b99c9caaaecff974ad46d6aa0a6f2d7fa36afe34bd357d016f16b13ebcc8ad9c'
    
      18            '278435315554de27e45cb590d7ed4d628da1e880057e40b2f62599d65ff69841')
    
      19options=('!strip')
    
      20
    
      21package() {
    
      22    cd "${srcdir}/Clangen"
    
      23
    
      24    install -dm755 "${pkgdir}/opt/${_pkgname}"
    
      25    cp -r . "${pkgdir}/opt/${_pkgname}/"
    
      26    chmod 755 "${pkgdir}/opt/${_pkgname}/Clangen"
    
      27    printf '%s-%s' "${pkgver}" "${pkgrel}" > "${pkgdir}/opt/${_pkgname}/.version"
    
      28
    
      29    install -dm755 "${pkgdir}/usr/bin"
    
      30    cat > "${pkgdir}/usr/bin/${_pkgname}" << 'EOF'
    
      31#!/bin/sh
    
      32# PyInstaller bundle chdirs to its install dir then writes a "game_data"
    
      33# symlink there, so the bundle directory must be user-writable. /opt is not.
    
      34# Mirror the bundle into the user cache on first launch (reflink on btrfs is
    
      35# free; on other filesystems re-syncs only changed bytes).
    
      36SRC="/opt/clangen"
    
      37DEST="${XDG_CACHE_HOME:-$HOME/.cache}/clangen"
    
      38STAMP="$DEST/.version"
    
      39INSTALLED_VERSION="$(cat "$SRC/.version" 2>/dev/null)"
    
      40
    
      41if [ "$(cat "$STAMP" 2>/dev/null)" != "$INSTALLED_VERSION" ]; then
    
      42    mkdir -p "$DEST"
    
      43    /usr/bin/cp -a --reflink=auto "$SRC/." "$DEST/"
    
      44    printf '%s' "$INSTALLED_VERSION" > "$STAMP"
    
      45fi
    
      46
    
      47exec "$DEST/Clangen" "$@"
    
      48EOF
    
      49    chmod 755 "${pkgdir}/usr/bin/${_pkgname}"
    
      50
    
      51    install -Dm644 "${srcdir}/Clangen/_internal/resources/images/icon.png" \
    
      52        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      53
    
      54    install -Dm644 "${srcdir}/clangen.desktop" \
    
      55        "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      56
    
      57    install -Dm644 "${srcdir}/LICENSE.md" \
    
      58        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      59}
    
      60

Changes since previous scan

--- PKGBUILD @ 2026-09-09 00:04
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer: Guru <anjanaya@gmail.com>
 pkgname=clangen-bin
 _pkgname=clangen
-pkgver=0.13.3
+pkgver=0.13.4
 pkgrel=1
 pkgdesc="Warrior Cats fan game (PyInstaller bundle)"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 source=("${pkgname}-${pkgver}.tar.xz::https://clangen.io/api/v1/Update/Channels/stable/Releases/v${pkgver}/Artifacts/linux2.35"
         "LICENSE.md::https://raw.githubusercontent.com/ClanGenOfficial/clangen/development/LICENSE.md"
         "clangen.desktop")
-sha256sums=('17fbf081ba2cef240f91ecd8097dda1ec223d64987676299dba202090297fa0a'
+sha256sums=('49cd5f5bbc2c353c0ea972a86bfcce979402e81d4f642b7937232a27c7baa7b3'
             'b99c9caaaecff974ad46d6aa0a6f2d7fa36afe34bd357d016f16b13ebcc8ad9c'
             '278435315554de27e45cb590d7ed4d628da1e880057e40b2f62599d65ff69841')
 options=('!strip')

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 07:19:13	Medium	1
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2