clangen-bin

LOW

maintainer anjanaya 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a PyInstaller bundle from the project's own API domain, which is not on the whitelist but plausibly official; the bundle is not executed during build, and the installation is self-contained with no obfuscated code or remote execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a PyInstaller bundle from the project's own API domain, which is not on the whitelist but plausibly official; the bundle is not executed during build, and the installation is self-contained with no obfuscated code or remote execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgname}-${pkgver}.tar.xz::https://clangen.io/api/v1/Update/Channels/stable/Releases/v${pkgver}/Artifacts/linux2.35"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Guru <anjanaya@gmail.com>
    
      2pkgname=clangen-bin
    
      3_pkgname=clangen
    
      4pkgver=0.13.4
    
      5pkgrel=1
    
      6pkgdesc="Warrior Cats fan game (PyInstaller bundle)"
    
      7arch=('x86_64')
    
      8url="https://clangen.io"
    
      9license=('MPL-2.0' 'CC-BY-NC-4.0')
    
      10depends=('glibc')
    
      11provides=('clangen')
    
      12conflicts=('clangen')
    
      13source=("${pkgname}-${pkgver}.tar.xz::https://clangen.io/api/v1/Update/Channels/stable/Releases/v${pkgver}/Artifacts/linux2.35"
    
      14        "LICENSE.md::https://raw.githubusercontent.com/ClanGenOfficial/clangen/development/LICENSE.md"
    
      15        "clangen.desktop")
    
      16sha256sums=('49cd5f5bbc2c353c0ea972a86bfcce979402e81d4f642b7937232a27c7baa7b3'
    
      17            'b99c9caaaecff974ad46d6aa0a6f2d7fa36afe34bd357d016f16b13ebcc8ad9c'
    
      18            '278435315554de27e45cb590d7ed4d628da1e880057e40b2f62599d65ff69841')
    
      19options=('!strip')
    
      20
    
      21package() {
    
      22    cd "${srcdir}/Clangen"
    
      23
    
      24    install -dm755 "${pkgdir}/opt/${_pkgname}"
    
      25    cp -r . "${pkgdir}/opt/${_pkgname}/"
    
      26    chmod 755 "${pkgdir}/opt/${_pkgname}/Clangen"
    
      27    printf '%s-%s' "${pkgver}" "${pkgrel}" > "${pkgdir}/opt/${_pkgname}/.version"
    
      28
    
      29    install -dm755 "${pkgdir}/usr/bin"
    
      30    cat > "${pkgdir}/usr/bin/${_pkgname}" << 'EOF'
    
      31#!/bin/sh
    
      32# PyInstaller bundle chdirs to its install dir then writes a "game_data"
    
      33# symlink there, so the bundle directory must be user-writable. /opt is not.
    
      34# Mirror the bundle into the user cache on first launch (reflink on btrfs is
    
      35# free; on other filesystems re-syncs only changed bytes).
    
      36SRC="/opt/clangen"
    
      37DEST="${XDG_CACHE_HOME:-$HOME/.cache}/clangen"
    
      38STAMP="$DEST/.version"
    
      39INSTALLED_VERSION="$(cat "$SRC/.version" 2>/dev/null)"
    
      40
    
      41if [ "$(cat "$STAMP" 2>/dev/null)" != "$INSTALLED_VERSION" ]; then
    
      42    mkdir -p "$DEST"
    
      43    /usr/bin/cp -a --reflink=auto "$SRC/." "$DEST/"
    
      44    printf '%s' "$INSTALLED_VERSION" > "$STAMP"
    
      45fi
    
      46
    
      47exec "$DEST/Clangen" "$@"
    
      48EOF
    
      49    chmod 755 "${pkgdir}/usr/bin/${_pkgname}"
    
      50
    
      51    install -Dm644 "${srcdir}/Clangen/_internal/resources/images/icon.png" \
    
      52        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      53
    
      54    install -Dm644 "${srcdir}/clangen.desktop" \
    
      55        "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      56
    
      57    install -Dm644 "${srcdir}/LICENSE.md" \
    
      58        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2