clangen-bin

maintainer anjanaya · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a PyInstaller bundle from the project's own API domain, which is not on the whitelist but is plausibly official; the bundle is not executed during build, and the installed script safely caches it in user space, so the risk is limited to potential supply-chain compromise of an official release artifact.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a PyInstaller bundle from the project's own API domain, which is not on the whitelist but is plausibly official; the bundle is not executed during build, and the installed script safely caches it in user space, so the risk is limited to potential supply-chain compromise of an official release artifact.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgname}-${pkgver}.tar.xz::https://clangen.io/api/v1/Update/Channels/stable/Releases/v${pkgver}/Artifacts/linux2.35"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Guru <anjanaya@gmail.com>
    
      2pkgname=clangen-bin
    
      3_pkgname=clangen
    
      4pkgver=0.13.2
    
      5pkgrel=1
    
      6pkgdesc="Warrior Cats fan game (PyInstaller bundle)"
    
      7arch=('x86_64')
    
      8url="https://clangen.io"
    
      9license=('MPL-2.0' 'CC-BY-NC-4.0')
    
      10depends=('glibc')
    
      11provides=('clangen')
    
      12conflicts=('clangen')
    
      13source=("${pkgname}-${pkgver}.tar.xz::https://clangen.io/api/v1/Update/Channels/stable/Releases/v${pkgver}/Artifacts/linux2.35"
    
      14        "LICENSE.md::https://raw.githubusercontent.com/ClanGenOfficial/clangen/development/LICENSE.md"
    
      15        "clangen.desktop")
    
      16sha256sums=('e74e4db9c3edf44290d08ab39758cf1e90cad12a0a4334bdf824e9919247a611'
    
      17            'SKIP'
    
      18            'SKIP')
    
      19options=('!strip')
    
      20
    
      21package() {
    
      22    cd "${srcdir}/Clangen"
    
      23
    
      24    install -dm755 "${pkgdir}/opt/${_pkgname}"
    
      25    cp -r . "${pkgdir}/opt/${_pkgname}/"
    
      26    chmod 755 "${pkgdir}/opt/${_pkgname}/Clangen"
    
      27    printf '%s-%s' "${pkgver}" "${pkgrel}" > "${pkgdir}/opt/${_pkgname}/.version"
    
      28
    
      29    install -dm755 "${pkgdir}/usr/bin"
    
      30    cat > "${pkgdir}/usr/bin/${_pkgname}" << 'EOF'
    
      31#!/bin/sh
    
      32# PyInstaller bundle chdirs to its install dir then writes a "game_data"
    
      33# symlink there, so the bundle directory must be user-writable. /opt is not.
    
      34# Mirror the bundle into the user cache on first launch (reflink on btrfs is
    
      35# free; on other filesystems re-syncs only changed bytes).
    
      36SRC="/opt/clangen"
    
      37DEST="${XDG_CACHE_HOME:-$HOME/.cache}/clangen"
    
      38STAMP="$DEST/.version"
    
      39INSTALLED_VERSION="$(cat "$SRC/.version" 2>/dev/null)"
    
      40
    
      41if [ "$(cat "$STAMP" 2>/dev/null)" != "$INSTALLED_VERSION" ]; then
    
      42    mkdir -p "$DEST"
    
      43    /usr/bin/cp -a --reflink=auto "$SRC/." "$DEST/"
    
      44    printf '%s' "$INSTALLED_VERSION" > "$STAMP"
    
      45fi
    
      46
    
      47exec "$DEST/Clangen" "$@"
    
      48EOF
    
      49    chmod 755 "${pkgdir}/usr/bin/${_pkgname}"
    
      50
    
      51    install -Dm644 "${srcdir}/Clangen/_internal/resources/images/icon.png" \
    
      52        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      53
    
      54    install -Dm644 "${srcdir}/clangen.desktop" \
    
      55        "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      56
    
      57    install -Dm644 "${srcdir}/LICENSE.md" \
    
      58        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2