crystal-launcher

LOW

maintainer orphaned 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a JAR file and assets from the project's own domain, which is plausibly the official source; building and installing the project's own code from its official host is normal AUR packaging, even if the host is not on a standard whitelist.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JAR file and assets from the project's own domain, which is plausibly the official source; building and installing the project's own code from its official host is normal AUR packaging, even if the host is not on a standard whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 source=("$pkgname.jar::https://launcher.crystal-launcher.net/bootstrapNX/data/crystal-wrapper.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Giovanni Santini <giovannisantini93@yahoo.it>
    
      2pkgname=crystal-launcher
    
      3pkgver=20241227
    
      4pkgrel=1
    
      5pkgdesc="A custom Minecraft launcher with its own package system"
    
      6arch=(any)
    
      7url="https://crystal-launcher.net/"
    
      8license=('unknown')
    
      9
    
      10# Current reverse engineering for figuring out the jar:
    
      11# 1. curl the current script:
    
      12#        https://bit.ly/cl4lx
    
      13#        ->
    
      14#        https://launcher.crystal-launcher.net/linux/install.sh
    
      15#    Here we can find the launcher icon.
    
      16# 2. Fetch the launcher.tar.xz mentioned there
    
      17# 3. The 'launcher' binary inside is a PyInstaller package.
    
      18#    It can be unpacked via:
    
      19#        https://github.com/extremecoders-re/pyinstxtractor
    
      20#    There is the web version here:
    
      21#        https://pyinstxtractor-web.netlify.app/
    
      22# 4. Unpack the .zip file, it has a bunch of .pyc files.
    
      23#    You can decompile it via pycdc.
    
      24#    Focus on the Crystal*.pyc.
    
      25#    The main manifest is available here:
    
      26#        https://launcher.crystal-launcher.net/bootstrapNX/data/bootstrapManifest.json
    
      27#    It also stores the Java version to use
    
      28# 5. We have the proper JAR and command line path for the launcher.
    
      29
    
      30_java_version="17"
    
      31depends=(
    
      32    "java-runtime=${_java_version}"
    
      33    "java${_java_version}-openjfx"
    
      34)
    
      35install="$pkgname.install"
    
      36source=("$pkgname.jar::https://launcher.crystal-launcher.net/bootstrapNX/data/crystal-wrapper.jar"
    
      37        "$pkgname.png::https://launcher.crystal-launcher.net/linux/icon.png"
    
      38        "$pkgname.sh"
    
      39        "$pkgname.desktop")
    
      40sha256sums=('cf9099cd5784fdcc93e87f17a1f0007349ca2ff30dd0d00492aea54e928e3a36'
    
      41            '214f4f12eb772d2ce945723ab7b126b1fb3e78c009f4132d6b0f98ea2270ab0c'
    
      42            '68a357836068f9382f96d8a858f664908d3e6dceb5246d4c34dcfb9b3495bdb6'
    
      43            'ff160d4a4cfe366f0ec806d7eeeac4bfd5e83c3d01afbc22ecc5caa1adb247ef')
    
      44
    
      45package() {
    
      46    cd "$srcdir"
    
      47
    
      48    mkdir -p "$pkgdir/usr/share/java"
    
      49    cp -v "$pkgname.jar" "$pkgdir/usr/share/java"
    
      50
    
      51    mkdir -p "$pkgdir/usr/bin"
    
      52    cp -v  "$pkgname.sh" "$pkgdir/usr/bin/$pkgname"
    
      53
    
      54    mkdir -p "$pkgdir/usr/share/applications"
    
      55    cp -v "$pkgname.desktop" "$pkgdir/usr/share/applications"
    
      56
    
      57    mkdir -p "$pkgdir/usr/share/pixmaps"
    
      58    cp -v "$pkgname.png" "$pkgdir/usr/share/pixmaps"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2