crystal-sol-bin

MEDIUM

maintainer Xeoxaz 0 votes scanned 2026-10-07 02:07:55.998262

View on AUR

Why flagged

A prebuilt proprietary binary is downloaded from a personal/project domain (downloads.frostal.us) that is not an established vendor infrastructure; while a checksum is provided and the package appears to be its own project's official release, the host is unverifiable and the binary is installed as an executable, making silent substitution a realistic concern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 "https://downloads.frostal.us/crystal-sol/launcher/${pkgver}/crystal-sol-launcher-${pkgver}-${CARCH}-linux.tar.gz"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): A prebuilt proprietary binary is downloaded from a personal/project domain (downloads.frostal.us) that is not an established vendor infrastructure; while a checksum is provided and the package appears to be its own project's official release, the host is unverifiable and the binary is installed as an executable, making silent substitution a realistic concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Frostal (upstream project)
    
      2# Crystal Sol's closed-source launcher; licensed game downloads remain per-user.
    
      3pkgname=crystal-sol-bin
    
      4pkgver=0.1.12
    
      5pkgrel=1
    
      6pkgdesc='Crystal Sol launcher and licensed game installer (official binary)'
    
      7arch=('x86_64')
    
      8url='https://frostal.us/crystal-sol'
    
      9license=('LicenseRef-Proprietary')
    
      10depends=('glibc' 'libgcc' 'xdg-utils' 'hicolor-icon-theme' 'libx11' 'libxcb' 'libxkbcommon' 'wayland')
    
      11optdepends=(
    
      12  'libgl: OpenGL graphics support for the downloaded game'
    
      13  'vulkan-icd-loader: Vulkan graphics support for the downloaded game'
    
      14  'vulkan-driver: Vulkan driver for the downloaded game'
    
      15  'alsa-lib: sound support for the downloaded game'
    
      16)
    
      17provides=('crystal-sol')
    
      18conflicts=('crystal-sol')
    
      19options=('!strip' '!debug')
    
      20source=(
    
      21  "https://downloads.frostal.us/crystal-sol/launcher/${pkgver}/crystal-sol-launcher-${pkgver}-${CARCH}-linux.tar.gz"
    
      22  'crystal-sol.desktop'
    
      23  'crystal-sol.png'
    
      24  'LICENSE-NOTICE'
    
      25)
    
      26sha256sums=(
    
      27  '9d373f6974a8c2ec9f3cd5798fecbe1573e1ceca9867f709b193a07cac4cdcdd'
    
      28  'dfd925478542c21fb4f2c376a5fe11283b2cd1f2800ba545c60e534dd72cb7ca'
    
      29  '2f9dd476b59343e516e477bbd731d3a78b0d22362379251fc5a971521a0ad4f3'
    
      30  'fa418322cd602a3be1078640a784b8f55ffa5fcedfeb817143593bcc922882b0'
    
      31)
    
      32
    
      33package() {
    
      34  install -Dm755 crystal-sol-launcher "$pkgdir/usr/bin/crystal-sol-launcher"
    
      35  ln -s crystal-sol-launcher "$pkgdir/usr/bin/crystal-sol"
    
      36  install -Dm644 crystal-sol.desktop "$pkgdir/usr/share/applications/crystal-sol.desktop"
    
      37  install -Dm644 crystal-sol.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/crystal-sol.png"
    
      38  install -Dm644 LICENSE-NOTICE "$pkgdir/usr/share/licenses/$pkgname/LICENSE-NOTICE"
    
      39}
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-10-07 00:21
+++ PKGBUILD @ 2026-10-07 02:07
@@ -1,7 +1,7 @@
 # Maintainer: Frostal (upstream project)
 # Crystal Sol's closed-source launcher; licensed game downloads remain per-user.
 pkgname=crystal-sol-bin
-pkgver=0.1.11
+pkgver=0.1.12
 pkgrel=1
 pkgdesc='Crystal Sol launcher and licensed game installer (official binary)'
 arch=('x86_64')
@@ -24,8 +24,8 @@
   'LICENSE-NOTICE'
 )
 sha256sums=(
-  '66b47ee9423af668a2fcc9ef9406ad9acc3855c6edf1e748001367f8047a7a2e'
-  '67a53badefb32111995c56a2e2fcfd640fdad27d248ee6300d7299df74d8e193'
+  '9d373f6974a8c2ec9f3cd5798fecbe1573e1ceca9867f709b193a07cac4cdcdd'
+  'dfd925478542c21fb4f2c376a5fe11283b2cd1f2800ba545c60e534dd72cb7ca'
   '2f9dd476b59343e516e477bbd731d3a78b0d22362379251fc5a971521a0ad4f3'
   'fa418322cd602a3be1078640a784b8f55ffa5fcedfeb817143593bcc922882b0'
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-07 02:07:55	Medium	3
2026-10-07 02:05:08	Medium	2
2026-10-07 00:21:34	Medium	3
2026-10-07 00:12:41	Medium	3
2026-10-07 00:04:18	Medium	2