eden-opt

maintainer Rainbowu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt AppImages from stable.eden-emu.dev, which is the official distribution host for the Eden Nintendo Switch emulator project (matching the upstream git URL at git.eden-emu.dev). The AppImage is extracted and its binaries are installed directly to /opt/eden/bin/ and /usr/bin/. While this is a legitimate official project host rather than a random personal server, the pattern of installing prebuilt binaries (not built from source) still constitutes a real supply-chain concern: if stable.eden-emu.dev were compromised, users would execute arbitrary code. The checksums (sha256 + b2) are pinned per-architecture, which mitigates substitution attacks somewhat. The host appears to be the project's own release infrastructure, making this more of a 'binary package from upstream' pattern common in AUR (similar to -bin packages), but the medium rating is still appropriate because the binaries are executed/installed without source verification. This is a legitimate medium-risk pattern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source_x86_64=("${_appimage}-x86_64::https://stable.eden-emu.dev/v${_pkgver}/Eden-Linux-v${_pkgver}-steamdeck-clang-pgo.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads prebuilt AppImages from stable.eden-emu.dev, which is the official distribution host for the Eden Nintendo Switch emulator project (matching the upstream git URL at git.eden-emu.dev). The AppImage is extracted and its binaries are installed directly to /opt/eden/bin/ and /usr/bin/. While this is a legitimate official project host rather than a random personal server, the pattern of installing prebuilt binaries (not built from source) still constitutes a real supply-chain concern: if stable.eden-emu.dev were compromised, users would execute arbitrary code. The checksums (sha256 + b2) are pinned per-architecture, which mitigates substitution attacks somewhat. The host appears to be the project's own release infrastructure, making this more of a 'binary package from upstream' pattern common in AUR (similar to -bin packages), but the medium rating is still appropriate because the binaries are executed/installed without source verification. This is a legitimate medium-risk pattern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rongbo Wu <wurongbo2012@hotmail.com>
    
      2
    
      3_pkgname=eden
    
      4_pkgver=0.2.1
    
      5pkgname="eden-opt"
    
      6pkgver=${_pkgver//-/.}
    
      7pkgrel=1.1
    
      8pkgdesc="The Eden Nintendo Switch emulator Clang PGO version (for Zen2 +)."
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://git.eden-emu.dev/eden-emu/eden"
    
      11license=('GPL-3.0-only')
    
      12depends=('enet'
    
      13    'qt6-base'
    
      14    'qt6-charts'
    
      15    'opus'
    
      16    'spirv-tools'
    
      17    'libfmt.so=12-64'
    
      18    'libusb'
    
      19    'libva'
    
      20)
    
      21makedepends=(patchelf)
    
      22optdepends=(
    
      23    'shared-mime-info'
    
      24    'libsm'
    
      25)
    
      26options=(!strip)
    
      27_appimage="${_pkgname}-${pkgver}"
    
      28source=("${url}/raw/branch/master/dist/dev.eden_emu.eden.xml")
    
      29source_x86_64=("${_appimage}-x86_64::https://stable.eden-emu.dev/v${_pkgver}/Eden-Linux-v${_pkgver}-steamdeck-clang-pgo.AppImage")
    
      30source_aarch64=("${_appimage}-aarch64::https://stable.eden-emu.dev/v${_pkgver}/Eden-Linux-v${_pkgver}-aarch64-clang-pgo.AppImage")
    
      31b2sums=('93ff8f217b74b140b27aba5c740e945bef37b5528ce865a4c83de7a0cbebc133d923633a7ef93fb24a696caa4003d55315f54a8ebfcd246dd4eebd306e7c7943'
    
      32)
    
      33sha256sums_x86_64=('5cc5b358ac6449b40021b20ba2430b4d12302737db15c8cbe5b46ce9aab85ce5')
    
      34sha256sums_aarch64=('b64f926cbf74fd870a39b144971084323d895d51919b91e906328e7f81bea087')
    
      35
    
      36prepare() {
    
      37    chmod +x "${_appimage}-$CARCH"
    
      38    ./"${_appimage}-$CARCH" --appimage-extract
    
      39    # icon name
    
      40    sed -i "s|org.eden_emu.eden|dev.eden_emu.eden|" dev.eden_emu.eden.xml
    
      41}
    
      42
    
      43# Fix .desktop file executable
    
      44build() {
    
      45  sed -i \
    
      46    -e "s|^Exec=.*|Exec=/opt/${_pkgname}/bin/eden %f|" \
    
      47    -e "s|^TryExec=.*||" \
    
      48    -e "s|^Name=.*|Name=Eden Opt|" \
    
      49    squashfs-root/dev.eden_emu.eden.desktop
    
      50  patchelf --set-rpath /opt/${_pkgname}/lib squashfs-root/shared/bin/eden*
    
      51}
    
      52
    
      53package() {
    
      54    # file associations
    
      55    install -Dm644 dev.eden_emu.eden.xml "${pkgdir}/usr/share/mime/packages/dev.eden_emu.eden.xml"
    
      56    install -Dm755 squashfs-root/shared/bin/eden ${pkgdir}/opt/${_pkgname}/bin/eden
    
      57    install -Dm755 squashfs-root/shared/bin/eden-cli ${pkgdir}/usr/bin/eden-cli
    
      58
    
      59    install -D squashfs-root/dev.eden_emu.eden.desktop \
    
      60        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      61
    
      62    install -Dm644 squashfs-root/dev.eden_emu.eden.svg \
    
      63        "${pkgdir}/usr/share/icons/hicolor/scalable/apps/dev.eden_emu.eden.svg"
    
      64    install -d ${pkgdir}/opt/${_pkgname}/lib
    
      65    cp -a squashfs-root/shared/lib/libboost* ${pkgdir}/opt/${_pkgname}/lib/
    
      66}
    
      67
    
      68# Update mime database for file associations
    
      69post_install() {
    
      70    update-mime-database /usr/share/mime
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2