epsxe

maintainer hav3lock · 226 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs a prebuilt closed-source x86_64 binary (ePSXe 2.0.5) downloaded directly from epsxe.com and a prebuilt ncurses library from archive.org. Both are executed/loaded at runtime. The ePSXe binary is the official upstream release from the vendor's own domain (epsxe.com), which is legitimate, but it is a closed-source prebuilt binary with no source verification beyond an MD5 checksum (which is weak). The ncurses package comes from archive.org (an Arch Linux package mirror snapshot), which is an unofficial redistribution host — this is the more concerning element since it is a shared library that will be loaded by the emulator. MD5 checksums are present for all sources (not SKIP'd as the cheaper model claimed), which provides some integrity assurance, though MD5 is cryptographically weak. The combination of a closed-source prebuilt binary plus a prebuilt shared library from a non-official host constitutes a real but moderate supply-chain concern. The PCSX-Reloaded source is pulled from GitHub with a checksum, which is fine. Overall this is a genuine medium: executed code from partially unofficial hosts with only weak checksum verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 https://www.epsxe.com/files/shaders.zip
PKGBUILD:25 "https://archive.org/download/archlinux_pkg_ncurses/ncurses-5.9_20141101-1-$CARCH.pkg.tar.xz"

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it MEDIUM (confidence 82%): The PKGBUILD installs a prebuilt closed-source x86_64 binary (ePSXe 2.0.5) downloaded directly from epsxe.com and a prebuilt ncurses library from archive.org. Both are executed/loaded at runtime. The ePSXe binary is the official upstream release from the vendor's own domain (epsxe.com), which is legitimate, but it is a closed-source prebuilt binary with no source verification beyond an MD5 checksum (which is weak). The ncurses package comes from archive.org (an Arch Linux package mirror snapshot), which is an unofficial redistribution host — this is the more concerning element since it is a shared library that will be loaded by the emulator. MD5 checksums are present for all sources (not SKIP'd as the cheaper model claimed), which provides some integrity assurance, though MD5 is cryptographically weak. The combination of a closed-source prebuilt binary plus a prebuilt shared library from a non-official host constitutes a real but moderate supply-chain concern. The PCSX-Reloaded source is pulled from GitHub with a checksum, which is fine. Overall this is a genuine medium: executed code from partially unofficial hosts with only weak checksum verification.

PKGBUILD

2 offending line(s) highlighted

      1#
    
      2# Maintainer: Alexej Magura <sickhadas.code at gmail dot com>
    
      3# Contributor: Swen Simon <swsimon at gmail dot com>
    
      4# Contributor: Raphaël Doursenaud <rdoursenaud@gmail.com>
    
      5#
    
      6
    
      7pkgname=epsxe
    
      8_pkgname=ePSXe
    
      9pkgver=2.0.5
    
      10_plgnver=1.9.95
    
      11pkgrel=34
    
      12pkgdesc="Enhanced PSX emulator"
    
      13url="https://epsxe.com"
    
      14arch=('x86_64')
    
      15depends=(bash libcurl-compat gtk3 sdl_ttf ncurses openssl-1.0 libxt libcanberra libcurl-compat libxv libcdio libarchive)
    
      16makedepends=(unzip tar cmake mesa intltool nasm valgrind)
    
      17license=('unknown')
    
      18install=${pkgname}.install
    
      19options=(!strip)
    
      20source=(${pkgname}.desktop
    
      21        ${pkgname}.png
    
      22        ${pkgname}.sh
    
      23        https://www.epsxe.com/files/shaders.zip
    
      24        "https://www.epsxe.com/files/${_pkgname}${pkgver//./}linux_x64.zip"
    
      25        "https://archive.org/download/archlinux_pkg_ncurses/ncurses-5.9_20141101-1-$CARCH.pkg.tar.xz"
    
      26        # 64-bit Plugins
    
      27        "pcsxr-$_plgnver.tar.gz::https://github.com/frealgagu/PCSX-Reloaded/archive/$_plgnver.tar.gz"
    
      28        Makefile.patch
    
      29        pcsxr-fix-undefined-operations.patch
    
      30        configure_ac.patch
    
      31        peopsxgl_gpu_c.patch
    
      32        dfxvideo_cfg_c.patch
    
      33        )
    
      34conflicts=(bin32-epsxe)
    
      35noextract=(shaders.zip ncurses-5.9_20141101-1-$CARCH.pkg.tar.xz)
    
      36md5sums=('aeb34e2ca34f968630ca133ea821c61c'
    
      37         'eb0c46b8ae1355c589792f6be1835e47'
    
      38         '6239ab64858d131acc3d2629d5834701'
    
      39         'a863740899adb064b8a28c3fa47d5280'
    
      40         '79fefeb4bff26bf1d374befb35b390df'
    
      41         'd435d3e9481e5786b9e377abe63ce325'
    
      42         'ee0f9dfd003d9a5350aafc8cca0cdeee'
    
      43         '65b85557db7af4fbb775ce3256d9784c'
    
      44         '96a82dcc66851160f452160a538cd6f8'
    
      45         'f84d9eff59ac127eb37be4088c599fe6'
    
      46         '5576cd7ddfe7e025f7e64ba532875420'
    
      47         '97dba4a28e162cd93882194d3a02bbf1')
    
      48
    
      49
    
      50
    
      51prepare()
    
      52{
    
      53  cd "$srcdir"
    
      54
    
      55  mv "${pkgname}_x64" "$pkgname"
    
      56
    
      57  tar xf ncurses*.tar.xz usr/lib/libncursesw.so.5.9 2> /dev/null
    
      58  mv usr/lib/libncursesw.so.5.9 .
    
      59  rm -rf usr
    
      60
    
      61  ## process shaders ##
    
      62  rm -rf shaders tmp
    
      63  mkdir tmp
    
      64  unzip -q shaders.zip -d tmp
    
      65  mv tmp/shaders "$srcdir"
    
      66
    
      67  cd "$srcdir/PCSX-Reloaded-$_plgnver/pcsxr"
    
      68  patch < $srcdir/Makefile.patch
    
      69  patch < $srcdir/configure_ac.patch
    
      70  cd ..
    
      71  patch -Np1 -i "$srcdir"/pcsxr-fix-undefined-operations.patch
    
      72  mkdir -p "$srcdir/PCSX-Reloaded-$_plgnver/pcsxr/include"
    
      73  patch -Np1 -i "$srcdir"/peopsxgl_gpu_c.patch "$srcdir/PCSX-Reloaded-$_plgnver/pcsxr/plugins/peopsxgl/gpu.c"
    
      74  patch -Np1 -i "$srcdir"/dfxvideo_cfg_c.patch "$srcdir/PCSX-Reloaded-$_plgnver/pcsxr/plugins/dfxvideo/cfg.c"
    
      75
    
      76  cd "$srcdir/PCSX-Reloaded-$_plgnver/pcsxr"
    
      77
    
      78
    
      79  ## Replace ~/.pcsxr with ~/.epsxe
    
      80  # # sed -i 's|\.pcsxr/plugins/|.epsxe/config/|' plugins/dfxvideo/cfg.c
    
      81  # sed -i 's|\.pcsxr/plugins/cfg/||' gui/Linux.h
    
      82  sed -i 's|\.pcsxr|.epsxe|' gui/Linux.h
    
      83
    
      84  ## Fix several implict function definitions (waitpid)
    
      85  sed -ri 's|(#include "pad.h")|\1\n#include <sys/wait.h>|' plugins/dfinput/pad.c
    
      86  sed -ri 's|(#include "stdafx.h")|\1\n#include <sys/wait.h>|' plugins/dfsound/cfg.c
    
      87  sed -ri 's|(#include "cdr.h")|\1\n#include <sys/wait.h>|' plugins/dfcdrom/cdr.c
    
      88  sed -ri 's|(#include "sio1.h")|\1\n#include <sys/wait.h>|' plugins/bladesio1/sio1.c
    
      89  # sed -ri 's|(#include "stdafx.h")|\1\n#include <sys/wait.h>|' plugins/peopsxgl/gpu.c
    
      90
    
      91  ## Fix implicit function definitions (fork)
    
      92  sed -ri 's|(#include "sio1.h")|\1\n#include <unistd.h>|' plugins/bladesio1/sio1.c
    
      93
    
      94  ## Fix incorrect assignment
    
      95  # sed -i 's|\*disp=(unsigned long \*)display;\(.*\)|disp\1|' plugins/peopsxgl/gpu.c
    
      96  # sed -i 's/pcsxr/epsxe/g' configure.ac
    
      97
    
      98  sed -i 's|/games/psemu\/||g' plugins/peopsxgl/Makefile.am
    
      99  sed -i 's|\/psemu\/||g' plugins/peopsxgl/Makefile.am
    
      100}
    
      101
    
      102build() {
    
      103  cd "${srcdir}/PCSX-Reloaded-$_plgnver/pcsxr"
    
      104
    
      105  export CC="gcc"
    
      106  export CXX="g++"
    
      107  export CFLAGS+=" -fcommon -I/usr/include/harfbuzz"
    
      108  export CXXFLAGS+=" -I/usr/include/harfbuzz"
    
      109  export PKG_CONFIG_PATH='/usr/lib/pkgconfig'
    
      110
    
      111  autoreconf -fi
    
      112  intltoolize --force
    
      113
    
      114  ./configure \
    
      115    --prefix=/opt/epsxe \
    
      116    --enable-libcdio \
    
      117    --enable-opengl \
    
      118    --libdir="/opt/$pkgname/plugins" \
    
      119    --datadir="/opt/$pkgname/config" \
    
      120    --bindir="/opt/$pkgname/plugins" \
    
      121    --datarootdir="/opt/$pkgname/config"
    
      122  # make clean
    
      123  make # DATADIR="/opt/$pkgname/cfg"
    
      124}
    
      125
    
      126package()
    
      127{
    
      128  cd "$srcdir"
    
      129  install -d "$pkgdir"/usr/share/doc/$pkgname
    
      130  install -d "$pkgdir"/opt/$pkgname/config \
    
      131    "$pkgdir"/opt/$pkgname/plugins \
    
      132    "$pkgdir"/opt/$pkgname/shaders
    
      133
    
      134  ## Docs and Shaders
    
      135
    
      136  find docs -name 'e???e_*.txt' -execdir install -m 644 -t "$pkgdir/usr/share/doc/$pkgname" \{\} +
    
      137  find shaders -maxdepth 1 -mindepth 1 -type d | xargs -I: cp -r : "$pkgdir/opt/$pkgname/shaders"
    
      138  chmod 644 -R "$pkgdir/opt/$pkgname/shaders"
    
      139  find "$pkgdir/opt/$pkgname/shaders" -maxdepth 1 -type d | xargs -I: chmod 645 :
    
      140
    
      141  ## Executable and images
    
      142
    
      143  install -Dm 755 "$pkgname" "$pkgdir/opt/$pkgname/$pkgname"
    
      144
    
      145  install -Dm 755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      146  install -Dm 644 "$srcdir/epsxe.png" "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      147  install -Dm 644 "$srcdir/epsxe.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      148
    
      149  ## NCURSES
    
      150
    
      151  # ln -sf "$HOME/.${pkgname}/${pkgname}rc "$pkgdir/opt/$pkgname/.${pkgname}rc"
    
      152  install -m 644 "$srcdir/libncursesw.so.5.9" "$pkgdir/opt/$pkgname/libncursesw.so.5.9"
    
      153  cd "$pkgdir/opt/$pkgname"
    
      154  ln -sf libncursesw.so.5.9 libncurses.so.5
    
      155  ln -sf libncursesw.so.5.9 libtinfo.so.5
    
      156
    
      157
    
      158  ## CURL
    
      159  ln -sf /usr/lib/libcurl-compat.so.4.8.0 "$pkgdir"/opt/epsxe/libcurl.so.4
    
      160
    
      161  ## Plugins
    
      162  cd "${srcdir}/PCSX-Reloaded-$_plgnver/pcsxr"
    
      163  make DESTDIR="$pkgdir" install
    
      164  # cd build
    
      165
    
      166  # make DESTDIR="$pkgdir" install
    
      167
    
      168  # cd "$pkgdir/opt/$pkgname/plugins/"
    
      169
    
      170  ## PeopsSoftX
    
      171  ln -sf /opt/"$pkgname"/config/peopsxgl.ui "$pkgdir"/opt/epsxe/config/cfgpeopsxgl.ui
    
      172  #
    
      173  # install -m 755 -t "$pkgdir/opt/$pkgname/plugins" \
    
      174  #   opt/epsxe/plugins/libpeopsxgl.la \
    
      175  #   opt/epsxe/plugins/libpeopsxgl.so
    
      176  # install -m 755 usr/lib/games/psemu/cfgpeopsxgl "$pkgdir/opt/$pkgname/cfg"
    
      177  # install -m 755 usr/lib/games/psemu/cfgpeopsxgl "$pkgdir/opt/$pkgname/"
    
      178
    
      179  chgrp games -R "$pkgdir/opt/epsxe"
    
      180  chmod g+rwx -R "$pkgdir/opt/epsxe"
    
      181
    
      182  # cd
    
      183  #
    
      184  # for plugindir in "$pkgdir/opt/$pkgname/plugins"; do
    
      185  #   echo "Installing Peops"
    
      186  #   cd "$plugindir"
    
      187  #   install -m 755 usr/lib/games/psemu/libpeopsxgl.so "$plugindir"
    
      188  #   mv usr/lib/games/psemu/cfgpeopsxgl "$plugindir/../cfg"
    
      189  # done
    
      190  # cd ..
    
      191}
    
      192

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2