feedthebeast-classic

maintainer FurTabs · 45 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt JAR (executed JVM bytecode) from dist.creeper.host, which is a third-party CDN/mirror host rather than the official feed-the-beast.com domain. The JAR is installed to /usr/share and executed at runtime as the launcher. Both checksums are 'SKIP', meaning no integrity verification is performed. creeper.host is a known FTB community mirror/CDN that has historically been used by FTB for distribution, so this is not clearly malicious, but it is not the official vendor domain and the lack of any checksum verification means a compromised or substituted JAR would go undetected. This constitutes a genuine supply-chain concern: an executed binary from a non-official host with no integrity check. The first source (the wrapper script '$pkgname') also has SKIP checksum and appears to be a local file that must exist in the PKGBUILD directory — its absence would break the build, but its presence without a checksum is also a concern. Overall: real medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "${_pkgname}-$pkgver.jar"::"https://dist.creeper.host/FTB2/launcher/FTB_Launcher.jar")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt JAR (executed JVM bytecode) from dist.creeper.host, which is a third-party CDN/mirror host rather than the official feed-the-beast.com domain. The JAR is installed to /usr/share and executed at runtime as the launcher. Both checksums are 'SKIP', meaning no integrity verification is performed. creeper.host is a known FTB community mirror/CDN that has historically been used by FTB for distribution, so this is not clearly malicious, but it is not the official vendor domain and the lack of any checksum verification means a compromised or substituted JAR would go undetected. This constitutes a genuine supply-chain concern: an executed binary from a non-official host with no integrity check. The first source (the wrapper script '$pkgname') also has SKIP checksum and appears to be a local file that must exist in the PKGBUILD directory — its absence would break the build, but its presence without a checksum is also a concern. Overall: real medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cranky Supertoon <crankysupertoon@gmail.com>
    
      2# Contributor: Alisson Lauffer <alissonvitortc@gmail.com>
    
      3# Contributor: AwesomeHaircut <jesusbalbastro@gmail.com>
    
      4# Contributor: Lari Tikkanen <lartza@outlook.com>
    
      5
    
      6pkgname=feedthebeast-classic
    
      7_pkgname=feedthebeast
    
      8pkgver=1.5.1
    
      9pkgrel=3
    
      10pkgdesc="Feed The Beast offers many different styles of Minecraft modpacks to the community, catering to all tastes."
    
      11arch=('any')
    
      12url='https://feed-the-beast.com/'
    
      13license=('Apache')
    
      14# libzip is needed for many modpacks.
    
      15depends=('java-runtime=8' 'hicolor-icon-theme' 'xorg-xrandr' 'ttf-dejavu' 'libzip')
    
      16makedepends=('gendesk')
    
      17source=("$pkgname"
    
      18	"${_pkgname}-$pkgver.jar"::"https://dist.creeper.host/FTB2/launcher/FTB_Launcher.jar")
    
      19noextract=("${_pkgname}-$pkgver.jar")
    
      20sha256sums=('SKIP'
    
      21            'SKIP')
    
      22
    
      23prepare() {
    
      24    # generate .desktop
    
      25    gendesk --pkgname "Feed The Beast Classic" --pkgdesc "${pkgdesc}" --icon ${pkgname} --exec "/usr/bin/${pkgname}" -n -f
    
      26    mv "Feed The Beast Classic.desktop" "${pkgname}.desktop"
    
      27}
    
      28
    
      29package() {
    
      30    install -Dm755 "$pkgname" "${pkgdir}/usr/bin/${pkgname}"
    
      31    install -Dm644 "${_pkgname}-$pkgver.jar" "${pkgdir}/usr/share/${_pkgname}/${_pkgname}.jar"
    
      32    install -Dm644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      33    bsdtar -xf "${_pkgname}-$pkgver.jar" image/logo_ftb_large.png
    
      34    install -d -m755 "${pkgdir}/usr/share/icons/hicolor"
    
      35    cp -Rr "${srcdir}/image/logo_ftb_large.png" "${pkgdir}/usr/share/icons/${pkgname}.png"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2