firestorm-bin

LOW

maintainer fennectech 62 votes scanned 2026-08-29 00:29:17.522988

View on AUR

Why flagged

The package downloads a prebuilt binary from the official project release host (downloads.firestormviewer.org), which is not on the whitelist but is plausibly the project's own infrastructure; the source is verifiable via b2sum, and no code execution or obfuscation occurs.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official project release host (downloads.firestormviewer.org), which is not on the whitelist but is plausibly the project's own infrastructure; the source is verifiable via b2sum, and no code execution or obfuscation occurs.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("https://downloads.firestormviewer.org/release/linux/${tardir}.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: FennecTECH <fennectech@gmail.com>
    
      2pkgname=firestorm-bin
    
      3pkgver=7.2.4.80712
    
      4pkgrel=2
    
      5pkgdesc="Firestorm is a feature-packed third-party viewer for Second Life."
    
      6url="http://www.firestormviewer.org/"
    
      7license=('GPL')
    
      8arch=('x86_64')
    
      9depends=(apr-util dbus-glib glu gtk2 lib32-libidn lib32-libsndfile
    
      10         lib32-util-linux lib32-zlib libbsd libgl libidn libjpeg-turbo
    
      11         libpng libxcrypt-compat libxss libxml2 mesa nss openal sdl
    
      12         vlc zlib)
    
      13optdepends=(
    
      14  'alsa-lib: for ALSA support'
    
      15  'pepper-flash: for inworld Flash support'
    
      16  'freealut: for OpenAL support'
    
      17  'gstreamer: For video support - may need good, bad and ugly plugins'
    
      18  'lib32-gst-plugins-good: for voice support'
    
      19  'lib32-libidn11: for voice support'
    
      20  'libpulse: for PulseAudio support'
    
      21  'mesa-libgl: For Intel, Radeon, Nouveau support'
    
      22  'nvidia-libgl: for NVIDIA support'
    
      23  'nvidia-utils: for NVIDIA support')
    
      24install=firestorm.install
    
      25tardir="Phoenix-Firestorm-Releasex64_AVX2-${pkgver//./-}"
    
      26source=("https://downloads.firestormviewer.org/release/linux/${tardir}.tar.xz"
    
      27        firestorm.desktop
    
      28        firestorm.launcher)
    
      29b2sums=('b06c08f9d365501931e3553c4a52b11612c6c52797209166cc72e4be98daa80c7fce3728b68efe9b00e802a28c377b07feec49e55649469cfda6b7f5d7562963'
    
      30	'225364d45839e61dd2ed3f3120e0c42111e72c07821180aa60de422731c61b3fc55cfb9977065d067e76a007461c05543441a30fcd8f9b1454f4b2e06e03a608'
    
      31        '5b9342aa587e12bd03e8abd24e5d2d9c53cdddee949409045d20931b572d317de23c1eaea6efabe67683ca435bde428c0ab0706760eff0acf9b301f42abe38c4')
    
      32
    
      33prepare() {
    
      34  cd "${srcdir}/${tardir}"
    
      35  for patch in ../*.patch; do
    
      36    if [ ! -f "$patch" ]; then
    
      37      break;
    
      38    else
    
      39      patch -p1 -i "$patch"
    
      40    fi
    
      41  done
    
      42}
    
      43
    
      44package() {
    
      45  install -d "${pkgdir}/usr/lib"
    
      46  cp -a "${srcdir}/${tardir}" "${pkgdir}"/usr/lib/firestorm
    
      47  cd "${pkgdir}/usr/lib/firestorm"
    
      48
    
      49  find app_settings skins -type f -execdir chmod 644 "{}" +
    
      50
    
      51  # find and remove broken symlinks
    
      52  find -L . -type l -delete
    
      53
    
      54  # Install desktop file
    
      55  install -D -m644 "${srcdir}"/firestorm.desktop \
    
      56          "$pkgdir"/usr/share/applications/firestorm.desktop
    
      57
    
      58  # Install icon file
    
      59  install -D -m644 firestorm_icon.png \
    
      60          "$pkgdir"/usr/share/pixmaps/firestorm.png
    
      61
    
      62  # Install launcher
    
      63  install -D -m755 "${srcdir}"/firestorm.launcher \
    
      64          "$pkgdir"/usr/bin/firestorm
    
      65}
    
      66

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-29 00:29
@@ -1,7 +1,7 @@
 # Maintainer: FennecTECH <fennectech@gmail.com>
 pkgname=firestorm-bin
 pkgver=7.2.4.80712
-pkgrel=1
+pkgrel=2
 pkgdesc="Firestorm is a feature-packed third-party viewer for Second Life."
 url="http://www.firestormviewer.org/"
 license=('GPL')
@@ -27,7 +27,7 @@
         firestorm.desktop
         firestorm.launcher)
 b2sums=('b06c08f9d365501931e3553c4a52b11612c6c52797209166cc72e4be98daa80c7fce3728b68efe9b00e802a28c377b07feec49e55649469cfda6b7f5d7562963'
-        'd9343e4f93fc549fa3dc98bef3bfcd96ffae11e0fbdcc0ef604312e5fa1e0b5217a44e0988dac24fe2ce556c2737322ac66c8cc026aee471d2263743c4287f30'
+	'225364d45839e61dd2ed3f3120e0c42111e72c07821180aa60de422731c61b3fc55cfb9977065d067e76a007461c05543441a30fcd8f9b1454f4b2e06e03a608'
         '5b9342aa587e12bd03e8abd24e5d2d9c53cdddee949409045d20931b572d317de23c1eaea6efabe67683ca435bde428c0ab0706760eff0acf9b301f42abe38c4')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-29 00:29:17	Low	2
2026-08-28 23:36:57	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 18:55:24	Clean	2
2026-06-18 16:11:54	Medium	1