flashpoint-launcher-bin
The package downloads a 7z archive from the project's own domain (flashpointarchive.org) which is plausibly the official source; the host is not whitelisted but belongs to the project, and the content is unpacked and installed as data, not executed remotely.
Triggered rules
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a 7z archive from the project's own domain (flashpointarchive.org) which is plausibly the official source; the host is not whitelisted but belongs to the project, and the content is unpacked and installed as data, not executed remotely.
1 higher static finding superseded - not the current verdict (shown for transparency)
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:40
"https://download.flashpointarchive.org/upload/fp${_launcherver}_lin_${_timestamp}.7z"
PKGBUILD
1 offending line(s) highlighted# Maintainer: hmarcelino <henry_marcelino at outlook dot com>
# Contributor: bbaster <bbaster at tutanota dot org>
pkgname=flashpoint-launcher-bin
pkgver=14.0.3_20251201
_launcherver=${pkgver%_*}
_timestamp=${pkgver#*_}
pkgrel=3
pkgdesc="An archive for games and animations from the web."
arch=('x86_64')
url="https://flashpointarchive.org/"
license=('MIT')
provides=(flashpoint-launcher)
conflicts=(flashpoint-launcher)
depends=(
'pulse-native-provider'
'lib32-libxcomposite'
'lib32-libpulse'
'gtk3'
'nss'
'php'
'7zip'
'bash'
)
optdepends=(
'gtk2: native Flash support'
'libxt: native Flash support'
)
options=(
'!strip'
'!emptydirs'
)
source=(
"https://download.flashpointarchive.org/upload/fp${_launcherver}_lin_${_timestamp}.7z"
"flashpoint-launcher.sh"
"setup-desktop-entry.patch"
"start-flashpoint.patch")
sha256sums=(
'f393a98c5c35e229a744c102b0cb53270b1b4f1b3ebd40d604f98323444a4b1f'
'b8865f06dda550effba982517de304a448209fcf4a5e2180929fcf21ccc28508'
'e443b979700a8691eb3ba1f7b55cb23d758b7cc13d0fb612c7dcf96a54e8f9d0'
'dea20d1a1ac8765adf6f81e8c1110dfe164770a38cd84b500c6dff258f690446')
prepare() {
patch -p1 -i setup-desktop-entry.patch -d "${srcdir}"
patch -p1 -i start-flashpoint.patch -d "${srcdir}"
}
package() {
echo "Copying data files ..."
mkdir -vp "${pkgdir}/opt/Flashpoint/"
find "${srcdir}/" -maxdepth 1 -not -name "fp${_launcherver}_lin_main_${_timestamp}.7z" -exec cp -rp {} "${pkgdir}/opt/Flashpoint/" \;
echo "Creating a launcher script wrapper..."
mkdir -vp "${pkgdir}/usr/bin"
cp -p ./flashpoint-launcher.sh "${pkgdir}/usr/bin/flashpoint-launcher"
echo "Creating the desktop file..."
chmod +x "./setup-desktop-entry.sh"
ENTRY="${srcdir}/flashpoint-archive.desktop" FP_DIR="/opt/Flashpoint/" "./setup-desktop-entry.sh"
echo "Installing licenses and desktop file..."
mkdir -vp "${pkgdir}/usr/share/licenses"
cp -rp "${pkgdir}/opt/Flashpoint/Launcher/licenses/" "${pkgdir}/usr/share/licenses/flashpoint"
install -Dm644 "${srcdir}/flashpoint-archive.desktop" "${pkgdir}/usr/share/applications/flashpoint-archive.desktop"
echo "Removing unneeded src folder..."
rm -rf "${pkgdir}/opt/Flashpoint/src"
echo "Removing unneeded Libraries folder..."
rm -rf "${pkgdir}/opt/Flashpoint/Libraries"
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |