flax

maintainer totchi · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binaries (FlaxEditorLinux.zip and Linux.zip) from vps2.flaxengine.com, which is a subdomain of the official Flax Engine domain (flaxengine.com). This is the vendor's own distribution infrastructure, not a random personal host. The sha256sums are hardcoded, providing integrity verification. However, the host is a VPS subdomain rather than a canonical release CDN (e.g., GitHub releases), and there is no GPG signature verification — only hash checks. The binaries are extracted and executed directly (/opt/flax/Binaries/Editor/Linux/Development/FlaxEditor). Additionally, the package() function references 'desktop_files.tar.gz' and '.run.sh' which are not listed in source=() at all, meaning they are expected to be present in $startdir (the git clone of the AUR package) — this is a non-standard pattern that could allow a compromised AUR repository to inject arbitrary files. The missing sources from source=() is the more concerning issue: .run.sh is chmod +x'd and installed, but its provenance is not verified via the standard source/checksum mechanism. Overall this is a real medium-severity supply-chain concern due to the untracked sources (.run.sh, desktop_files.tar.gz) installed without integrity verification in the standard PKGBUILD sense, combined with prebuilt binary installation.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=(https://vps2.flaxengine.com/store/builds/Package_$(echo $pkgver | cut -d "." -f 1)_$(echo $pkgver | cut -d "." -f 2)_0$(echo $pkgver | cut -d "." -f 3)/{FlaxEditorLinux,Linux}.zip)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt binaries (FlaxEditorLinux.zip and Linux.zip) from vps2.flaxengine.com, which is a subdomain of the official Flax Engine domain (flaxengine.com). This is the vendor's own distribution infrastructure, not a random personal host. The sha256sums are hardcoded, providing integrity verification. However, the host is a VPS subdomain rather than a canonical release CDN (e.g., GitHub releases), and there is no GPG signature verification — only hash checks. The binaries are extracted and executed directly (/opt/flax/Binaries/Editor/Linux/Development/FlaxEditor). Additionally, the package() function references 'desktop_files.tar.gz' and '.run.sh' which are not listed in source=() at all, meaning they are expected to be present in $startdir (the git clone of the AUR package) — this is a non-standard pattern that could allow a compromised AUR repository to inject arbitrary files. The missing sources from source=() is the more concerning issue: .run.sh is chmod +x'd and installed, but its provenance is not verified via the standard source/checksum mechanism. Overall this is a real medium-severity supply-chain concern due to the untracked sources (.run.sh, desktop_files.tar.gz) installed without integrity verification in the standard PKGBUILD sense, combined with prebuilt binary installation.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Totchi Lagawi <chatnoir420 at gmx dot com>
    
      2# Fomer maintainer: Crawcik <crawcik@gmail.com>
    
      3
    
      4pkgname=flax
    
      5pkgver=1.12.6912
    
      6pkgrel=1
    
      7pkgdesc="Flax Engine – multi-platform 3D game engine"
    
      8arch=('x86_64')
    
      9url="https://flaxengine.com"
    
      10license=('Flax EULA')
    
      11depends=(glibc libx11 libxcursor libxinerama zlib libvorbis libxcb gcc-libs)
    
      12makedepends=(dotnet-host)
    
      13optdepends=('dotnet-sdk: Dotnet 8 SDK'
    
      14            'vulkan-driver: Vulkan graphics driver'
    
      15            'portaudio: PortAudio audio driver'
    
      16            'libpulse: PulseAudio audio driver'
    
      17            'jack: JACK audio driver')
    
      18source=(https://vps2.flaxengine.com/store/builds/Package_$(echo $pkgver | cut -d "." -f 1)_$(echo $pkgver | cut -d "." -f 2)_0$(echo $pkgver | cut -d "." -f 3)/{FlaxEditorLinux,Linux}.zip)
    
      19noextract=({FlaxEditorLinux,Linux}.zip)
    
      20conflicts=(flax-git)
    
      21sha256sums=('d7d6c835e0845e9b7de67ec2f79df62df67a82cb645b43be9e8c8c28d28dbb45'
    
      22            '7be2ec219d2abcf5631aee307a9a52ee0051dc8f67fe5d0a542a17a4676c67b3')
    
      23
    
      24package() {
    
      25	cd "$srcdir"
    
      26	echo "Extracting Editor..."
    
      27	mkdir -p "$pkgdir/opt/flax/"
    
      28	bsdtar -xf "FlaxEditorLinux.zip" -C "$pkgdir/opt/flax"
    
      29	echo "Extracting Platform files..."
    
      30	mkdir -p "$pkgdir/opt/flax/Source/Platforms/Linux"
    
      31	bsdtar -xf "Linux.zip" -C "$pkgdir/opt/flax/Source/Platforms/Linux"
    
      32	mkdir -p "$pkgdir/usr/bin/"
    
      33	ln -sf "/opt/flax/Binaries/Editor/Linux/Development/FlaxEditor" "$pkgdir/usr/bin/flax"
    
      34	echo "Extracting Desktop files..."
    
      35	cd "$startdir"
    
      36	bsdtar -xf "desktop_files.tar.gz" -C "$pkgdir/usr/"
    
      37	cp --no-preserve=mode,ownership ".run.sh" "$pkgdir/opt/flax/"
    
      38	chmod +x "$pkgdir/opt/flax/.run.sh"
    
      39
    
      40	dotnet --list-sdks > /dev/null 2>/dev/null
    
      41	if [ $? -eq 0 ]; then
    
      42		_newest=0
    
      43		for _ver in $(dotnet --list-sdks | cut -b 1); do
    
      44			if [[ "$_ver" -gt "$_newest" ]]; then
    
      45				_newest=$_ver
    
      46			fi
    
      47		done
    
      48		if [[ $_newest -lt 8 ]]; then
    
      49			echo "Flax engine is using Dotnet 8 SDK. Older versions might cause problems."
    
      50			echo "Please upgrade throught pacman or manually install Dotnet 8 SDK & Runtime!"
    
      51		fi
    
      52	else
    
      53		echo "Command 'dotnet' wasn't detected. Do you have dotnet 8 installed and/or in \$PATH?"
    
      54		echo "Please install via pacman or manually Dotnet 8 SDK & Runtime!"
    
      55	fi
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2