flax

MEDIUM

maintainer totchi 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt binaries from a non-standard host (vps3.flaxengine.com) which is not a common release infrastructure; while likely legitimate, the source is not easily verifiable and could pose a supply-chain risk if compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=(https://vps3.flaxengine.com/store/builds/Package_$(echo $pkgver | cut -d "." -f 1)_$(echo $pkgver | cut -d "." -f 2)_0$(echo $pkgver | cut -d "." -f 3)/{FlaxEditorLinux,Linux}.zip)

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads prebuilt binaries from a non-standard host (vps3.flaxengine.com) which is not a common release infrastructure; while likely legitimate, the source is not easily verifiable and could pose a supply-chain risk if compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Totchi Lagawi <chatnoir420 at gmx dot com>
    
      2# Fomer maintainer: Crawcik <crawcik@gmail.com>
    
      3
    
      4pkgname=flax
    
      5pkgver=1.13.7012
    
      6pkgrel=1
    
      7pkgdesc="Flax Engine – multi-platform 3D game engine"
    
      8arch=('x86_64')
    
      9url="https://flaxengine.com"
    
      10license=('Flax EULA')
    
      11depends=(glibc libx11 libxcursor libxinerama zlib libvorbis libxcb gcc-libs)
    
      12makedepends=(dotnet-host)
    
      13optdepends=('dotnet-sdk: Dotnet 8 SDK'
    
      14            'vulkan-driver: Vulkan graphics driver'
    
      15            'portaudio: PortAudio audio driver'
    
      16            'libpulse: PulseAudio audio driver'
    
      17            'jack: JACK audio driver')
    
      18source=(https://vps3.flaxengine.com/store/builds/Package_$(echo $pkgver | cut -d "." -f 1)_$(echo $pkgver | cut -d "." -f 2)_0$(echo $pkgver | cut -d "." -f 3)/{FlaxEditorLinux,Linux}.zip)
    
      19noextract=({FlaxEditorLinux,Linux}.zip)
    
      20conflicts=(flax-git)
    
      21sha256sums=('cbd76dd7cd7fe54de2291045f99f0a257fd1c9729ef1d448e86f88cf49a03416'
    
      22            'bda158b83ad9b4c7cdac795990b4b35b1910a5e5e77b97a19143893ef7c8b05e')
    
      23
    
      24package() {
    
      25	cd "$srcdir"
    
      26	echo "Extracting Editor..."
    
      27	mkdir -p "$pkgdir/opt/flax/"
    
      28	bsdtar -xf "FlaxEditorLinux.zip" -C "$pkgdir/opt/flax"
    
      29	echo "Extracting Platform files..."
    
      30	mkdir -p "$pkgdir/opt/flax/Source/Platforms/Linux"
    
      31	bsdtar -xf "Linux.zip" -C "$pkgdir/opt/flax/Source/Platforms/Linux"
    
      32	mkdir -p "$pkgdir/usr/bin/"
    
      33	ln -sf "/opt/flax/Binaries/Editor/Linux/Development/FlaxEditor" "$pkgdir/usr/bin/flax"
    
      34	echo "Extracting Desktop files..."
    
      35	cd "$startdir"
    
      36	bsdtar -xf "desktop_files.tar.gz" -C "$pkgdir/usr/"
    
      37	cp --no-preserve=mode,ownership ".run.sh" "$pkgdir/opt/flax/"
    
      38	chmod +x "$pkgdir/opt/flax/.run.sh"
    
      39
    
      40	dotnet --list-sdks > /dev/null 2>/dev/null
    
      41	if [ $? -eq 0 ]; then
    
      42		_newest=0
    
      43		for _ver in $(dotnet --list-sdks | cut -b 1); do
    
      44			if [[ "$_ver" -gt "$_newest" ]]; then
    
      45				_newest=$_ver
    
      46			fi
    
      47		done
    
      48		if [[ $_newest -lt 8 ]]; then
    
      49			echo "Flax engine is using Dotnet 8 SDK. Older versions might cause problems."
    
      50			echo "Please upgrade throught pacman or manually install Dotnet 8 SDK & Runtime!"
    
      51		fi
    
      52	else
    
      53		echo "Command 'dotnet' wasn't detected. Do you have dotnet 8 installed and/or in \$PATH?"
    
      54		echo "Please install via pacman or manually Dotnet 8 SDK & Runtime!"
    
      55	fi
    
      56}
    
      57

Changes since previous scan

--- PKGBUILD @ 2026-10-21 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 # Fomer maintainer: Crawcik <crawcik@gmail.com>
 
 pkgname=flax
-pkgver=1.12.6912
+pkgver=1.13.7012
 pkgrel=1
 pkgdesc="Flax Engine – multi-platform 3D game engine"
 arch=('x86_64')
@@ -15,11 +15,11 @@
             'portaudio: PortAudio audio driver'
             'libpulse: PulseAudio audio driver'
             'jack: JACK audio driver')
-source=(https://vps2.flaxengine.com/store/builds/Package_$(echo $pkgver | cut -d "." -f 1)_$(echo $pkgver | cut -d "." -f 2)_0$(echo $pkgver | cut -d "." -f 3)/{FlaxEditorLinux,Linux}.zip)
+source=(https://vps3.flaxengine.com/store/builds/Package_$(echo $pkgver | cut -d "." -f 1)_$(echo $pkgver | cut -d "." -f 2)_0$(echo $pkgver | cut -d "." -f 3)/{FlaxEditorLinux,Linux}.zip)
 noextract=({FlaxEditorLinux,Linux}.zip)
 conflicts=(flax-git)
-sha256sums=('d7d6c835e0845e9b7de67ec2f79df62df67a82cb645b43be9e8c8c28d28dbb45'
-            '7be2ec219d2abcf5631aee307a9a52ee0051dc8f67fe5d0a542a17a4676c67b3')
+sha256sums=('cbd76dd7cd7fe54de2291045f99f0a257fd1c9729ef1d448e86f88cf49a03416'
+            'bda158b83ad9b4c7cdac795990b4b35b1910a5e5e77b97a19143893ef7c8b05e')
 
 package() {
 	cd "$srcdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 09:31:11	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2