gbata

maintainer Sterophonick · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged This package installs a Windows GUI tool (gbata.exe) to be run under Wine. The source is romhacking.net's S3 bucket (s3-external-1.amazonaws.com/romhacking-hacks/), which is the well-known ROMHacking.net file hosting infrastructure — a legitimate, long-standing ROM hacking community site. The gbata.exe is installed as data (Dm644, not executable) and launched via a Wine wrapper script. There is an md5sum for the zip file, providing basic integrity verification. The 'gbata' launcher script and .desktop/.png files are local to the AUR package (SKIP checksums, which is sloppy but common for locally-maintained wrapper files). The main concern is that the launcher script and desktop file have SKIP checksums and are not in the source tarball, meaning they come from the AUR git repo itself — standard AUR practice. No piracy concern: GBATA is freeware. The S3 host is romhacking.net's CDN, not a random personal bucket. Overall this is a low-risk, slightly sloppy packaging of a freeware Wine application.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): This package installs a Windows GUI tool (gbata.exe) to be run under Wine. The source is romhacking.net's S3 bucket (s3-external-1.amazonaws.com/romhacking-hacks/), which is the well-known ROMHacking.net file hosting infrastructure — a legitimate, long-standing ROM hacking community site. The gbata.exe is installed as data (Dm644, not executable) and launched via a Wine wrapper script. There is an md5sum for the zip file, providing basic integrity verification. The 'gbata' launcher script and .desktop/.png files are local to the AUR package (SKIP checksums, which is sloppy but common for locally-maintained wrapper files). The main concern is that the launcher script and desktop file have SKIP checksums and are not in the source tarball, meaning they come from the AUR git repo itself — standard AUR practice. No piracy concern: GBATA is freeware. The S3 host is romhacking.net's CDN, not a random personal bucket. Overall this is a low-risk, slightly sloppy packaging of a freeware Wine application.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(https://s3-external-1.amazonaws.com/romhacking-hacks/utilities/%5B601%5Dgbata7a-en.zip

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sterophonick
    
      2
    
      3pkgname=gbata
    
      4_pkgname='gbata'
    
      5pkgver=0.7
    
      6pkgrel=1
    
      7pkgdesc='Game Boy Advance ROM viewer and patcher'
    
      8url='http://gbadat.altervista.org'
    
      9arch=(x86_64 i686)
    
      10depends=('wine' 'winetricks')
    
      11source=(https://s3-external-1.amazonaws.com/romhacking-hacks/utilities/%5B601%5Dgbata7a-en.zip
    
      12        gbata
    
      13        gbata.desktop
    
      14        gbata.png)
    
      15md5sums=('e59501521166ffe4568fbb8fee59357f'
    
      16         'SKIP'
    
      17         'SKIP'
    
      18         'SKIP')
    
      19
    
      20
    
      21package() {
    
      22  cd $srcdir
    
      23  install -Dm755 gbata $pkgdir/usr/bin/gbata
    
      24  install -Dm644 gbata.desktop $pkgdir/usr/share/applications/gbata.desktop
    
      25  install -Dm644 gbata.png $pkgdir/usr/share/pixmaps/gbata.png
    
      26  
    
      27  mkdir -p $pkgdir/usr/share/gbata
    
      28
    
      29  install -Dm644 gbata.exe $pkgdir/usr/share/gbata
    
      30  install -Dm644 readme.txt $pkgdir/usr/share/gbata
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2