goomba-color

maintainer Sterophonick · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary bundle (goombacolor_2019_5_4.zip) from dwedit.org, a personal domain. The zip contains Windows executables (goombafront.exe, gbctrim.exe) and a GBA ROM (goomba.gba) that are installed and run via Wine. dwedit is a well-known GBA homebrew developer and Goomba Color is a legitimate GBA emulator for Game Boy/Color games, so this is not clearly malicious. However, the source is a personal/unofficial host with no reproducible build, the md5sum only covers the zip (not the other three local files which are SKIPped), and the executables are unverifiable prebuilt binaries executed at runtime via Wine. This constitutes a genuine supply-chain concern: if dwedit.org were compromised, arbitrary code would execute on the user's system. The SKIP checksums on goomba-front (a shell wrapper script that is installed as executable) are also a concern since that script is not in the source array with a verifiable hash. Overall this is a legitimate medium-risk package — real software from a known author on a personal host with unverifiable executed binaries.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=(https://www.dwedit.org/gba/goombacolor_2019_5_4.zip

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary bundle (goombacolor_2019_5_4.zip) from dwedit.org, a personal domain. The zip contains Windows executables (goombafront.exe, gbctrim.exe) and a GBA ROM (goomba.gba) that are installed and run via Wine. dwedit is a well-known GBA homebrew developer and Goomba Color is a legitimate GBA emulator for Game Boy/Color games, so this is not clearly malicious. However, the source is a personal/unofficial host with no reproducible build, the md5sum only covers the zip (not the other three local files which are SKIPped), and the executables are unverifiable prebuilt binaries executed at runtime via Wine. This constitutes a genuine supply-chain concern: if dwedit.org were compromised, arbitrary code would execute on the user's system. The SKIP checksums on goomba-front (a shell wrapper script that is installed as executable) are also a concern since that script is not in the source array with a verifiable hash. Overall this is a legitimate medium-risk package — real software from a known author on a personal host with unverifiable executed binaries.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sterophonick
    
      2pkgname=goomba-color
    
      3_pkgname='goomba-color'
    
      4pkgver=2019.05.04
    
      5pkgrel=1
    
      6pkgdesc='DMG/CGB emulator for Game Boy Advance'
    
      7arch=(x86_64 i686)
    
      8depends=('wine' 'winetricks')
    
      9source=(https://www.dwedit.org/gba/goombacolor_2019_5_4.zip
    
      10        goomba-front
    
      11        goomba-front.desktop
    
      12        goomba-front.png)
    
      13md5sums=('be58df7b75858b665e64898daaf6e3d3'
    
      14         'SKIP'
    
      15         'SKIP'
    
      16         'SKIP')
    
      17options=(!debug !strip)
    
      18
    
      19package() {
    
      20  install -Dm755 goomba-front $pkgdir/usr/bin/goomba-front
    
      21  install -Dm644 goomba-front.desktop $pkgdir/usr/share/applications/goomba-front.desktop
    
      22  install -Dm644 goomba-front.png $pkgdir/usr/share/pixmaps/goomba-front.png
    
      23
    
      24  mkdir -p $pkgdir/usr/share/goomba-color
    
      25
    
      26  cp -r $srcdir/goombafront.exe $pkgdir/usr/share/goomba-color
    
      27  cp -r $srcdir/gbctrim.exe $pkgdir/usr/share/goomba-color
    
      28  cp -r $srcdir/goomba.gba $pkgdir/usr/share/goomba-color
    
      29  chmod -R 777 $pkgdir/usr/share/goomba-color
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2