heaven-studio-nightly-bin

maintainer Orche · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary archive from archive.org (a third-party, non-official host for this project) with 'SKIP' checksums for both sources. The binary is a Unity-built Linux executable that gets installed with 755 permissions and executed directly by users. The combination of: (1) a non-official redistribution host (archive.org personal upload, not GitHub Releases), (2) completely skipped integrity verification (sha512sums=SKIP for both files), and (3) a prebuilt binary that is directly installed and executed constitutes a genuine supply-chain risk. If the archive.org artifact were replaced or tampered with, there is no checksum to detect it. The upstream project does have GitHub releases, making this unofficial redistribution unnecessary. This is a real medium-severity concern: not clearly malicious, but an executed binary from an unofficial host with no integrity check.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://archive.org/download/hs-nightly-140624/StandaloneLinux64-build.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary archive from archive.org (a third-party, non-official host for this project) with 'SKIP' checksums for both sources. The binary is a Unity-built Linux executable that gets installed with 755 permissions and executed directly by users. The combination of: (1) a non-official redistribution host (archive.org personal upload, not GitHub Releases), (2) completely skipped integrity verification (sha512sums=SKIP for both files), and (3) a prebuilt binary that is directly installed and executed constitutes a genuine supply-chain risk. If the archive.org artifact were replaced or tampered with, there is no checksum to detect it. The upstream project does have GitHub releases, making this unofficial redistribution unnecessary. This is a real medium-severity concern: not clearly malicious, but an executed binary from an unofficial host with no integrity check.

PKGBUILD

1 offending line(s) highlighted

      1# Mentioner: Orche <orkv1234@gmail.com>
    
      2# Contributor: Eli Štefků "Octelly" <eli@stefek.cz>
    
      3
    
      4pkgname=heaven-studio-nightly-bin
    
      5provides=("heaven-studio")
    
      6_pkgname=heaven-studio
    
      7pkgver=6241434638
    
      8# note: Couldn't find a proper versioning system for this project
    
      9pkgrel=7
    
      10pkgdesc="Fully playable, open source recreation of every Rhythm Heaven minigame with a built in level editor."
    
      11arch=('x86_64')
    
      12url="https://github.com/RHeavenStudio/HeavenStudio"
    
      13license=('GPL3')
    
      14source=(
    
      15  "https://archive.org/download/hs-nightly-140624/StandaloneLinux64-build.zip"
    
      16	'heaven-studio.desktop'
    
      17)
    
      18noextract=("StandaloneLinux64-build.zip")
    
      19sha512sums=(
    
      20	'SKIP'
    
      21	'SKIP'
    
      22)
    
      23makedepends=('unzip' 'tar')
    
      24
    
      25prepare() {
    
      26 unzip StandaloneLinux64-build.zip
    
      27 rm StandaloneLinux64-build.zip
    
      28 tar -xvf StandaloneLinux64.tar
    
      29 rm StandaloneLinux64.tar
    
      30}
    
      31
    
      32package() {
    
      33  cd build/StandaloneLinux64
    
      34  find . -type f -exec install -v -Dm 755 "{}" "$pkgdir/opt/$_pkgname/{}" \;
    
      35
    
      36  mkdir -p $pkgdir/usr/share/icons/hicolor/128x128/apps
    
      37  ln -sf /opt/heaven-studio/Heaven\ Studio_Data/Resources/UnityPlayer.png $pkgdir/usr/share/icons/hicolor/128x128/apps/heaven-studio.png
    
      38
    
      39  mkdir -p $pkgdir/usr/share/applications
    
      40  cd ../..
    
      41  install -Dm 755 "heaven-studio.desktop" $pkgdir/usr/share/applications
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2