holocure-bin

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD dynamically resolves the download URL at parse time by executing a curl POST request to itch.io during makepkg's sourcing phase, before any integrity check can be applied. The resolved URL is then used as a source entry. While itch.io is a legitimate game distribution platform and this is a real fan game, the dynamic URL resolution pattern means: (1) the actual binary URL is not pinned in the PKGBUILD, (2) the b2sum for the zip appears to be a fixed checksum that may not match what itch.io returns at build time (itch.io file IDs can be updated), and (3) the DLAGENTS override uses bare curl without --fail or integrity verification beyond the b2sum. The checksum IS present (not SKIP), so if itch.io serves a different file the build would fail — this partially mitigates the risk. However, the pattern of executing network code at parse time to resolve a source URL is a genuine supply-chain concern: if the itch.io endpoint or the curl/sed pipeline were manipulated, a different binary could be fetched. The installed artifact is a Windows PE binary run under Wine, which is executed code from a non-official/personal host resolved dynamically. This warrants a medium rating — it is not clearly malicious but represents a real, non-standard supply-chain pattern with an executed binary.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:12 /usr/bin/env curl 'https://kay-yu.itch.io/holocure/file/7335355' -X POST \

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD dynamically resolves the download URL at parse time by executing a curl POST request to itch.io during makepkg's sourcing phase, before any integrity check can be applied. The resolved URL is then used as a source entry. While itch.io is a legitimate game distribution platform and this is a real fan game, the dynamic URL resolution pattern means: (1) the actual binary URL is not pinned in the PKGBUILD, (2) the b2sum for the zip appears to be a fixed checksum that may not match what itch.io returns at build time (itch.io file IDs can be updated), and (3) the DLAGENTS override uses bare curl without --fail or integrity verification beyond the b2sum. The checksum IS present (not SKIP), so if itch.io serves a different file the build would fail — this partially mitigates the risk. However, the pattern of executing network code at parse time to resolve a source URL is a genuine supply-chain concern: if the itch.io endpoint or the curl/sed pipeline were manipulated, a different binary could be fetched. The installed artifact is a Windows PE binary run under Wine, which is executed code from a non-official/personal host resolved dynamically. This warrants a medium rating — it is not clearly malicious but represents a real, non-standard supply-chain pattern with an executed binary.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Edward Shen <code@eddie.sh>
    
      2
    
      3pkgname=holocure-bin
    
      4pkgver=0.5.1676187876
    
      5pkgrel=1
    
      6pkgdesc="A free unofficial fan game with Hololive members"
    
      7arch=('x86_64')
    
      8url=https://kay-yu.itch.io/holocure
    
      9license=('custom')
    
      10depends=(wine)
    
      11_srcurl=$(
    
      12  /usr/bin/env curl 'https://kay-yu.itch.io/holocure/file/7335355' -X POST \
    
      13  | sed -E 's/.*(https:[\/a-zA-Z0-9\.\?&=@%]*).*/\1/; s/\\//g'
    
      14)
    
      15source=(holocure holocure.desktop holocure.png "$pkgname-$pkgver.zip"::$_srcurl)
    
      16# update via updpkgsums
    
      17b2sums=('4301db2ba2d8bd5e9ccddf617c07846323b002eb5aa0e1fdc8df84e2d90d4ce7167fa0097fbcd3f159d209d1950c63afa8ac3d70a18161723566c48d69a8ee08'
    
      18        'b7260f800bf63a8f058b7df9965190583a4b3f6ad3d85aa752e5e9e8aa6f5a17742affe347ee70aee74f781657767ed9c845cbe1c48bc752cb0e7988e1532d92'
    
      19        'ede12f7c2bedcf077dd6da495f5aa2c45b95db128eb28af562b11fc13dcf21db18d98aa818b6b81514049696d9e622364d1f5044282950faa6c64499b2c613c5'
    
      20        '502a21678bd67582dabe8fd3a738443cb9c70a60fde12f015e9fce24a19a9d5cee261487c9d515bee46bcbdb6da22e9a4b252d5b61361bd2298d5524e028b5c9')
    
      21DLAGENTS=('https::/usr/bin/env curl -o %o')
    
      22options=(!strip)
    
      23
    
      24package() {
    
      25  install -Dm644 -t "${pkgdir}/usr/share/holocure" audiogroup1.dat audiogroup2.dat data.win HoloCure.exe options.ini
    
      26  install -Dm644 -t "${pkgdir}/usr/share/applications/" holocure.desktop
    
      27  install -Dm644 -t "${pkgdir}/usr/share/pixmaps/" holocure.png
    
      28  install -Dm755 -t "${pkgdir}/usr/bin/" holocure
    
      29  cat > LICENSE << EOF
    
      30Video/Stream Content: Please feel free to record or stream this game however you'd like as an independent creator! 
    
      31
    
      32However, you may not use this game for any direct business purposes for profit or purposes that conflict with Cover Corps' Derivative Works guidelines. 
    
      33
    
      34Disclaimers: We are not affiliated with Hololive or Cover Corp. in any way. This project was made while following all guidelines under the Hololive Derivative Works guidelines (https://en.hololive.tv/terms). There is no monetization in this game. All visual and music assets used in this game are originally made for this game specifically. All sound assets are bought and paid for with the license to use commercially and non-commercially. 
    
      35EOF
    
      36  install -Dm644 -t "${pkgdir}/usr/share/licenses/${pkgname}/" LICENSE
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2