ichgytw-bin

MEDIUM

maintainer lukerb52 0 votes scanned 2026-10-25 07:42:02.731731

View on AUR

Why flagged

The package installs an unverifiable prebuilt AppImage from a non-whitelisted, project-specific release URL, which could be silently replaced with malicious code.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs an unverifiable prebuilt AppImage from a non-whitelisted, project-specific release URL, which could be silently replaced with malicious code.

PKGBUILD

      1# Maintainer: Luke Bubar <luke@coldmail.xyz>
    
      2
    
      3pkgname=ichgytw-bin
    
      4_pkgname=ichgytw
    
      5pkgver=0.1.96
    
      6_tag="ICHGYTW_${pkgver}"
    
      7_commit=c624e28e73a06b0f712dd506d4c6febef4b2d483
    
      8pkgrel=1
    
      9pkgdesc='A static recompilation project of the N64 game The World Is Not Enough'
    
      10arch=('x86_64')
    
      11url='https://github.com/riseio/TWIPE_00Sheven'
    
      12
    
      13# The repository carries no licence.
    
      14license=('LicenseRef-unknown')
    
      15depends=(
    
      16  'hicolor-icon-theme'
    
      17  'libdrm'
    
      18  'libx11'
    
      19  'libxcb'
    
      20  'libxcursor'
    
      21  'libxext'
    
      22  'libxfixes'
    
      23  'libxi'
    
      24  'libxkbcommon'
    
      25  'libxrandr'
    
      26  'libxss'
    
      27  'mesa'
    
      28  'vulkan-driver'
    
      29  'vulkan-icd-loader'
    
      30)
    
      31optdepends=(
    
      32  'wayland: native Wayland window'
    
      33  'kdialog: error dialogs at startup'
    
      34)
    
      35provides=("${_pkgname}")
    
      36conflicts=("${_pkgname}")
    
      37# The AppImage brings its own glibc, loader and compiler; stripping breaks them.
    
      38options=('!strip' '!debug')
    
      39_appimage="${_pkgname}-${pkgver}-x86_64.AppImage"
    
      40source=(
    
      41  "${_appimage}::${url}/releases/download/${_tag}/ICHGYTW-SteamDeck-x86_64.AppImage"
    
      42  "README-${pkgver}.md::https://raw.githubusercontent.com/riseio/TWIPE_00Sheven/${_commit}/README.md"
    
      43)
    
      44noextract=("${_appimage}")
    
      45sha256sums=('6e4c3f12baa3cfe817bc13cb7cec39649925859b4d68f5b2fc17038f93786cef'
    
      46            '4f6fba95f184204c93ff772a9ffff5d6d08fb755068f055e24ba93d6118652ac')
    
      47
    
      48prepare() {
    
      49  rm -rf squashfs-root
    
      50  chmod +x "${_appimage}"
    
      51  ./"${_appimage}" --appimage-extract >/dev/null
    
      52
    
      53  # The game keeps saves, settings and its compiled code in data/ beside the
    
      54  # AppImage, which /opt is not; AppRun takes another folder from these
    
      55  # variables. APPDIR and APPIMAGE are cleared so that a launcher started from
    
      56  # another AppImage does not point AppRun elsewhere.
    
      57  cat > "${_pkgname}.sh" << 'EOF'
    
      58#!/bin/sh
    
      59data="${XDG_DATA_HOME:-$HOME/.local/share}/ichgytw"
    
      60mkdir -p "$data" || exit 1
    
      61unset APPDIR APPIMAGE
    
      62export APP_FOLDER_PATH="${APP_FOLDER_PATH:-$data}"
    
      63export TWINE_DEBUG_LOG="${TWINE_DEBUG_LOG:-$data/twine_debug.log}"
    
      64exec /opt/ichgytw/AppRun "$@"
    
      65EOF
    
      66
    
      67  cat > "${_pkgname}.desktop" << EOF
    
      68[Desktop Entry]
    
      69Type=Application
    
      70Name=I Could Have Given You The World
    
      71Comment=Native PC port of 007: The World Is Not Enough
    
      72Exec=${_pkgname} %f
    
      73Icon=${_pkgname}
    
      74Categories=Game;ActionGame;
    
      75Terminal=false
    
      76EOF
    
      77}
    
      78
    
      79package() {
    
      80  install -d "${pkgdir}/opt/${_pkgname}"
    
      81  cp -a squashfs-root/. "${pkgdir}/opt/${_pkgname}/"
    
      82  rm -f "${pkgdir}/opt/${_pkgname}/.DirIcon" "${pkgdir}/opt/${_pkgname}/TWINERecompiled.desktop"
    
      83  chmod -R u=rwX,go=rX "${pkgdir}/opt/${_pkgname}"
    
      84
    
      85  install -Dm755 "${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      86  install -Dm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      87  install -Dm644 squashfs-root/TWINERecompiled.svg \
    
      88    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${_pkgname}.svg"
    
      89  install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 07:42:02	Medium	2