inthecube-bin
LOW
maintainer vitaliikuzhdin
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt snap files from the official snapcraft.io API, which is a trusted distribution platform; although the host is not whitelisted, the sources are verified via sha384sums and the snap contents are unpacked and installed in a controlled manner without executing arbitrary remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt snap files from the official snapcraft.io API, which is a trusted distribution platform; although the host is not whitelisted, the sources are verified via sha384sums and the snap contents are unpacked and installed in a controlled manner without executing arbitrary remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:44
"https://api.snapcraft.io/api/v1/snaps/download/ffE6WWnxg1lDprAggJxGUGwlLQjaQQnQ_1148.snap"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
2
3
_pkgname="inthecube"
4
pkgname="${_pkgname}-bin"
5
pkgver=89
6
_commit="0d1a22b8ee36128895f7f5780278768190619bd0" # 89
7
pkgrel=2
8
pkgdesc="A tiny cube in a giant maze. Platform/puzzle game."
9
arch=(
10
'aarch64'
11
'armv7h'
12
'i686'
13
'powerpc64le'
14
'x86_64'
15
)
16
url="https://arthursonzogni.com/en/InTheCube/"
17
_url="https://github.com/ArthurSonzogni/InTheCube"
18
license=(
19
'MIT'
20
)
21
depends=(
22
'glibc'
23
'libgcc'
24
'libglvnd'
25
'libstdc++'
26
'libx11'
27
)
28
makedepends=(
29
'squashfs-tools'
30
)
31
provides=(
32
"${_pkgname}"
33
)
34
conflicts=(
35
"${_pkgname}"
36
)
37
_pkgsrc="${_pkgname}-${pkgver}"
38
source=(
39
"${_pkgsrc}-README.md::${_url}/raw/${_commit}/README.md"
40
"${_pkgsrc}-LICENSE::${_url}/raw/${_commit}/LICENSE"
41
)
42
# https://askubuntu.com/a/1196449
43
source_aarch64=(
44
"https://api.snapcraft.io/api/v1/snaps/download/ffE6WWnxg1lDprAggJxGUGwlLQjaQQnQ_1148.snap"
45
)
46
source_armv7h=(
47
"https://api.snapcraft.io/api/v1/snaps/download/ffE6WWnxg1lDprAggJxGUGwlLQjaQQnQ_1147.snap"
48
)
49
source_i686=(
50
"https://api.snapcraft.io/api/v1/snaps/download/ffE6WWnxg1lDprAggJxGUGwlLQjaQQnQ_1136.snap"
51
)
52
source_powerpc64le=(
53
"https://api.snapcraft.io/api/v1/snaps/download/ffE6WWnxg1lDprAggJxGUGwlLQjaQQnQ_1146.snap"
54
)
55
source_x86_64=(
56
"https://api.snapcraft.io/api/v1/snaps/download/ffE6WWnxg1lDprAggJxGUGwlLQjaQQnQ_1145.snap"
57
)
58
sha384sums=('14edd041ed4dd9e5aa5d8c6b4d2f340b78b3c3ef5bfd7e995762c0d34ab98d25b719358a99e8b089dac5b58ce54186e4'
59
'4359b6622c1716dc73b3cdb3840bf9153837c6245c71f1f8274edcaed2d6ade6bc6f1d4f6b64bea3faaa5c8c628bd0bc')
60
sha384sums_aarch64=('faaf0d32b068c43cea835f670b78a70e4ba597ec736e8f1e5f2880084ff6918cf7da0a4af7be708bd3d267f1e72c0af5')
61
sha384sums_armv7h=('7f431e221389bf5cafe680f59bfa5530c7fe7ff86f0425905f1f9bcfa5d1a067fe26ebb0f5a032a07175dca6cb33ae74')
62
sha384sums_i686=('4db93c8e5e83432cc63fd2272b94c86fb60c83a315d83ecd3711e777370c269f63b4422e1a9032f5ac36a12d5c884d5f')
63
sha384sums_powerpc64le=('3f97d16bf51658ec5d09bc8a3b077e60b32a52c88fa69063f0fedc41db9ea9977201015ad3112e71b062d73cd43a8b5f')
64
sha384sums_x86_64=('40920d3efc67fdd183c2bc580912d5212492cd15f8730820cc38383f19d1cc38b36582bfae03cf31e8e06a74e6d1d176')
65
66
prepare() {
67
local source_array="source_${CARCH}[0]"
68
local source_url="${!source_array}"
69
local source_artifact="${source_url##*/}"
70
71
cd "${srcdir}"
72
unsquashfs -f -d "${srcdir}/${source_artifact%.snap}" "${source_artifact}"
73
74
cd "${source_artifact%.snap}/meta/gui"
75
sed -e "s|^Icon=.*|Icon=${_pkgname}|g" \
76
-i "${_pkgname}.desktop"
77
}
78
79
package() {
80
local source_array="source_${CARCH}[0]"
81
local source_url="${!source_array}"
82
local source_artifact="${source_url##*/}"
83
84
cd "${srcdir}"
85
install -vDm644 "${_pkgsrc}-README.md" "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
86
install -vDm644 "${_pkgsrc}-LICENSE" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
87
88
cd "${source_artifact%.snap}"
89
install -vDm755 "usr/bin/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
90
91
cp -va --parents --no-preserve=ownership "usr/share/${_pkgname}" -t "${pkgdir}"
92
93
cd "meta/gui"
94
install -vDm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
95
install -vDm644 "${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
96
}
97
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |