itch-setup-bin

maintainer FabioLolix · 127 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The binary (itch-setup) is downloaded from itch.io/app/download, which is the official itch.io distribution endpoint — this is the canonical upstream source for the itch-setup installer, not a personal or unofficial host. The PKGBUILD does include a sha256sum for the x86_64 binary ('16e87c1ea4704724e9e07a950ce122990f5c5dc8db269ae342c34919aca1074b'), which provides integrity verification at build time. The dynamic filename using `date +%F-%H` in the source array is sloppy (it means the checksum will only match if built within the same hour, and will break on rebuild), but this is a packaging quality issue rather than a security threat. The source is the official vendor's distribution URL, the license is fetched from the official GitHub repo, and icons/metadata come from the official itch GitHub archive. The main concern is that the date-stamped filename makes the checksum fragile and the package effectively non-reproducible, but there is no evidence of malicious redirection or unofficial hosting. Rating: low (sloppy packaging, not a supply-chain attack).

Triggered rules

LOW AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is LOW (confidence 82%): The binary (itch-setup) is downloaded from itch.io/app/download, which is the official itch.io distribution endpoint — this is the canonical upstream source for the itch-setup installer, not a personal or unofficial host. The PKGBUILD does include a sha256sum for the x86_64 binary ('16e87c1ea4704724e9e07a950ce122990f5c5dc8db269ae342c34919aca1074b'), which provides integrity verification at build time. The dynamic filename using `date +%F-%H` in the source array is sloppy (it means the checksum will only match if built within the same hour, and will break on rebuild), but this is a packaging quality issue rather than a security threat. The source is the official vendor's distribution URL, the license is fetched from the official GitHub repo, and icons/metadata come from the official itch GitHub archive. The main concern is that the date-stamped filename makes the checksum fragile and the package effectively non-reproducible, but there is no evidence of malicious redirection or unofficial hosting. Rating: low (sloppy packaging, not a supply-chain attack).

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_x86_64=("itch-setup-$(date +%F-%H)-amd64::https://itch.io/app/download?platform=linux")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fabio 'Lolix' Loli <lolix@disroot.org> -> https://github.com/FabioLolix
    
      2# Contributor: Paragoumba <paragoumba@protonmail.com>
    
      3# Contributor: Amos Wenger <amos@itch.io>
    
      4
    
      5pkgname=itch-setup-bin
    
      6pkgver=1.29.0
    
      7pkgrel=1
    
      8pkgdesc="Installer for the itch.io desktop app"
    
      9arch=(x86_64)
    
      10url="https://itch.io/"
    
      11license=(MIT)
    
      12depends=(gtk3)
    
      13_itchver=26.13.0
    
      14source=("itch-${_itchver}.tar.gz::https://github.com/itchio/itch/archive/refs/tags/v${_itchver}.tar.gz"
    
      15        "itch-setup-LICENSE::https://raw.githubusercontent.com/itchio/itch-setup/master/LICENSE"
    
      16        'itch.desktop'
    
      17        'itch.sh')
    
      18provides=(itch-setup)
    
      19conflicts=(itch-setup itch)
    
      20source_x86_64=("itch-setup-$(date +%F-%H)-amd64::https://itch.io/app/download?platform=linux")
    
      21sha256sums=('94843e035f4d41a0888e872da2cd100cea04cccd8a409c4e46a8a082fb92ec5b'
    
      22            'd50905ab2e78d6ed3773959d6fb3c1c2fee724cf497f1c441cacb3765eac30ff'
    
      23            '57e1c8ad285b89f3380cd028aa51e8083a8e4327cc5763d396caf607e905efcf'
    
      24            '985cf842686598dd7e4e153f6fd7c9ee901fd200403893235e2974b108653bcf')
    
      25sha256sums_x86_64=('16e87c1ea4704724e9e07a950ce122990f5c5dc8db269ae342c34919aca1074b')
    
      26
    
      27package() {
    
      28  install -Dm755 itch-setup-*-amd64 "${pkgdir}/usr/bin/itch-setup"
    
      29  install -Dm755 itch.sh "${pkgdir}/usr/bin/itch"
    
      30  install -Dm644 itch.desktop -t "${pkgdir}/usr/share/applications/"
    
      31  install -Dm644 itch-setup-LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      32
    
      33  cd "itch-${_itchver}"
    
      34  for icon in release/images/itch-icons/icon*.png
    
      35  do
    
      36    iconsize="${icon#release/images/itch-icons/icon}"
    
      37    iconsize="${iconsize%.png}"
    
      38    icondir="${pkgdir}/usr/share/icons/hicolor/${iconsize}x${iconsize}/apps/"
    
      39    install -d "${icondir}"
    
      40    install -Dm644 "$icon" "$icondir/itch.png"
    
      41  done
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2