katawa-shoujo
maintainer snit
· 22 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a source tarball from a non-whitelisted but project-associated CDN (fhs.sh, linked from katawa-shoujo.com); the content is a game for Ren'Py, not executable code, and is verified by a matching sha256sum; worst case is data tampering, not remote code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from a non-whitelisted but project-associated CDN (fhs.sh, linked from katawa-shoujo.com); the content is a game for Ren'Py, not executable code, and is verified by a matching sha256sum; worst case is data tampering, not remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"ks.tar.zst::https://cdn.fhs.sh/ks/bin/${pkgver}/%5B4ls%5D_katawa_shoujo_${pkgver}-%5Blinux-x86%5D%5BBA993979%5D.tar.zst"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: snit <snit@cock.li>
2
# Contributor: Cravix < dr dot neemous at gmail dot com >
3
4
_pkgname="katawa-shoujo"
5
pkgname="$_pkgname"
6
pkgver=1.3.2
7
pkgrel=1
8
pkgdesc="A bishoujo-style visual novel by Four Leaf Studios"
9
url="https://www.katawa-shoujo.com"
10
license=("CC-BY-NC-ND-3.0")
11
arch=('any')
12
13
options=('!debug' '!strip')
14
15
_pkgsrc="Katawa Shoujo-$pkgver-linux"
16
source=(
17
"ks.tar.zst::https://cdn.fhs.sh/ks/bin/${pkgver}/%5B4ls%5D_katawa_shoujo_${pkgver}-%5Blinux-x86%5D%5BBA993979%5D.tar.zst"
18
"katawa-shoujo.png"
19
)
20
21
sha256sums=(
22
'c76b644b9d7582b20c50d0a984e426b6a85d8c564325e73ad29637210e31e0af'
23
'dcd08ef958f785ac52b88a255680e385051d6b6a9626e57f00acb44021d7c0ee'
24
)
25
26
package() {
27
depends=('renpy6-bin')
28
29
# main files
30
install -dm755 "$pkgdir/usr/share/$_pkgname"
31
cp --reflink=auto -a "$_pkgsrc/game" "$_pkgsrc/Katawa Shoujo.py" "$pkgdir/usr/share/$_pkgname/"
32
33
# script
34
install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << END
35
#!/usr/bin/env sh
36
RENPY="/usr/bin/renpy6"
37
if [ ! -e "\$RENPY" ]; then
38
RENPY="/usr/bin/renpy"
39
fi
40
exec "\$RENPY" "/usr/share/katawa-shoujo"
41
END
42
43
# .desktop
44
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" << END
45
[Desktop Entry]
46
Name=Katawa Shoujo
47
Comment=$pkgdesc
48
Exec=$_pkgname
49
Icon=$_pkgname
50
Type=Application
51
Categories=Game;
52
END
53
54
# icon
55
install -Dm644 "$srcdir/$_pkgname.png" -t "$pkgdir/usr/share/pixmaps/"
56
57
# license
58
install -Dm644 "$_pkgsrc/LICENSE.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
59
60
# manual
61
install -Dm644 "$_pkgsrc/Game Manual.pdf" "$pkgdir/usr/share/doc/$pkgname/gamemanual.pdf"
62
63
# permissions
64
chmod -R u+rwX,go+rX,go-w "$pkgdir/"
65
}
66
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |