kega-fusion

maintainer trya · 98 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source archives hosted on a non-whitelisted but plausible project-affiliated server (slackware.uk) and includes a local icon and script; the emulator binary is built locally from source, so the worst case of a swapped source is limited to supply-chain risk in the build process, not remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from source archives hosted on a non-whitelisted but plausible project-affiliated server (slackware.uk) and includes a local icon and script; the emulator binary is built locally from source, so the worst case of a swapped source is limited to supply-chain risk in the build process, not remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://slackware.uk/slacky/slackware-13.0/games/kega-fusion/3.63x/src/Fusion363x.tar.gz"
PKGBUILD:19 "https://trya.alwaysdata.net/linux/icons/kega-fusion.png"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: trya <tryagainprod@gmail.com>
    
      2
    
      3pkgname=kega-fusion
    
      4pkgver=3.63
    
      5pkgrel=17
    
      6pkgdesc="An emulator of classic Sega consoles, including SMS/GG, Genesis/Megadrive and add-ons"
    
      7url="http://www.carpeludum.com/kega-fusion"
    
      8license=('custom')
    
      9arch=('i686' 'x86_64')
    
      10depends=('alsa-lib' 'glu' 'libsm' 'gtk2' 'mpg123')
    
      11optdepends=('gtk-engines: libclearlooks.so library')
    
      12makedepends=('upx')
    
      13depends_x86_64=('lib32-alsa-lib' 'lib32-glu' 'lib32-libsm' 'lib32-gtk2' 'lib32-mpg123')
    
      14optdepends_x86_64=('lib32-gtk-engines: libclearlooks.so library'
    
      15                   'lib32-alsa-plugins: for PulseAudio users')
    
      16install="kega-fusion.install"
    
      17source=("https://slackware.uk/slacky/slackware-13.0/games/kega-fusion/3.63x/src/Fusion363x.tar.gz"
    
      18        "https://slackware.uk/slacky/slackware-13.0/games/kega-fusion/3.63x/src/Plugins(Linux).tar.gz"
    
      19        "https://trya.alwaysdata.net/linux/icons/kega-fusion.png"
    
      20        kega-fusion.sh kega-fusion.desktop Fusion.ini)
    
      21sha256sums=('8f245ead905bfb389da286a6ed94d627ec73e669b0247cbc87b34020fc674693'
    
      22            '1283a359e1cd82b5f23a121eab218bab8bdeeb488f98c58794b15803371bc234'
    
      23            '13ce738c8e10f92735085f624651a7c983093c785b40f4c2e4c7aee6506fe10b'
    
      24            'fc96b04a2341aea9d8810175ae0a45a714307a0292917ddc716656c00567fed6'
    
      25            '6cf957f9cd0b9e1cf439e511a0c7114d3b309f800076bc5fd0d407682cde1c4b'
    
      26            '317ee62d71b7fb8b0f083eea4f96eaffbf37466d7e277784ae2b663bbecaac5b')
    
      27options=(!strip)
    
      28
    
      29package() {
    
      30  cd "$srcdir"
    
      31
    
      32  # plugins
    
      33  install -d "$pkgdir/usr/lib/kega-fusion/plugins"
    
      34  install -m644 Plugins/*.rpi "$pkgdir/usr/lib/kega-fusion/plugins"
    
      35  if [ "$CARCH" == "x86_64" ]; then
    
      36    ln -s /usr/lib32/libmpg123.so.0 "$pkgdir/usr/lib/kega-fusion"  
    
      37  else
    
      38    ln -s /usr/lib/libmpg123.so.0 "$pkgdir/usr/lib/kega-fusion" 
    
      39  fi
    
      40  
    
      41  # default configuration and documentation
    
      42  install -Dm644 Fusion.ini "$pkgdir/usr/share/kega-fusion/Fusion.ini"
    
      43  install -d "$pkgdir/usr/share/doc/kega-fusion"
    
      44  install -m644 Fusion/*.txt "$pkgdir/usr/share/doc/kega-fusion"
    
      45  
    
      46  # startup script and executable
    
      47  install -Dm755 kega-fusion.sh "$pkgdir/usr/bin/kega-fusion"
    
      48  upx -d "$srcdir/Fusion/Fusion"
    
      49  install -Dm755 Fusion/Fusion "$pkgdir/usr/lib/kega-fusion"
    
      50  
    
      51  # desktop icon
    
      52  install -Dm644 kega-fusion.desktop "$pkgdir/usr/share/applications/kega-fusion.desktop"
    
      53  install -Dm644 kega-fusion.png "$pkgdir/usr/share/pixmaps/kega-fusion.png"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2