key-gunner

LOW

maintainer Pietagorh 0 votes scanned 2026-10-23 15:41:01.488442

View on AUR

Why flagged

The 'hib://' source is a deliberate manual-download mechanism for a commercial game binary (from itch.io) that cannot be auto-fetched; the DLAGENT explicitly exits with an error instructing the user to supply the file themselves, so no unreviewed remote code is silently downloaded. The icon is fetched from itch.io's CDN (pure image data), and all other sources are local bundled files with checksums. The main concern is an unverifiable prebuilt Windows executable run under Wine, but it comes from the project's own itch.io page and requires explicit user action to obtain.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The 'hib://' source is a deliberate manual-download mechanism for a commercial game binary (from itch.io) that cannot be auto-fetched; the DLAGENT explicitly exits with an error instructing the user to supply the file themselves, so no unreviewed remote code is silently downloaded. The icon is fetched from itch.io's CDN (pure image data), and all other sources are local bundled files with checksums. The main concern is an unverifiable prebuilt Windows executable run under Wine, but it comes from the project's own itch.io page and requires explicit user action to obtain.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 key-gunner_iconsrc.png::'https://img.itch.zone/aW1nLzE5NDI4MDIyLnBuZw==/original/tlzD7z.png'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Pietagorh <pietagorhh at proton dot me>
    
      2pkgname=key-gunner
    
      3pkgver=1.3.1
    
      4pkgrel=1
    
      5pkgdesc="A game where you defeat waves of enemies by typing"
    
      6arch=('x86_64')
    
      7url='https://zad-man.itch.io/key-gunner'
    
      8license=('custom:commercial')
    
      9depends=('wine')
    
      10source=(
    
      11	"hib://KeyGunnerPortable${pkgver}.zip"
    
      12	launch-script.sh
    
      13	key-gunner.desktop
    
      14	key-gunner_iconsrc.png::'https://img.itch.zone/aW1nLzE5NDI4MDIyLnBuZw==/original/tlzD7z.png'
    
      15)
    
      16sha256sums=(
    
      17	'1ff9ceee6afa689d9b23ad6c31edd80831c5cb50292e5b2ee1d2421c3cfe080c'
    
      18	'ce80193e3b750688d83c6e663bcef441de1c529fea44834622172a4ab8e23beb'
    
      19	'65403ef470ce1b292aa19cef49daacf80bbdfd88609319baad5a49ea8d7ee3c8'
    
      20	'21b2763c4daee08cc6548fb3ca418bfe0c56b4b923a78a6c19692122e2cef5c4'
    
      21)
    
      22noextract=("KeyGunnerPortable${pkgver}.zip")
    
      23DLAGENTS+=('hib::/usr/bin/echo "Could not find %u. Manually download it to \"$(pwd)\", or set up a hib:// DLAGENT in /etc/makepkg.conf."; exit 1')
    
      24
    
      25prepare() {
    
      26	mkdir -p key-gunner
    
      27	bsdtar -C key-gunner -xf "KeyGunnerPortable${pkgver}.zip"
    
      28
    
      29	magick key-gunner_iconsrc.png -background transparent -gravity center -extent 1660x1660 key-gunner_square.png
    
      30	for _size in 16 24 32 48 64 96 128 256; do
    
      31		magick key-gunner_square.png -resize "${_size}x${_size}" "key-gunner_x${_size}.png"
    
      32	done
    
      33}
    
      34
    
      35package() {
    
      36	for _size in 16 24 32 48 64 96 128 256; do
    
      37		_destdir="${pkgdir}/usr/share/icons/hicolor/${_size}x${_size}/apps"
    
      38		install -d -m755 "${_destdir}"
    
      39		install -Dm644 "key-gunner_x${_size}.png" "${_destdir}/${pkgname}.png"
    
      40	done
    
      41
    
      42	_destdir="${pkgdir}/usr/share/${pkgname}"
    
      43	install -d -m755 "${_destdir}"
    
      44	find key-gunner -type f -exec \
    
      45		install -Dm644 {} "${_destdir}" \;
    
      46
    
      47	_destdir="${pkgdir}/usr/bin"
    
      48	install -d -m755 "${_destdir}"
    
      49	install -Dm755 launch-script.sh "${_destdir}/${pkgname}"
    
      50
    
      51	_destdir="${pkgdir}/usr/share/applications"
    
      52	install -d -m755 "${_destdir}"
    
      53	install -Dm755 key-gunner.desktop "${_destdir}/${pkgname}.desktop"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 15:41:01	Low	3
2026-10-23 15:37:50	Medium	2