kolossus-launcher

MEDIUM

maintainer skid9000 5 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt executable archive from a non-standard, untrusted CDN (b-cdn.net) with a SKIP'd checksum, posing a supply-chain risk if the host is compromised or swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=(https://ifscl.b-cdn.net/kolossus/Kolossus_${pkgver}_Linux.zip Kolossus-Launcher.desktop install.sh kolossus-launcher.install)

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt executable archive from a non-standard, untrusted CDN (b-cdn.net) with a SKIP'd checksum, posing a supply-chain risk if the host is compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jarod G. <skid+aur@gamindustri.fr>
    
      2# Contributor: leonekmi <me+git@leonekmi.fr>
    
      3pkgname=kolossus-launcher
    
      4pkgver="200_8"
    
      5pkgrel=2
    
      6pkgdesc="Kolossus Launcher, to download the latest version of the IFSCL."
    
      7arch=(x86_64)
    
      8url="https://en.codelyoko.fr/ifscl/"
    
      9license=('custom')
    
      10groups=()
    
      11provides=()
    
      12depends=('bash')
    
      13optdepends=()
    
      14makedepends=('zip' 'unzip')
    
      15conflicts=()
    
      16replaces=()
    
      17backup=()
    
      18install="kolossus-launcher.install"
    
      19source=(https://ifscl.b-cdn.net/kolossus/Kolossus_${pkgver}_Linux.zip Kolossus-Launcher.desktop install.sh kolossus-launcher.install)
    
      20noextract=(Kolossus_${pkgver}_Linux.zip)
    
      21md5sums=('d5a8fb999105b008aa8572792697c18e'
    
      22         '51d205515237b6d61ed7ed3379ed6d5f'
    
      23         '07976c32fd38c38b1221580ba59c37ee'
    
      24         '6cbd8a292f3700ffe4a1150d607542cc')
    
      25 
    
      26prepare() {
    
      27	mkdir -p "$pkgname-$pkgver"
    
      28	cd "$pkgname-$pkgver"
    
      29	unzip "$srcdir/Kolossus_${pkgver}_Linux.zip"
    
      30}
    
      31
    
      32package() {
    
      33	mkdir -p "$pkgdir/opt" "$pkgdir/usr/share/applications"
    
      34	find "$pkgname-$pkgver"/* -type f -exec install -Dm 755 "{}" "$pkgdir/opt/Kolossus-Launcher/{}" \;
    
      35	mv "$pkgdir/opt/Kolossus-Launcher/$pkgname-$pkgver"/* "$pkgdir/opt/Kolossus-Launcher/"
    
      36	echo $pkgver > "$pkgdir/opt/Kolossus-Launcher/version.txt"
    
      37	rm -r "$pkgdir/opt/Kolossus-Launcher/$pkgname-$pkgver"
    
      38	install -m755 "$srcdir/install.sh" "$pkgdir/opt/Kolossus-Launcher"
    
      39	install "$srcdir/Kolossus-Launcher.desktop" "$pkgdir/usr/share/applications/"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-10-15 00:28
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 # Contributor: leonekmi <me+git@leonekmi.fr>
 pkgname=kolossus-launcher
 pkgver="200_8"
-pkgrel=1
+pkgrel=2
 pkgdesc="Kolossus Launcher, to download the latest version of the IFSCL."
 arch=(x86_64)
 url="https://en.codelyoko.fr/ifscl/"
@@ -20,7 +20,7 @@
 noextract=(Kolossus_${pkgver}_Linux.zip)
 md5sums=('d5a8fb999105b008aa8572792697c18e'
          '51d205515237b6d61ed7ed3379ed6d5f'
-         '9f1a0529669e271c87ce19325fcdb893'
+         '07976c32fd38c38b1221580ba59c37ee'
          '6cbd8a292f3700ffe4a1150d607542cc')
  
 prepare() {
@@ -33,6 +33,7 @@
 	mkdir -p "$pkgdir/opt" "$pkgdir/usr/share/applications"
 	find "$pkgname-$pkgver"/* -type f -exec install -Dm 755 "{}" "$pkgdir/opt/Kolossus-Launcher/{}" \;
 	mv "$pkgdir/opt/Kolossus-Launcher/$pkgname-$pkgver"/* "$pkgdir/opt/Kolossus-Launcher/"
+	echo $pkgver > "$pkgdir/opt/Kolossus-Launcher/version.txt"
 	rm -r "$pkgdir/opt/Kolossus-Launcher/$pkgname-$pkgver"
 	install -m755 "$srcdir/install.sh" "$pkgdir/opt/Kolossus-Launcher"
 	install "$srcdir/Kolossus-Launcher.desktop" "$pkgdir/usr/share/applications/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 19:13:05	Medium	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2