legacy-launcher

maintainer corecathx · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt JAR binary from dl.llaun.ch/legacy/bootstrap (a rolling/latest URL with no version pinning) and installs it as executed code. All checksums are SKIP'd, meaning there is no integrity verification whatsoever. While dl.llaun.ch appears to be the official distribution host for Legacy Launcher (a known Minecraft launcher), the combination of: (1) a versionless 'latest' URL that always fetches whatever the server currently serves, (2) SKIP on all checksums including the JAR, and (3) a prebuilt binary JAR being installed and executed — constitutes a genuine supply-chain risk. If the host is compromised or the maintainer changes the served binary, users will silently receive and execute arbitrary Java bytecode. This is a real medium-severity concern, not a false positive, though it is not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("LegacyLauncher_legacy.jar::https://dl.llaun.ch/legacy/bootstrap"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt JAR binary from dl.llaun.ch/legacy/bootstrap (a rolling/latest URL with no version pinning) and installs it as executed code. All checksums are SKIP'd, meaning there is no integrity verification whatsoever. While dl.llaun.ch appears to be the official distribution host for Legacy Launcher (a known Minecraft launcher), the combination of: (1) a versionless 'latest' URL that always fetches whatever the server currently serves, (2) SKIP on all checksums including the JAR, and (3) a prebuilt binary JAR being installed and executed — constitutes a genuine supply-chain risk. If the host is compromised or the maintainer changes the served binary, users will silently receive and execute arbitrary Java bytecode. This is a real medium-severity concern, not a false positive, though it is not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: corecathx <corecathx@proton.me>
    
      2pkgname=legacy-launcher
    
      3pkgver=latest
    
      4pkgrel=1
    
      5pkgdesc="Stable, fast and simple Minecraft Launcher."
    
      6arch=('any')
    
      7url="https://llaun.ch"
    
      8license=('Other')
    
      9depends=('java-runtime')
    
      10source=("LegacyLauncher_legacy.jar::https://dl.llaun.ch/legacy/bootstrap"
    
      11        "legacy-launcher"
    
      12        "legacy-launcher.desktop"
    
      13        "legacy-launcher.png")
    
      14sha256sums=('SKIP'
    
      15            'SKIP'
    
      16            'SKIP'
    
      17            'SKIP')
    
      18
    
      19package() {
    
      20    cd "${srcdir}/"
    
      21    install -Dm755 "${srcdir}/legacy-launcher" "${pkgdir}/usr/bin/legacy-launcher"
    
      22    install -Dm644 "${srcdir}/legacy-launcher.desktop" "${pkgdir}/usr/share/applications/legacy-launcher.desktop"
    
      23    install -Dm644 "${srcdir}/LegacyLauncher_legacy.jar" "${pkgdir}/usr/share/legacy-launcher/LegacyLauncher_legacy.jar"
    
      24    install -Dm644 "${srcdir}/legacy-launcher.png" "${pkgdir}/usr/share/pixmaps/legacy-launcher.png"
    
      25}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2