legacy-launcher-bootstrap
LOW
maintainer nexul
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
Downloads a prebuilt JAR from llaun.ch (the official Legacy Launcher domain) with a pinned sha256sum and a validity check; the jar is installed as data and executed only via a wrapper script, so this is effectively an official-source binary package with no obfuscation or exfiltration, though the non-whitelisted host and few votes warrant mild caution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt JAR from llaun.ch (the official Legacy Launcher domain) with a pinned sha256sum and a validity check; the jar is installed as data and executed only via a wrapper script, so this is effectively an official-source binary package with no obfuscation or exfiltration, though the non-whitelisted host and few votes warrant mild caution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
"LegacyLauncher.jar::https://llaun.ch/jar"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Arif Sardar <arifsardar.private@gmail.com>
2
pkgname=legacy-launcher-bootstrap
3
pkgver=1.40.3
4
pkgrel=2
5
pkgdesc="Unofficial Legacy Launcher for Minecraft, fetching the official jar at build time"
6
arch=('any')
7
url="https://llaun.ch/"
8
# Not 'MIT': the bundled LICENSE covers only the packaging. The jar ships no
9
# license text and upstream publishes terms only on the website, so there is no
10
# SPDX-listed identifier that fits.
11
license=('LicenseRef-LegacyLauncher')
12
# hicolor-icon-theme owns the icon hierarchy this package installs into.
13
depends=('java-runtime>=17' 'hicolor-icon-theme')
14
# Icons must stay flat and listed here. makepkg reduces local sources to their
15
# basename, so an icons/foo.svg path resolves to ./foo.svg and fails -- and
16
# reaching outside srcdir instead would drop them from `makepkg -S` tarballs,
17
# breaking every build from the AUR snapshot.
18
source=(
19
"LegacyLauncher.jar::https://llaun.ch/jar"
20
"LICENSE"
21
"legacy-launcher.svg"
22
"legacy-launcher_256.png"
23
"legacy-launcher_512.png"
24
"minecraft.svg"
25
"minecraft_256.png"
26
"minecraft_512.png"
27
)
28
# The jar is a zip; without this makepkg explodes it into $srcdir.
29
noextract=('LegacyLauncher.jar')
30
# Never SKIP the jar's sum, and regenerate local sums by hand rather than with
31
# updpkgsums: the endpoint sits behind Cloudflare, and either shortcut can bake
32
# a challenge page into the package.
33
sha256sums=('09ba7517c8a9b30780ff9a6de230b8905247835ae0da914d66991e2b3b4b6c4e'
34
'476a68d242896eb7a51ec8bb3d3fadfa93474f3b89b5a0ba40599e66b27955a8'
35
'bfe4f259f20bc4626c7619e7d72ec1940e631ff0872258064a1d55e6413f73d2'
36
'4d960d32736f6173fc8254b922ebf673e8a2dd2c6dfc963864a3d70b24db8a6b'
37
'fd602599d1910358866bcc501118adfd13bcd89bd1a63e23953e68d153160370'
38
'ece5c3bb77bfadd043591c01b3504fb9c04daa951d93322a321e15036095d6a3'
39
'94aa904c39037d5cd0852a108fd9995ca422bba745903d9b1f490fb4e2ad4fc8'
40
'd234769b937fa3725a51ccbf0b1a6c8405b571fe2b88f77f086daaa2bedef466')
41
42
prepare() {
43
# Catches a Cloudflare challenge page reaching this far, e.g. if a maintainer
44
# temporarily sets sha256sums to SKIP while bumping versions.
45
bsdtar -tf LegacyLauncher.jar >/dev/null 2>&1 \
46
|| { echo "ERROR: LegacyLauncher.jar is not a valid archive" >&2; return 1; }
47
}
48
49
package() {
50
install -Dm644 LegacyLauncher.jar \
51
"$pkgdir/opt/legacy-launcher/LegacyLauncher.jar"
52
53
install -Dm644 LICENSE \
54
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
55
56
install -Dm755 /dev/stdin \
57
"$pkgdir/usr/bin/legacy-launcher" <<'EOF'
58
#!/bin/sh
59
set -eu
60
exec java -jar /opt/legacy-launcher/LegacyLauncher.jar "$@"
61
EOF
62
63
install -Dm644 /dev/stdin \
64
"$pkgdir/usr/share/applications/legacy-launcher.desktop" <<'EOF'
65
[Desktop Entry]
66
Version=1.0
67
Type=Application
68
Name=Legacy Launcher
69
GenericName=Minecraft Launcher
70
Comment=Launch and manage Minecraft
71
Exec=legacy-launcher %U
72
Icon=legacy-launcher
73
Terminal=false
74
Categories=Game;
75
Keywords=minecraft;
76
StartupNotify=true
77
StartupWMClass=org-springframework-boot-loader-PropertiesLauncher
78
EOF
79
80
# The game runs in its own JVM and its window is created by GLFW, which sets
81
# WM_CLASS to "Minecraft*" independently of anything the launcher does.
82
# StartupWMClass holds a single value, so the game needs its own entry.
83
# NoDisplay keeps it out of menus -- it exists only to give shells an
84
# app_id -> icon mapping for the game window.
85
install -Dm644 /dev/stdin \
86
"$pkgdir/usr/share/applications/legacy-launcher-minecraft.desktop" <<'EOF'
87
[Desktop Entry]
88
Version=1.0
89
Type=Application
90
Name=Minecraft
91
Comment=Minecraft game window
92
Exec=legacy-launcher
93
Icon=legacy-launcher-minecraft
94
Terminal=false
95
NoDisplay=true
96
Categories=Game;
97
StartupWMClass=Minecraft*
98
EOF
99
100
install -Dm644 "$srcdir/legacy-launcher.svg" \
101
"$pkgdir/usr/share/icons/hicolor/scalable/apps/legacy-launcher.svg"
102
103
install -Dm644 "$srcdir/legacy-launcher_256.png" \
104
"$pkgdir/usr/share/icons/hicolor/256x256/apps/legacy-launcher.png"
105
106
install -Dm644 "$srcdir/legacy-launcher_512.png" \
107
"$pkgdir/usr/share/icons/hicolor/512x512/apps/legacy-launcher.png"
108
109
# The jar re-execs itself as a second JVM whose main class is Spring Boot's
110
# PropertiesLauncher, and AWT derives WM_CLASS from the bottom stack frame,
111
# so the window reports org-springframework-boot-loader-PropertiesLauncher.
112
# StartupWMClass above covers shells that match on it (GNOME); KDE, XFCE and
113
# Cinnamon instead fall back to an icon-theme lookup keyed on WM_CLASS.
114
install -Dm644 "$srcdir/legacy-launcher_256.png" \
115
"$pkgdir/usr/share/icons/hicolor/256x256/apps/org-springframework-boot-loader-PropertiesLauncher.png"
116
117
install -Dm644 "$srcdir/legacy-launcher_512.png" \
118
"$pkgdir/usr/share/icons/hicolor/512x512/apps/org-springframework-boot-loader-PropertiesLauncher.png"
119
120
# Namespaced under legacy-launcher- so they cannot collide with a plain
121
# minecraft.png from another package in the shared hicolor theme.
122
install -Dm644 "$srcdir/minecraft.svg" \
123
"$pkgdir/usr/share/icons/hicolor/scalable/apps/legacy-launcher-minecraft.svg"
124
125
install -Dm644 "$srcdir/minecraft_256.png" \
126
"$pkgdir/usr/share/icons/hicolor/256x256/apps/legacy-launcher-minecraft.png"
127
128
install -Dm644 "$srcdir/minecraft_512.png" \
129
"$pkgdir/usr/share/icons/hicolor/512x512/apps/legacy-launcher-minecraft.png"
130
131
# Same fallback for the game window's WM_CLASS. The literal asterisk is part
132
# of the class GLFW reports, so it is part of the filename too.
133
install -Dm644 "$srcdir/minecraft_256.png" \
134
"$pkgdir/usr/share/icons/hicolor/256x256/apps/Minecraft*.png"
135
136
install -Dm644 "$srcdir/minecraft_512.png" \
137
"$pkgdir/usr/share/icons/hicolor/512x512/apps/Minecraft*.png"
138
}
139
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |