legacy-launcher-bootstrap

maintainer nexul · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Downloads a prebuilt JAR from llaun.ch (the official Legacy Launcher domain) with a pinned sha256sum and a validity check; the jar is installed as data and executed only via a wrapper script, so this is effectively an official-source binary package with no obfuscation or exfiltration, though the non-whitelisted host and few votes warrant mild caution.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt JAR from llaun.ch (the official Legacy Launcher domain) with a pinned sha256sum and a validity check; the jar is installed as data and executed only via a wrapper script, so this is effectively an official-source binary package with no obfuscation or exfiltration, though the non-whitelisted host and few votes warrant mild caution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "LegacyLauncher.jar::https://llaun.ch/jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arif Sardar <arifsardar.private@gmail.com>
    
      2pkgname=legacy-launcher-bootstrap
    
      3pkgver=1.40.3
    
      4pkgrel=2
    
      5pkgdesc="Unofficial Legacy Launcher for Minecraft, fetching the official jar at build time"
    
      6arch=('any')
    
      7url="https://llaun.ch/"
    
      8# Not 'MIT': the bundled LICENSE covers only the packaging. The jar ships no
    
      9# license text and upstream publishes terms only on the website, so there is no
    
      10# SPDX-listed identifier that fits.
    
      11license=('LicenseRef-LegacyLauncher')
    
      12# hicolor-icon-theme owns the icon hierarchy this package installs into.
    
      13depends=('java-runtime>=17' 'hicolor-icon-theme')
    
      14# Icons must stay flat and listed here. makepkg reduces local sources to their
    
      15# basename, so an icons/foo.svg path resolves to ./foo.svg and fails -- and
    
      16# reaching outside srcdir instead would drop them from `makepkg -S` tarballs,
    
      17# breaking every build from the AUR snapshot.
    
      18source=(
    
      19    "LegacyLauncher.jar::https://llaun.ch/jar"
    
      20    "LICENSE"
    
      21    "legacy-launcher.svg"
    
      22    "legacy-launcher_256.png"
    
      23    "legacy-launcher_512.png"
    
      24    "minecraft.svg"
    
      25    "minecraft_256.png"
    
      26    "minecraft_512.png"
    
      27)
    
      28# The jar is a zip; without this makepkg explodes it into $srcdir.
    
      29noextract=('LegacyLauncher.jar')
    
      30# Never SKIP the jar's sum, and regenerate local sums by hand rather than with
    
      31# updpkgsums: the endpoint sits behind Cloudflare, and either shortcut can bake
    
      32# a challenge page into the package.
    
      33sha256sums=('09ba7517c8a9b30780ff9a6de230b8905247835ae0da914d66991e2b3b4b6c4e'
    
      34            '476a68d242896eb7a51ec8bb3d3fadfa93474f3b89b5a0ba40599e66b27955a8'
    
      35            'bfe4f259f20bc4626c7619e7d72ec1940e631ff0872258064a1d55e6413f73d2'
    
      36            '4d960d32736f6173fc8254b922ebf673e8a2dd2c6dfc963864a3d70b24db8a6b'
    
      37            'fd602599d1910358866bcc501118adfd13bcd89bd1a63e23953e68d153160370'
    
      38            'ece5c3bb77bfadd043591c01b3504fb9c04daa951d93322a321e15036095d6a3'
    
      39            '94aa904c39037d5cd0852a108fd9995ca422bba745903d9b1f490fb4e2ad4fc8'
    
      40            'd234769b937fa3725a51ccbf0b1a6c8405b571fe2b88f77f086daaa2bedef466')
    
      41
    
      42prepare() {
    
      43    # Catches a Cloudflare challenge page reaching this far, e.g. if a maintainer
    
      44    # temporarily sets sha256sums to SKIP while bumping versions.
    
      45    bsdtar -tf LegacyLauncher.jar >/dev/null 2>&1 \
    
      46        || { echo "ERROR: LegacyLauncher.jar is not a valid archive" >&2; return 1; }
    
      47}
    
      48
    
      49package() {
    
      50    install -Dm644 LegacyLauncher.jar \
    
      51        "$pkgdir/opt/legacy-launcher/LegacyLauncher.jar"
    
      52
    
      53    install -Dm644 LICENSE \
    
      54        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      55
    
      56    install -Dm755 /dev/stdin \
    
      57        "$pkgdir/usr/bin/legacy-launcher" <<'EOF'
    
      58#!/bin/sh
    
      59set -eu
    
      60exec java -jar /opt/legacy-launcher/LegacyLauncher.jar "$@"
    
      61EOF
    
      62
    
      63    install -Dm644 /dev/stdin \
    
      64        "$pkgdir/usr/share/applications/legacy-launcher.desktop" <<'EOF'
    
      65[Desktop Entry]
    
      66Version=1.0
    
      67Type=Application
    
      68Name=Legacy Launcher
    
      69GenericName=Minecraft Launcher
    
      70Comment=Launch and manage Minecraft
    
      71Exec=legacy-launcher %U
    
      72Icon=legacy-launcher
    
      73Terminal=false
    
      74Categories=Game;
    
      75Keywords=minecraft;
    
      76StartupNotify=true
    
      77StartupWMClass=org-springframework-boot-loader-PropertiesLauncher
    
      78EOF
    
      79
    
      80    # The game runs in its own JVM and its window is created by GLFW, which sets
    
      81    # WM_CLASS to "Minecraft*" independently of anything the launcher does.
    
      82    # StartupWMClass holds a single value, so the game needs its own entry.
    
      83    # NoDisplay keeps it out of menus -- it exists only to give shells an
    
      84    # app_id -> icon mapping for the game window.
    
      85    install -Dm644 /dev/stdin \
    
      86        "$pkgdir/usr/share/applications/legacy-launcher-minecraft.desktop" <<'EOF'
    
      87[Desktop Entry]
    
      88Version=1.0
    
      89Type=Application
    
      90Name=Minecraft
    
      91Comment=Minecraft game window
    
      92Exec=legacy-launcher
    
      93Icon=legacy-launcher-minecraft
    
      94Terminal=false
    
      95NoDisplay=true
    
      96Categories=Game;
    
      97StartupWMClass=Minecraft*
    
      98EOF
    
      99
    
      100    install -Dm644 "$srcdir/legacy-launcher.svg" \
    
      101        "$pkgdir/usr/share/icons/hicolor/scalable/apps/legacy-launcher.svg"
    
      102
    
      103    install -Dm644 "$srcdir/legacy-launcher_256.png" \
    
      104        "$pkgdir/usr/share/icons/hicolor/256x256/apps/legacy-launcher.png"
    
      105
    
      106    install -Dm644 "$srcdir/legacy-launcher_512.png" \
    
      107        "$pkgdir/usr/share/icons/hicolor/512x512/apps/legacy-launcher.png"
    
      108
    
      109    # The jar re-execs itself as a second JVM whose main class is Spring Boot's
    
      110    # PropertiesLauncher, and AWT derives WM_CLASS from the bottom stack frame,
    
      111    # so the window reports org-springframework-boot-loader-PropertiesLauncher.
    
      112    # StartupWMClass above covers shells that match on it (GNOME); KDE, XFCE and
    
      113    # Cinnamon instead fall back to an icon-theme lookup keyed on WM_CLASS.
    
      114    install -Dm644 "$srcdir/legacy-launcher_256.png" \
    
      115        "$pkgdir/usr/share/icons/hicolor/256x256/apps/org-springframework-boot-loader-PropertiesLauncher.png"
    
      116
    
      117    install -Dm644 "$srcdir/legacy-launcher_512.png" \
    
      118        "$pkgdir/usr/share/icons/hicolor/512x512/apps/org-springframework-boot-loader-PropertiesLauncher.png"
    
      119
    
      120    # Namespaced under legacy-launcher- so they cannot collide with a plain
    
      121    # minecraft.png from another package in the shared hicolor theme.
    
      122    install -Dm644 "$srcdir/minecraft.svg" \
    
      123        "$pkgdir/usr/share/icons/hicolor/scalable/apps/legacy-launcher-minecraft.svg"
    
      124
    
      125    install -Dm644 "$srcdir/minecraft_256.png" \
    
      126        "$pkgdir/usr/share/icons/hicolor/256x256/apps/legacy-launcher-minecraft.png"
    
      127
    
      128    install -Dm644 "$srcdir/minecraft_512.png" \
    
      129        "$pkgdir/usr/share/icons/hicolor/512x512/apps/legacy-launcher-minecraft.png"
    
      130
    
      131    # Same fallback for the game window's WM_CLASS. The literal asterisk is part
    
      132    # of the class GLFW reports, so it is part of the filename too.
    
      133    install -Dm644 "$srcdir/minecraft_256.png" \
    
      134        "$pkgdir/usr/share/icons/hicolor/256x256/apps/Minecraft*.png"
    
      135
    
      136    install -Dm644 "$srcdir/minecraft_512.png" \
    
      137        "$pkgdir/usr/share/icons/hicolor/512x512/apps/Minecraft*.png"
    
      138}
    
      139

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 13:18:46	LOW	3
2026-07-21 13:17:02	MEDIUM	2