leigod-steamdeck-plugin

MEDIUM

maintainer suiyuan 0 votes scanned 2026-09-06 07:10:31.945140

View on AUR

Why flagged

Downloads closed-source binaries over HTTP (despite pinned checksums) which, if tampered with, could lead to privilege escalation via root-level network modifications; the binaries are not built from source and run with elevated privileges, creating a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): Downloads closed-source binaries over HTTP (despite pinned checksums) which, if tampered with, could lead to privilege escalation via root-level network modifications; the binaries are not built from source and run with elevated privileges, creating a supply-chain risk.

PKGBUILD

      1# Maintainer: suiyuan <adesince@163.com>
    
      2#
    
      3# 雷神加速器 (Leigod) 官方 SteamDeck 插件在普通 x86_64 Linux 上的移植:
    
      4# 将闭源官方二进制置于 bwrap 伪造的 SteamDeck 文件系统/进程视图中运行,
    
      5# 网络与主机共享(非隔离), 插件会以 root 修改主机路由表与 iptables 规则,
    
      6# 这是设计上的预期行为, 不是缺陷。
    
      7#
    
      8# 风险: 构建期经明文 HTTP(默认 http://119.3.40.126)下载官方文件, 以 pinned
    
      9#       sha256 校验; 二进制闭源, 运行期访问雷神云端接口并上报流量统计。
    
      10# 版权: acc-gw.router.amd64 与 ipdatacloud_country.xdb 版权归雷神(Leigod)所有,
    
      11#       本包仅分发部署脚本, 不再分发二进制。
    
      12
    
      13pkgname=leigod-steamdeck-plugin
    
      14pkgver=1.2.2.15
    
      15pkgrel=1
    
      16pkgdesc="Leigod accelerator SteamDeck plugin on generic Linux via bwrap SteamDeck emulation"
    
      17arch=('x86_64')
    
      18url="https://www.leigod.com"
    
      19license=('custom:proprietary')
    
      20depends=('bubblewrap' 'curl' 'iproute2' 'iptables-nft' 'ipset' 'sslh')
    
      21install='leigod-plugin.install'
    
      22options=('!strip' '!debug')
    
      23backup=('etc/leigod/bwrap.conf' 'etc/leigod/sslh-guard.cfg' 'etc/leigod/device.conf')
    
      24
    
      25# 官方文件下载源(构建期) —— 双通道可配, 环境变量优先于配置文件, 均缺省用官方 IP:
    
      26#   1) 环境变量: LEIGOD_MIRROR=http://<镜像>/ makepkg
    
      27#   2) 配置文件: /etc/leigod/mirror.conf(第一行写镜像 URL, 见 mirror.conf.example)
    
      28# 更换镜像后必须同步更新 sha256sums 的前 3 项(远程文件); 本地文件哈希与镜像无关。
    
      29# 注: makepkg 的本地源文件必须平铺在本目录(解析时按 basename 查找), 故不做子目录分类。
    
      30_mirror="${LEIGOD_MIRROR:-}"
    
      31if [ -z "$_mirror" ] && [ -r /etc/leigod/mirror.conf ]; then
    
      32    _mirror=$(head -n1 /etc/leigod/mirror.conf 2>/dev/null | tr -d '[:space:]')
    
      33fi
    
      34_base="${_mirror:-http://119.3.40.126}"
    
      35
    
      36source=(
    
      37    "$_base/acc-gw.router.amd64"
    
      38    "$_base/ipdatacloud_country.xdb"
    
      39    "$_base/steamdeck_acc_monitor.sh"
    
      40    'bwrap.conf'
    
      41    'leigod.service'
    
      42    'accelerator.ini'
    
      43    'acc_version.ini'
    
      44    'fake_product_name'
    
      45    'fake_os_release'
    
      46    'fake_version'
    
      47    'ensure-wlan0.sh'
    
      48    'run.sh'
    
      49    'sslh-guard.cfg'
    
      50    'device.conf'
    
      51    'mirror.conf.example'
    
      52)
    
      53sha256sums=(
    
      54    '8e0adbd1b1ce0d37e6588ff222408fed66a3f8954fee27bc37a10e0bf6806d4d'
    
      55    '3536000ee9eb3997538cb37a14f90d571979734c48b23b8d548eceac16666273'
    
      56    '5b0b4948d870adc608c0a674ec4997dc1db650fe65e36548744bcfa63336440e'
    
      57    'a23979f4e5a33c7c5a3826d1257e739b54ae89f282d0897829d5ac609acd2789'
    
      58    'ecc1142fcab87a6f8b1470d25b158ee0a02d9ccad1a4832ccf80e57c795288c7'
    
      59    '417a0a88af9989770a351da4727fe7df5b1265e4cc8c3a5ba2b4ab35750783d4'
    
      60    '3cab558f1791dd2b347bccd81e619c97664d2a4bfe79a72c34938676a5168c4d'
    
      61    'ee5b87871d52e6f5852c09b59110183346579a47a474c57a6a67fb55210d8580'
    
      62    'd20c01fa15205e8e2f8f2d937d87871d367ecb62423de141d07daed2ea3b9a9c'
    
      63    'fe9de708249b35ffe1c4f97dbede7278d5ded8c64ff512e82d024c6228aaa9ee'
    
      64    '2021df0d9b12323915633e3a72f0cd2a8ec55f9f81892f82eb11ad261d5d490d'
    
      65    '4abdfb02e5191ddcb7791f4f6e6ea2c8b0e6bfb3ca874339714b7cf6268a9d08'
    
      66    '26426ed86918ab11635f1ad15c19f3514661c74b1c73dcd9196e768162514f63'
    
      67    'f6f224c4b5a45154ccf900bd18250013ae55c7f58bddb66f72c42f51b49ee4c0'
    
      68    '32e08c7e86519b470c1e7043a4ba613136534faae8b19937d0376046f7543105'
    
      69)
    
      70
    
      71prepare() {
    
      72    # 将 web 进程监听端口后移到 5589: 5588 让给 sslh 门前过滤(run.sh 内拉起)。
    
      73    # 背景: 官方 web 进程基于 WebSocket++ 0.8.2, 收到未升级握手的普通 HTTP 会
    
      74    # SIGABRT 崩溃, 详见 https://github.com/Husky0c/leigod-plugin-linux/issues/5
    
      75    sed -i 's/-p 5588/-p 5589/g' "$srcdir/steamdeck_acc_monitor.sh"
    
      76    grep -q -- '-p 5589' "$srcdir/steamdeck_acc_monitor.sh" || {
    
      77        echo 'error: patch steamdeck_acc_monitor.sh (-p 5589) failed' >&2
    
      78        return 1
    
      79    }
    
      80}
    
      81
    
      82package() {
    
      83    # 主程序与升级监视器(官方为同一文件的两份拷贝)
    
      84    install -Dm755 "$srcdir/acc-gw.router.amd64" "$pkgdir/opt/leigod/acc-gw.router.amd64"
    
      85    install -Dm755 "$srcdir/acc-gw.router.amd64" "$pkgdir/opt/leigod/acc_upgrade_monitor"
    
      86
    
      87    # IP 地理库与配置(路径对齐官方 install_binary 的 steamdeck 分支: config/ 子目录)
    
      88    install -Dm644 "$srcdir/ipdatacloud_country.xdb" "$pkgdir/opt/leigod/config/ipdatacloud_country.xdb"
    
      89    install -Dm644 "$srcdir/accelerator.ini" "$pkgdir/opt/leigod/config/accelerator.ini"
    
      90    install -Dm644 "$srcdir/acc_version.ini" "$pkgdir/opt/leigod/config/acc_version.ini"
    
      91
    
      92    # 官方进程守护脚本(prepare() 已补丁端口)
    
      93    install -Dm755 "$srcdir/steamdeck_acc_monitor.sh" "$pkgdir/opt/leigod/steamdeck_acc_monitor.sh"
    
      94
    
      95    # SteamDeck 伪装文件(DMI product_name=Jupiter / os-release=SteamOS / /etc/version)
    
      96    install -Dm644 "$srcdir/fake_product_name" "$pkgdir/opt/leigod/fake_product_name"
    
      97    install -Dm644 "$srcdir/fake_os_release" "$pkgdir/opt/leigod/fake_os_release"
    
      98    install -Dm644 "$srcdir/fake_version" "$pkgdir/opt/leigod/fake_version"
    
      99
    
      100    # 用户可编辑配置(pacman 升级保留, 见 backup=)
    
      101    install -Dm644 "$srcdir/bwrap.conf" "$pkgdir/etc/leigod/bwrap.conf"
    
      102    install -Dm644 "$srcdir/sslh-guard.cfg" "$pkgdir/etc/leigod/sslh-guard.cfg"
    
      103    install -Dm644 "$srcdir/device.conf" "$pkgdir/etc/leigod/device.conf"
    
      104
    
      105    # 辅助脚本与 systemd 单元
    
      106    install -Dm755 "$srcdir/ensure-wlan0.sh" "$pkgdir/usr/lib/leigod/ensure-wlan0.sh"
    
      107    install -Dm755 "$srcdir/run.sh" "$pkgdir/usr/lib/leigod/run.sh"
    
      108    install -Dm644 "$srcdir/leigod.service" "$pkgdir/usr/lib/systemd/system/leigod.service"
    
      109    install -Dm644 "$srcdir/mirror.conf.example" "$pkgdir/usr/share/leigod/mirror.conf.example"
    
      110
    
      111    # 说明: 官方安装脚本(plugin_install.sh/plugin_common.sh)在共享网络下会重置
    
      112    # 系统行为, 本包刻意不携带、不执行; 配置由上述文件直接布放, 运行只调用官方守护脚本。
    
      113}
    
      114

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 07:10:31	Medium	2