lib32-romcheckfail-bin

MEDIUM

maintainer zulc22 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a shell script from web.archive.org (an archived copy of the original vendor host games.lastchancemedia.com/farbs/) and executes it with 'sh RomCheckFail.sh --noexec --target ...' to extract a nixstaller self-extracting archive. The sha256sum is pinned, which mitigates tampering with the archived copy itself. However, the concern is real: (1) the source is a web.archive.org snapshot rather than the original vendor host, meaning the original is unavailable and provenance relies entirely on the Wayback Machine's integrity; (2) the payload is a self-extracting installer script that bundles and installs prebuilt 32-bit binaries — these binaries are not independently verified beyond the outer script's checksum; (3) the inner 'instarchive_all' contents are not checksummed separately. This is a classic medium supply-chain risk: executed prebuilt binaries from a non-primary host with only partial integrity verification. Not clearly malicious, but the pattern of running an archived installer script to extract unverified binaries warrants medium severity.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "RomCheckFail.sh::https://web.archive.org/web/20210128143934if_/https://games.lastchancemedia.com/farbs/RomCheckFail.sh"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a shell script from web.archive.org (an archived copy of the original vendor host games.lastchancemedia.com/farbs/) and executes it with 'sh RomCheckFail.sh --noexec --target ...' to extract a nixstaller self-extracting archive. The sha256sum is pinned, which mitigates tampering with the archived copy itself. However, the concern is real: (1) the source is a web.archive.org snapshot rather than the original vendor host, meaning the original is unavailable and provenance relies entirely on the Wayback Machine's integrity; (2) the payload is a self-extracting installer script that bundles and installs prebuilt 32-bit binaries — these binaries are not independently verified beyond the outer script's checksum; (3) the inner 'instarchive_all' contents are not checksummed separately. This is a classic medium supply-chain risk: executed prebuilt binaries from a non-primary host with only partial integrity verification. Not clearly malicious, but the pattern of running an archived installer script to extract unverified binaries warrants medium severity.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=lib32-romcheckfail-bin
    
      2provides=('romcheckfail')
    
      3arch=('x86_64')
    
      4pkgdesc='A swirling glitch-soup of classic videogames, reforming every 10 seconds into a new playable mass. Won the TIGSource VGNG competition and some very nice press.'
    
      5pkgver=1.0
    
      6pkgrel=3
    
      7license=('custom:romcheckfail_eula')
    
      8depends=('lib32-sdl_mixer' 'lib32-sdl=1.2.15' 'lib32-libogg' 'lib32-libvorbis')
    
      9optdepends=('lib32-libpulse: PulseAudio output from game')
    
      10makedepends=('libarchive')
    
      11source=(
    
      12    "RomCheckFail.sh::https://web.archive.org/web/20210128143934if_/https://games.lastchancemedia.com/farbs/RomCheckFail.sh"
    
      13    "RomCheckFail.desktop"
    
      14)
    
      15sha256sums=('ae2b94bde8941728cc670890ccfc6dc2fd6ee6b41a9e05fffb0dd6eec5b09e85' 'SKIP')
    
      16options=(!debug !strip)
    
      17
    
      18build() {
    
      19    cd "$srcdir"
    
      20    echo "-- Extracting nixstaller data:"
    
      21    sh RomCheckFail.sh --noexec --target RomCheckFail_installer
    
      22    mkdir -p binaries
    
      23    echo "-- Extracting instarchive..."
    
      24    bsdtar xf RomCheckFail_installer/instarchive_all -C binaries
    
      25    cd "$srcdir/binaries/RomCheckFail"
    
      26    echo "-- Removing unneeded libraries so that system versions are used"
    
      27    rm lib/lib{vorbisfile,vorbis,SDL-1.2,ogg}.so*
    
      28}
    
      29
    
      30package() {
    
      31    mkdir -p "$pkgdir/opt/romcheckfail"
    
      32    cp -r "$srcdir/binaries/RomCheckFail/." "$pkgdir/opt/romcheckfail/"
    
      33    install -Dm644 "$srcdir/binaries/RomCheckFail/license" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      34    install -Dm644 "$srcdir/binaries/RomCheckFail/bin/Farbs.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/RomCheckFail.png"
    
      35    install -Dm644 "$srcdir/RomCheckFail.desktop" "$pkgdir/usr/share/applications/RomCheckFail.desktop"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2