lib32-romcheckfail-bin

maintainer zulc22 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a shell script from web.archive.org (an archived copy of the original vendor host games.lastchancemedia.com/farbs/) and executes it with 'sh RomCheckFail.sh --noexec --target ...' to extract a nixstaller self-extracting archive. The sha256sum is pinned, which mitigates tampering with the archived copy itself. However, the concern is real: (1) the source is a web.archive.org snapshot rather than the original vendor host, meaning the original is unavailable and provenance relies entirely on the Wayback Machine's integrity; (2) the payload is a self-extracting installer script that bundles and installs prebuilt 32-bit binaries — these binaries are not independently verified beyond the outer script's checksum; (3) the inner 'instarchive_all' contents are not checksummed separately. This is a classic medium supply-chain risk: executed prebuilt binaries from a non-primary host with only partial integrity verification. Not clearly malicious, but the pattern of running an archived installer script to extract unverified binaries warrants medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "RomCheckFail.sh::https://web.archive.org/web/20210128143934if_/https://games.lastchancemedia.com/farbs/RomCheckFail.sh"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a shell script from web.archive.org (an archived copy of the original vendor host games.lastchancemedia.com/farbs/) and executes it with 'sh RomCheckFail.sh --noexec --target ...' to extract a nixstaller self-extracting archive. The sha256sum is pinned, which mitigates tampering with the archived copy itself. However, the concern is real: (1) the source is a web.archive.org snapshot rather than the original vendor host, meaning the original is unavailable and provenance relies entirely on the Wayback Machine's integrity; (2) the payload is a self-extracting installer script that bundles and installs prebuilt 32-bit binaries — these binaries are not independently verified beyond the outer script's checksum; (3) the inner 'instarchive_all' contents are not checksummed separately. This is a classic medium supply-chain risk: executed prebuilt binaries from a non-primary host with only partial integrity verification. Not clearly malicious, but the pattern of running an archived installer script to extract unverified binaries warrants medium severity.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=lib32-romcheckfail-bin
    
      2provides=('romcheckfail')
    
      3arch=('x86_64')
    
      4pkgdesc='A swirling glitch-soup of classic videogames, reforming every 10 seconds into a new playable mass. Won the TIGSource VGNG competition and some very nice press.'
    
      5pkgver=1.0
    
      6pkgrel=3
    
      7license=('custom:romcheckfail_eula')
    
      8depends=('lib32-sdl_mixer' 'lib32-sdl=1.2.15' 'lib32-libogg' 'lib32-libvorbis')
    
      9optdepends=('lib32-libpulse: PulseAudio output from game')
    
      10makedepends=('libarchive')
    
      11source=(
    
      12    "RomCheckFail.sh::https://web.archive.org/web/20210128143934if_/https://games.lastchancemedia.com/farbs/RomCheckFail.sh"
    
      13    "RomCheckFail.desktop"
    
      14)
    
      15sha256sums=('ae2b94bde8941728cc670890ccfc6dc2fd6ee6b41a9e05fffb0dd6eec5b09e85' 'SKIP')
    
      16options=(!debug !strip)
    
      17
    
      18build() {
    
      19    cd "$srcdir"
    
      20    echo "-- Extracting nixstaller data:"
    
      21    sh RomCheckFail.sh --noexec --target RomCheckFail_installer
    
      22    mkdir -p binaries
    
      23    echo "-- Extracting instarchive..."
    
      24    bsdtar xf RomCheckFail_installer/instarchive_all -C binaries
    
      25    cd "$srcdir/binaries/RomCheckFail"
    
      26    echo "-- Removing unneeded libraries so that system versions are used"
    
      27    rm lib/lib{vorbisfile,vorbis,SDL-1.2,ogg}.so*
    
      28}
    
      29
    
      30package() {
    
      31    mkdir -p "$pkgdir/opt/romcheckfail"
    
      32    cp -r "$srcdir/binaries/RomCheckFail/." "$pkgdir/opt/romcheckfail/"
    
      33    install -Dm644 "$srcdir/binaries/RomCheckFail/license" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      34    install -Dm644 "$srcdir/binaries/RomCheckFail/bin/Farbs.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/RomCheckFail.png"
    
      35    install -Dm644 "$srcdir/RomCheckFail.desktop" "$pkgdir/usr/share/applications/RomCheckFail.desktop"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2