liblast-bin

maintainer begin-theadventu · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 binary (Liblast.x86_64) from https://libla.st/downloads/Liblast_dev.zip, which appears to be the project's own download mirror (libla.st is the Liblast project domain, consistent with the Codeberg repo at codeberg.org/Liblast/Liblast). However, the domain libla.st is not the canonical source repository (Codeberg), and the zip is fetched as a 'dev' build with a date-based version. The binary is installed as an executable and symlinked into /usr/bin. The sha256sum is pinned, which mitigates tampering risk somewhat, but the source is a prebuilt binary from a third-party host rather than built from source. This is a legitimate medium concern: a prebuilt binary from a non-primary host (even if project-affiliated) that is directly executed, with no source build. The risk is real but not clearly malicious — it matches the standard AUR -bin package pattern with the caveat that libla.st is a less-established host than e.g. GitHub releases.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("liblast-$pkgver.zip::https://libla.st/downloads/Liblast_dev.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 binary (Liblast.x86_64) from https://libla.st/downloads/Liblast_dev.zip, which appears to be the project's own download mirror (libla.st is the Liblast project domain, consistent with the Codeberg repo at codeberg.org/Liblast/Liblast). However, the domain libla.st is not the canonical source repository (Codeberg), and the zip is fetched as a 'dev' build with a date-based version. The binary is installed as an executable and symlinked into /usr/bin. The sha256sum is pinned, which mitigates tampering risk somewhat, but the source is a prebuilt binary from a third-party host rather than built from source. This is a legitimate medium concern: a prebuilt binary from a non-primary host (even if project-affiliated) that is directly executed, with no source build. The risk is real but not clearly malicious — it matches the standard AUR -bin package pattern with the caveat that libla.st is a less-established host than e.g. GitHub releases.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: begin-theadventure <begin-thecontact.ncncb at dralias dot com>
    
      2
    
      3pkgname=liblast-bin
    
      4pkgver=2023.12.30
    
      5pkgrel=1
    
      6pkgdesc="A libre multiplayer FPS game and framework built using Godot game engine and a fully open-source tool chain (PREVIEW) (binary release)"
    
      7url="https://codeberg.org/Liblast/Liblast"
    
      8license=('MIT')
    
      9arch=('x86_64')
    
      10depends=('hicolor-icon-theme')
    
      11provides=("liblast")
    
      12conflicts=("liblast")
    
      13source=("liblast-$pkgver.zip::https://libla.st/downloads/Liblast_dev.zip"
    
      14        "$url/raw/commit/c901da2dbc7307c755c67369b462c6997351dbca/LICENSE"
    
      15        "$url/raw/commit/ef8b6acd473048b09bbec2c1a093b7d703acb7f0/src/game/icon.svg")
    
      16sha256sums=('6f4a86286484b14ed447b610d578722eabc51aa32c55d817d83702d1665ae316'
    
      17            'f986b15a47941613ad5414aef3738a4157313af1f23c9cc79695e1268ad5094e'
    
      18            '189f1492895cd2c8a8b4a95ee7d6965bc4aa7e82e635e8415d6d83ca0e324d98')
    
      19
    
      20prepare(){
    
      21# Create a shortcut
    
      22  echo -e "[Desktop Entry]\n\
    
      23Name=liblast\n\
    
      24Comment=A libre multiplayer FPS game and framework built using Godot game engine and a fully open-source tool chain\n\
    
      25Exec=liblast %U\n\
    
      26Icon=liblast\n\
    
      27Terminal=false\n\
    
      28Type=Application\n\
    
      29Categories=Game;" > liblast.desktop
    
      30}
    
      31
    
      32package() {
    
      33# Create directories
    
      34  mkdir -p "$pkgdir/usr/bin" "$pkgdir/usr/lib/liblast"
    
      35# Install
    
      36  install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/liblast"
    
      37  install -Dm644 liblast.desktop -t "$pkgdir/usr/share/applications"
    
      38  install -Dm644 icon.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/liblast.svg"
    
      39  install -Dm644 Liblast.pck -t  "$pkgdir/usr/lib/liblast"
    
      40  install -Dm755 Liblast.x86_64 -t "$pkgdir/usr/lib/liblast"
    
      41  ln -s /usr/lib/liblast/Liblast.x86_64 "$pkgdir/usr/bin/liblast"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2