lncvrt-games-launcher

maintainer Lncvrt · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary executable ('Lncvrt-Games-Launcher-${pkgver}-linux') from a personal/project-specific R2 storage host (games-r2.lncvrt.xyz) and installs it with execute permissions (Dm755). This is not an official distribution channel (e.g., GitHub Releases, a distro mirror), but rather a personal Cloudflare R2 bucket controlled solely by the maintainer. While sha256sums are provided (offering some integrity protection), the binary is opaque, not built from source, and hosted on infrastructure entirely under the maintainer's control — meaning the maintainer could silently replace the binary at any version bump without any independent verification. This is a classic self-hosted prebuilt binary supply-chain concern: legitimate but risky. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 "https://games-r2.lncvrt.xyz/lncvrt-games-launcher/Lncvrt-Games-Launcher-${pkgver}-linux"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary executable ('Lncvrt-Games-Launcher-${pkgver}-linux') from a personal/project-specific R2 storage host (games-r2.lncvrt.xyz) and installs it with execute permissions (Dm755). This is not an official distribution channel (e.g., GitHub Releases, a distro mirror), but rather a personal Cloudflare R2 bucket controlled solely by the maintainer. While sha256sums are provided (offering some integrity protection), the binary is opaque, not built from source, and hosted on infrastructure entirely under the maintainer's control — meaning the maintainer could silently replace the binary at any version bump without any independent verification. This is a classic self-hosted prebuilt binary supply-chain concern: legitimate but risky. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lncvrt <lncvrtreal@gmail.com>
    
      2pkgname=lncvrt-games-launcher
    
      3pkgver=1.1.0
    
      4pkgrel=1
    
      5pkgdesc="The official Lncvrt Games Launcher AUR Package!"
    
      6arch=('x86_64')
    
      7depends=('gtk3' 'libx11')
    
      8url="https://games.lncvrt.xyz"
    
      9source=(
    
      10    "https://games-r2.lncvrt.xyz/lncvrt-games-launcher/Lncvrt-Games-Launcher-${pkgver}-linux"
    
      11    'lncvrt-games-launcher.desktop'
    
      12    '32x32.png'
    
      13    '128x128.png'
    
      14    '256x256@2.png'
    
      15)
    
      16sha256sums=(
    
      17    '9fa6de4b24bfd3b8ca1609da2b11f8436b4b47e0d4c6ed1470b1a7d872c5f88a'
    
      18    '459c15b6f69f7026963b2090a22a3de3729ae8f54ad23b3c72e8b8a15a937115'
    
      19    'c40be4e50bca8c58fa0114aec50e62dc85b8747cd0c61ed7b464e3b5d1ae1bd5'
    
      20    'd5272d77054a9a3f010760bf8ff78babf59eaecd31e5f695f5a7156d34252219'
    
      21    '6e812d3fcdce162d740fb7f4a0ad0a2c4b2485103b9569ed8062b952a9445c4f'
    
      22)
    
      23options=('!strip')
    
      24package() {
    
      25  install -Dm755 \
    
      26    "$srcdir/Lncvrt-Games-Launcher-${pkgver}-linux" \
    
      27    "$pkgdir/usr/bin/lncvrt-games-launcher-loader"
    
      28
    
      29  install -Dm644 \
    
      30    "$srcdir/lncvrt-games-launcher.desktop" \
    
      31    "$pkgdir/usr/share/applications/lncvrt-games-launcher.desktop"
    
      32
    
      33  install -Dm644 \
    
      34    "$srcdir/32x32.png" \
    
      35    "$pkgdir/usr/share/icons/hicolor/32x32/apps/lncvrt-games-launcher-loader.png"
    
      36
    
      37  install -Dm644 \
    
      38    "$srcdir/128x128.png" \
    
      39    "$pkgdir/usr/share/icons/hicolor/128x128/apps/lncvrt-games-launcher-loader.png"
    
      40
    
      41  install -Dm644 \
    
      42    "$srcdir/256x256@2.png" \
    
      43    "$pkgdir/usr/share/icons/hicolor/256x256@2/apps/lncvrt-games-launcher-loader.png"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2