lucas-simpsons-hit-and-run-mod-launcher
LOW
maintainer CodingKoopa
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source files from the project's official CDN and a trusted GitLab repository; both are plausibly project-owned, and the installed files are either data or expected build artifacts, posing no remote code execution or supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from the project's official CDN and a trusted GitLab repository; both are plausibly project-owned, and the installed files are either data or expected build artifacts, posing no remote code execution or supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:42
"$pkgname-${_launcherver}.zip::https://cdn.donutteam.com/Downloads/Tools/\
PKGBUILD
1 offending line(s) highlighted
1
#!/bin/bash
2
# ^ Indicate that this is meant for use with Bash.
3
# Don't warn about unused variables.
4
# shellcheck disable=2034
5
# Don't warn about referencing unassigned variables.
6
# shellcheck disable=2154
7
8
# Maintainer: Koopa <codingkoopa@gmail.com>
9
10
pkgname='lucas-simpsons-hit-and-run-mod-launcher'
11
_launcherver='1.26'
12
_linuxver='b024359583da621c6e5402b2c2f46c6061c975ac'
13
pkgver="$_launcherver.${_linuxver:0:9}"
14
pkgrel='1'
15
pkgdesc='Mod launcher for The Simpsons: Hit & Run.'
16
arch=(
17
'x86_64'
18
'i686'
19
)
20
url='https://donutteam.com/'
21
# The mod launcher uses libraries under the ZLIB and Lua licenses, but it doesn't make sense to
22
# bundle them with this package because said licenses should be managed by their respective Linux
23
# packages (e.g. the TinyXML ZLIB license installed by the Linux zlib package.) and Windows licenses
24
# left up to the Windows program to display.
25
# The mod launcher itself has no particular license.
26
license=('unknown')
27
depends=(
28
# Zenity is needed for the mod launcher launcher's dialogs shown while installing the runtime.
29
'zenity'
30
# Wine is needed to run the mod launcher.
31
'wine'
32
# Winetricks is needed to install the .NET 3.5 SP1 runtime required by the mod launcher.
33
'winetricks'
34
)
35
optdepends=(
36
# wrestools is needed to get the version of the mod launcher EXE and apply any workarounds.
37
'icoutils: old launcher support'
38
)
39
source=(
40
# TODO: Add the package version here to the saved file name too!
41
# Official mod launcher download for the current release.
42
"$pkgname-${_launcherver}.zip::https://cdn.donutteam.com/Downloads/Tools/\
43
Lucas'%20Simpsons%20Hit%20&%20Run%20Mod%20Launcher%20${_launcherver}.zip"
44
# Unofficial mod launcher Linux launcher download for the latest master branch.
45
# TODO: release these in lockstep with the launcher?
46
"https://gitlab.com/CodingKoopa/lml-linux-launcher/-/archive/\
47
$_linuxver/lml-linux-launcher-$_linuxver.zip"
48
)
49
sha256sums=(
50
'ed469c8cf29f3f4fcfb3793e3afb7c3e4d8f6c5d824e9d8645b31eb7f93cbb00'
51
'49f643d14cf04c882548f22feb25db6e91af2635c93291f97fbdfd47ec81f98f')
52
53
package() {
54
# Install the mod launcher files.
55
56
# Install the Windows executable to /usr/lib/lucas-simpsons-hit-and-run-mod-launcher/ because it's
57
# an executable, but not meant to be ran as-is.
58
install -Dm644 'Lucas Simpsons Hit & Run Mod Launcher.exe' "$pkgdir/usr/lib/$pkgname/$pkgname.exe"
59
# Install the default hacks to /usr/lib/lucas-simpsons-hit-and-run-mod-launcher/dlls for the same
60
# reason.
61
install -Dm644 -t "$pkgdir/usr/lib/$pkgname/dlls/" DLLs/*
62
# Install the default mods to /usr/share/lucas-simpsons-hit-and-run-mod-launcher/mods/ because
63
# they aren't really shared objects, but just data like textures and models.
64
install -Dm644 -t "$pkgdir/usr/share/$pkgname/mods/" Mods/*.lmlm
65
66
# Install the mod launcher Linux launcher files.
67
cd lml-linux-launcher-$_linuxver || exit 1
68
69
# Install the mod launcher launcher.
70
install -Dm655 "bin/$pkgname.sh" "$pkgdir/usr/bin/$pkgname"
71
# Install the MIME types.
72
install -Dm644 "data/$pkgname.xml" "$pkgdir/usr/share/mime/packages/$pkgname.xml"
73
# Install the icons.
74
for SIZE in 16 22 32 48 64 256; do
75
install -Dm644 "data/$pkgname-$SIZE.png" \
76
"$pkgdir/usr/share/icons/hicolor/${SIZE}x${SIZE}/apps/$pkgname.png"
77
done
78
# Install the desktop entry.
79
install -Dm644 "data/com.donutteam.$pkgname.desktop" \
80
"$pkgdir/usr/share/applications/com.donutteam.$pkgname.desktop"
81
# Install the helper script.
82
install -m655 'bin/check-for-duplicate-lmlms.sh' "$pkgdir/usr/bin/check-for-duplicate-lmlms"
83
}
84
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |