mapcrafter-git

maintainer pompeoponti · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a Minecraft JAR from s3.amazonaws.com/Minecraft.Download during the package() step outside the source=() array, bypassing makepkg's integrity checking entirely (no checksum, no signature). The S3 bucket 'Minecraft.Download' was the official Mojang download host at the time this PKGBUILD was written, so this is not an attacker-controlled host. However, the version string is read from a file (MCVERSION) in the git repo, meaning a compromised upstream repo could redirect the download to a different version, and there is no integrity verification of the downloaded JAR. The Python script then runs against this unverified JAR to extract textures. This is a real but not clearly malicious concern: it's sloppy packaging that bypasses makepkg's security model, but the intent is legitimate (extracting Minecraft textures for the map renderer). Not HIGH/malware, but medium due to the unverified external binary download executed during packaging.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:33 curl --output /tmp/mc.jar https://s3.amazonaws.com/Minecraft.Download/versions/$(cat MCVERSION)/$(cat MCVERSION).jar

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a Minecraft JAR from s3.amazonaws.com/Minecraft.Download during the package() step outside the source=() array, bypassing makepkg's integrity checking entirely (no checksum, no signature). The S3 bucket 'Minecraft.Download' was the official Mojang download host at the time this PKGBUILD was written, so this is not an attacker-controlled host. However, the version string is read from a file (MCVERSION) in the git repo, meaning a compromised upstream repo could redirect the download to a different version, and there is no integrity verification of the downloaded JAR. The Python script then runs against this unverified JAR to extract textures. This is a real but not clearly malicious concern: it's sloppy packaging that bypasses makepkg's security model, but the intent is legitimate (extracting Minecraft textures for the map renderer). Not HIGH/malware, but medium due to the unverified external binary download executed during packaging.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Moritz Hilscher <m0r13@mapcrafter.org>
    
      2
    
      3pkgname=mapcrafter-git
    
      4pkgver=v.2.3.1.r0.g68eb131
    
      5pkgrel=1
    
      6pkgdesc="A High Performance Minecraft Map Renderer"
    
      7arch=("i686" "x86_64")
    
      8license=("GPL")
    
      9url="http://mapcrafter.org"
    
      10makedepends=("cmake" "boost" "imagemagick")
    
      11depends=("boost-libs" "libpng" "libjpeg" "curl" "python2")
    
      12optdepends=(
    
      13    "python2-pillow: support for mapcrafter_png-it.py script"
    
      14)
    
      15source=("$pkgname"::"git://github.com/mapcrafter/mapcrafter.git")
    
      16md5sums=("SKIP")
    
      17
    
      18pkgver() {
    
      19    cd "$srcdir/$pkgname"
    
      20    git describe --long | sed -E 's/([^-]*-g)/r\1/;s/-/./g'    
    
      21}
    
      22
    
      23build() {
    
      24    cd "$srcdir/$pkgname"
    
      25    cmake -DCMAKE_INSTALL_PREFIX="$pkgdir/usr" .
    
      26    make
    
      27}
    
      28
    
      29package() {
    
      30    cd "$srcdir/$pkgname"
    
      31    VERBOSE=1 make install
    
      32
    
      33    curl --output /tmp/mc.jar https://s3.amazonaws.com/Minecraft.Download/versions/$(cat MCVERSION)/$(cat MCVERSION).jar
    
      34    python2 "$srcdir/$pkgname/src/tools/mapcrafter_textures.py" -f /tmp/mc.jar "$pkgdir/usr/share/mapcrafter/textures"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2