mapcrafter-world113-git

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a Minecraft JAR from s3.amazonaws.com/Minecraft.Download at package() time using a version string read from a file in the repo (MCVERSION), with no checksum verification. While s3.amazonaws.com/Minecraft.Download was historically Mojang's official distribution endpoint, it is no longer the canonical download URL (Mojang moved to launcher.mojang.com and later piston-data.mojang.com), meaning this bucket could be abandoned, repurposed, or controlled by a third party. The downloaded JAR is then executed/processed by a Python script (mapcrafter_textures.py) which extracts textures from it. An attacker who controls or can tamper with that S3 bucket could serve a malicious JAR. Additionally, the download happens outside source=() so there is no integrity check whatsoever. This is a genuine supply-chain concern: an executed artifact (JAR processed by Python tooling) from a potentially untrusted/abandoned host with no checksum. The git source itself is from the official mapcrafter GitHub repo, which is fine. The medium rating is appropriate.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:35 curl --output /tmp/mc.jar https://s3.amazonaws.com/Minecraft.Download/versions/$(cat MCVERSION)/$(cat MCVERSION).jar

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a Minecraft JAR from s3.amazonaws.com/Minecraft.Download at package() time using a version string read from a file in the repo (MCVERSION), with no checksum verification. While s3.amazonaws.com/Minecraft.Download was historically Mojang's official distribution endpoint, it is no longer the canonical download URL (Mojang moved to launcher.mojang.com and later piston-data.mojang.com), meaning this bucket could be abandoned, repurposed, or controlled by a third party. The downloaded JAR is then executed/processed by a Python script (mapcrafter_textures.py) which extracts textures from it. An attacker who controls or can tamper with that S3 bucket could serve a malicious JAR. Additionally, the download happens outside source=() so there is no integrity check whatsoever. This is a genuine supply-chain concern: an executed artifact (JAR processed by Python tooling) from a potentially untrusted/abandoned host with no checksum. The git source itself is from the official mapcrafter GitHub repo, which is fine. The medium rating is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alan Hardman <alan@phpizza.com>
    
      2
    
      3pkgname=mapcrafter-world113-git
    
      4pkgver=v.2.3.1.r0.g2e33e0d
    
      5pkgrel=1
    
      6pkgdesc="A High Performance Minecraft Map Renderer - Experimental MC 1.13 branch"
    
      7arch=("i686" "x86_64")
    
      8license=("GPL")
    
      9url="http://mapcrafter.org"
    
      10makedepends=("cmake" "boost" "imagemagick")
    
      11depends=("boost-libs" "libpng" "libjpeg" "curl" "python2")
    
      12optdepends=(
    
      13    "python2-pillow: support for mapcrafter_png-it.py script"
    
      14)
    
      15provides=("mapcrafter")
    
      16conflicts=("mapcrafter")
    
      17source=("$pkgname"::"git://github.com/mapcrafter/mapcrafter.git#branch=world113")
    
      18md5sums=("SKIP")
    
      19
    
      20pkgver() {
    
      21    cd "$srcdir/$pkgname"
    
      22    git describe --long | sed -E 's/([^-]*-g)/r\1/;s/-/./g' 
    
      23}
    
      24
    
      25build() {
    
      26    cd "$srcdir/$pkgname"
    
      27    cmake -DCMAKE_INSTALL_PREFIX="$pkgdir/usr" .
    
      28    make
    
      29}
    
      30
    
      31package() {
    
      32    cd "$srcdir/$pkgname"
    
      33    VERBOSE=1 make install
    
      34
    
      35    curl --output /tmp/mc.jar https://s3.amazonaws.com/Minecraft.Download/versions/$(cat MCVERSION)/$(cat MCVERSION).jar
    
      36    python2 "$srcdir/$pkgname/src/tools/mapcrafter_textures.py" -f /tmp/mc.jar "$pkgdir/usr/share/mapcrafter/textures"
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 21:12:02	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2