mega-man-x-regenesis

maintainer quest · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a self-contained Godot binary from itch.io, a plausible source for indie games; the download is handled securely via a custom DLAGENT script for ephemeral URLs, and the binary is not executed during build, posing minimal risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a self-contained Godot binary from itch.io, a plausible source for indie games; the download is handled securely via a custom DLAGENT script for ephemeral URLs, and the binary is not executed during build, posing minimal risk.

PKGBUILD

      1# Maintainer: Josh Ellithorpe <quest@mac.com>
    
      2
    
      3pkgname=mega-man-x-regenesis
    
      4pkgver=1.00.1
    
      5pkgrel=1
    
      6pkgdesc="A fan-made Mega Man X game set in an alternate timeline where Sigma has won"
    
      7arch=('x86_64')
    
      8url="https://mmxregenesis.itch.io/mega-man-x-regenesis"
    
      9license=('LicenseRef-proprietary')
    
      10depends=('glibc' 'alsa-lib' 'libx11' 'libxcursor' 'libxi' 'libxinerama' 'libxrandr' 'mesa')
    
      11optdepends=(
    
      12  'libpulse: PulseAudio audio support'
    
      13  'wayland: native Wayland support'
    
      14)
    
      15makedepends=('curl')
    
      16# Self-contained Godot binary with an embedded PCK; stripping would corrupt it.
    
      17options=(!strip !debug)
    
      18
    
      19# The trailing number is the itch.io upload id for the Linux build.
    
      20# It changes with every release; find the new one in the page source
    
      21# (data-upload_id) or via: curl -s $url | grep -o 'data-upload_id="[0-9]*"'
    
      22_upload_id=18845226
    
      23source=(
    
      24  "${pkgname}-${pkgver}.x86_64::itch://mmxregenesis/mega-man-x-regenesis/${_upload_id}"
    
      25  "${pkgname}.desktop"
    
      26  "${pkgname}.png"
    
      27  "itch-dl.sh"
    
      28)
    
      29b2sums=('c428a4260bf8f8ed5e2afcac80d23256bfdd1551bc550a2f3df7d56bde4cd0622d5c0bb3019e044851aa06aaecc1323a1b314345998a834e6889314019f29080'
    
      30        'd8f2264a07d9d0dae799571da39194bfc9212b1096e84e0ee1b29f11c4d67e489b7e4b15d1e78e5b67b29291e165e22ebab07f9b88020ffbb0db4f16072c8e18'
    
      31        'af50b022103a57f46d324f773f748d326f8fc485326c778bb307d15f44279387ae0bab7fc38be99da676ab0f137188eba6a5e97ff7e518ffb5a29955c4fe1fbf'
    
      32        'c1ce296192f16c0050da40350dff2eb9573c9b75f48e0cd7a8b64a5fb7953d4243f3731fdcd012b11d4f15d42446882721a2eea1b36ef244f433fb72ed3d58de')
    
      33# itch.io download URLs are ephemeral (signed, 60s expiry); itch-dl.sh
    
      34# resolves itch://<user>/<game>/<upload_id> URLs at fetch time.
    
      35DLAGENTS+=("itch::/bin/sh ${PWD}/itch-dl.sh %u %o")
    
      36
    
      37package() {
    
      38  install -Dm755 "${pkgname}-${pkgver}.x86_64" "${pkgdir}/usr/bin/${pkgname}"
    
      39  install -Dm644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      40  install -Dm644 "${pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 23:38:16	LOW	2