meshmc

LOW
maintainer yongdohyun 1 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package builds from source tarballs hosted on the project's own domain, which is not on the whitelist but plausibly legitimate; all sources are compiled locally and no remote code execution occurs, though checksums are skipped, reducing verifiability.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source tarballs hosted on the project's own domain, which is not on the whitelist but plausibly legitimate; all sources are compiled locally and no remote code execution occurs, though checksums are skipped, reducing verifiability.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:45 source=("https://ftp.projecttick.org/Project-Tick/meshmc/releases/download/meshmc-v$pkgver/meshmc-meshmc-v$pkgver.tar.gz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Mehmet Samet Duman <yongdohyun@projecttick.org>
2
3pkgname=meshmc
4pkgver=7.19.0
5pkgrel=1
6pkgdesc="Minecraft launcher with ability to manage multiple instances"
7arch=(x86_64)
8url='https://projecttick.org/p/meshmc'
9license=('GPL-3.0-or-later AND LGPL-3.0-or-later AND LGPL-2.0-or-later AND Apache-2.0 AND MIT AND LicenseRef-Batch AND OFL-1.1')
10depends=(
11 glibc
12 mesa-utils
13 libarchive
14 libgl
15 pciutils
16 qt6-base
17 qt6-imageformats
18 qt6-networkauth
19 qt6-svg
20 zlib-ng
21 qrencode
22 hicolor-icon-theme
23 cmark
24 libstdc++
25 libgcc
26)
27makedepends=(
28 cmake
29 extra-cmake-modules
30 git
31 jdk17-openjdk
32 ninja
33 scdoc
34 vulkan-headers
35)
36optdepends=(
37 'glfw: to use system GLFW libraries'
38 'openal: to use system OpenAL libraries'
39 'visualvm: Profiling support'
40 'xorg-xrandr: for older minecraft versions'
41 'orca: minecraft screen reader'
42 'flite: minecraft voice narration'
43 'java-runtime: use system java versions'
44)
45source=("https://ftp.projecttick.org/Project-Tick/meshmc/releases/download/meshmc-v$pkgver/meshmc-meshmc-v$pkgver.tar.gz"
46 "https://ftp.projecttick.org/Project-Tick/classparser/releases/download/classparser-v1.0.0/classparser-classparser-v1.0.0.tar.gz"
47 "https://ftp.projecttick.org/Project-Tick/cmark/releases/download/cmark-v0.31.2/cmark-cmark-v0.31.2.tar.gz"
48 "https://ftp.projecttick.org/Project-Tick/ganalytics/releases/download/ganalytics-v1.0.0/ganalytics-ganalytics-v1.0.0.tar.gz"
49 "https://ftp.projecttick.org/Project-Tick/iconfix/releases/download/iconfix-v1.0.0/iconfix-iconfix-v1.0.0.tar.gz"
50 "https://ftp.projecttick.org/Project-Tick/javacheck/releases/download/javacheck-v1.0.0/javacheck-javacheck-v1.0.0.tar.gz"
51 "https://ftp.projecttick.org/Project-Tick/javalauncher/releases/download/javalauncher-v1.0.0/javalauncher-javalauncher-v1.0.0.tar.gz"
52 "https://ftp.projecttick.org/Project-Tick/libnbtplusplus/releases/download/libnbtplusplus-v3.2/libnbtplusplus-libnbtplusplus-v3.2.tar.gz"
53 "https://ftp.projecttick.org/Project-Tick/katabasis/releases/download/katabasis-v1.0.0/katabasis-katabasis-v1.0.0.tar.gz"
54 "https://ftp.projecttick.org/Project-Tick/localpeer/releases/download/localpeer-v1.0.0/localpeer-localpeer-v1.0.0.tar.gz"
55 "https://ftp.projecttick.org/Project-Tick/neozip/releases/download/neozip-v10.1.0/neozip-neozip-v10.1.0.tar.gz"
56 "https://ftp.projecttick.org/Project-Tick/optional-bare/releases/download/optional-bare-v1.0.0/optional-bare-optional-bare-v1.0.0.tar.gz"
57 "https://ftp.projecttick.org/Project-Tick/rainbow/releases/download/rainbow-v1.0.0/rainbow-rainbow-v1.0.0.tar.gz"
58 "https://ftp.projecttick.org/Project-Tick/systeminfo/releases/download/systeminfo-v1.0.0/systeminfo-systeminfo-v1.0.0.tar.gz"
59 "https://ftp.projecttick.org/Project-Tick/tomlplusplus/releases/download/tomlplusplus-v10.0.3/tomlplusplus-tomlplusplus-v10.0.3.tar.gz"
60 "https://ftp.projecttick.org/Project-Tick/xz-embedded/releases/download/xzembedded-v1.0.0/xz-embedded-xzembedded-v1.0.0.tar.gz"
61 {lionshead,batch,mdi}.license)
62b2sums=('SKIP'
63 'SKIP'
64 'SKIP'
65 'SKIP'
66 'SKIP'
67 'SKIP'
68 'SKIP'
69 'SKIP'
70 'SKIP'
71 'SKIP'
72 'SKIP'
73 'SKIP'
74 'SKIP'
75 'SKIP'
76 'SKIP'
77 'SKIP'
78 'be4289832af95b1cd6e721dc16b84a034533de9718d9b43a49bd08dd6fe4e28eaa15228bfb311867b18fddbda1c9fc4c91f04c6d5c1a3bcc39aaa5161425e3ba'
79 '356248a6b86f06d260e0920b49d34034f79f9bc504c7fdc1849d929d2ff9b169e693a8269a2c0b34656b3802970d9b8be41a92b35177eaa3c4ccc89a702f5c9d'
80 'b35c447cd9223e096a2bb75e0741a7d0a3a1606af54c957e4f276f4e6861a9b3f06ae1d646137e8d2f24ba2238c9967c76eff8cc631a68d7e48e376056982cc6')
81
82cmake_options_deps() {
83 local _dep_source="$1"
84 local _dep_build="$2"
85
86 local cmake_config_options=(
87 -D CMAKE_BUILD_TYPE=RelWithDebInfo
88 -D CMAKE_INSTALL_PREFIX="${_faketarget}"
89 -S "${_dep_source}"
90 -B "${_dep_build}"
91 )
92
93 cmake "${cmake_config_options[@]}"
94
95 cmake --build "${_dep_build}"
96}
97
98build() {
99
100 local _faketarget="${srcdir}/fake-root"
101 mkdir -p "${_faketarget}"
102
103 export PATH="/usr/lib/jvm/java-17-openjdk/bin/:$PATH"
104
105 local cmake_options_meshmc=(
106 -B build
107 -S "meshmc-meshmc-v$pkgver"
108 -G Ninja
109 -D CMAKE_CXX_FLAGS="-Wall -pedantic -Wno-deprecated-declarations -fstack-protector-strong --param=ssp-buffer-size=4 -O3"
110 -D MeshMC_BUILD_PLATFORM=archlinux
111 -D MeshMC_DISABLE_JAVA_DOWNLOADER=OFF
112 -W no-dev
113 -D CMAKE_BUILD_TYPE=None
114 -D CMAKE_INSTALL_PREFIX=/usr
115 -D CMAKE_PREFIX_PATH="${_faketarget}"
116 )
117
118
119 cmake_options_deps "neozip-neozip-v10.1.0" "neozip-neozip-v10.1.0/build"
120 cmake --install "neozip-neozip-v10.1.0/build"
121
122 cmake_options_deps "cmark-cmark-v0.31.2" "cmark-cmark-v0.31.2/build"
123 cmake --install "cmark-cmark-v0.31.2/build"
124
125 cmake_options_deps "libnbtplusplus-libnbtplusplus-v3.2" "libnbtplusplus-libnbtplusplus-v3.2/build"
126 cmake --install "libnbtplusplus-libnbtplusplus-v3.2/build"
127
128 cmake_options_deps "optional-bare-optional-bare-v1.0.0" "optional-bare-optional-bare-v1.0.0/build"
129 cmake --install "optional-bare-optional-bare-v1.0.0/build"
130
131 cmake_options_deps "xz-embedded-xzembedded-v1.0.0" "xz-embedded-xzembedded-v1.0.0/build"
132 cmake --install "xz-embedded-xzembedded-v1.0.0/build"
133
134 cmake_options_deps "systeminfo-systeminfo-v1.0.0" "systeminfo-systeminfo-v1.0.0/build"
135 cmake --install "systeminfo-systeminfo-v1.0.0/build"
136
137 cmake_options_deps "ganalytics-ganalytics-v1.0.0" "ganalytics-ganalytics-v1.0.0/build"
138 cmake --install "ganalytics-ganalytics-v1.0.0/build"
139
140 cmake_options_deps "rainbow-rainbow-v1.0.0" "rainbow-rainbow-v1.0.0/build"
141 cmake --install "rainbow-rainbow-v1.0.0/build"
142
143 cmake_options_deps "iconfix-iconfix-v1.0.0" "iconfix-iconfix-v1.0.0/build"
144 cmake --install "iconfix-iconfix-v1.0.0/build"
145
146 cmake_options_deps "localpeer-localpeer-v1.0.0" "localpeer-localpeer-v1.0.0/build"
147 cmake --install "localpeer-localpeer-v1.0.0/build"
148
149 cmake_options_deps "classparser-classparser-v1.0.0" "classparser-classparser-v1.0.0/build"
150 cmake --install "classparser-classparser-v1.0.0/build"
151
152 cmake_options_deps "katabasis-katabasis-v1.0.0" "katabasis-katabasis-v1.0.0/build"
153 cmake --install "katabasis-katabasis-v1.0.0/build"
154
155 cmake_options_deps "javacheck-javacheck-v1.0.0" "javacheck-javacheck-v1.0.0/build"
156 cmake --install "javacheck-javacheck-v1.0.0/build"
157
158 cmake_options_deps "javalauncher-javalauncher-v1.0.0" "javalauncher-javalauncher-v1.0.0/build"
159 cmake --install "javalauncher-javalauncher-v1.0.0/build"
160
161 cmake "${cmake_options_meshmc[@]}"
162 cmake --build build
163}
164
165check() {
166 ctest --test-dir build
167}
168
169package() {
170 # licenses
171 install -Dm644 lionshead.license -t "$pkgdir"/usr/share/licenses/$pkgname/
172 install -Dm644 batch.license -t "$pkgdir"/usr/share/licenses/$pkgname/
173 install -Dm644 mdi.license -t "$pkgdir"/usr/share/licenses/$pkgname/
174
175 DESTDIR="$pkgdir" cmake --install build
176}
177
178# mnv:set ts=2 sw=2 et:
179# vim:set ts=2 sw=2 et:
180

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion