meshmc

maintainer yongdohyun · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source tarballs hosted on the project's own domain, which is not on the whitelist but plausibly legitimate; all sources are compiled locally and no remote code execution occurs, though checksums are skipped, reducing verifiability.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source tarballs hosted on the project's own domain, which is not on the whitelist but plausibly legitimate; all sources are compiled locally and no remote code execution occurs, though checksums are skipped, reducing verifiability.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:45 source=("https://ftp.projecttick.org/Project-Tick/meshmc/releases/download/meshmc-v$pkgver/meshmc-meshmc-v$pkgver.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mehmet Samet Duman <yongdohyun@projecttick.org>
    
      2
    
      3pkgname=meshmc
    
      4pkgver=7.19.0
    
      5pkgrel=1
    
      6pkgdesc="Minecraft launcher with ability to manage multiple instances"
    
      7arch=(x86_64)
    
      8url='https://projecttick.org/p/meshmc'
    
      9license=('GPL-3.0-or-later AND LGPL-3.0-or-later AND LGPL-2.0-or-later AND Apache-2.0 AND MIT AND LicenseRef-Batch AND OFL-1.1')
    
      10depends=(
    
      11  glibc
    
      12  mesa-utils
    
      13  libarchive
    
      14  libgl
    
      15  pciutils
    
      16  qt6-base
    
      17  qt6-imageformats
    
      18  qt6-networkauth
    
      19  qt6-svg
    
      20  zlib-ng
    
      21  qrencode
    
      22  hicolor-icon-theme
    
      23  cmark
    
      24  libstdc++
    
      25  libgcc
    
      26)
    
      27makedepends=(
    
      28  cmake
    
      29  extra-cmake-modules
    
      30  git
    
      31  jdk17-openjdk
    
      32  ninja
    
      33  scdoc
    
      34  vulkan-headers
    
      35)
    
      36optdepends=(
    
      37  'glfw: to use system GLFW libraries'
    
      38  'openal: to use system OpenAL libraries'
    
      39  'visualvm: Profiling support'
    
      40  'xorg-xrandr: for older minecraft versions'
    
      41  'orca: minecraft screen reader'
    
      42  'flite: minecraft voice narration'
    
      43  'java-runtime: use system java versions'
    
      44)
    
      45source=("https://ftp.projecttick.org/Project-Tick/meshmc/releases/download/meshmc-v$pkgver/meshmc-meshmc-v$pkgver.tar.gz"
    
      46        "https://ftp.projecttick.org/Project-Tick/classparser/releases/download/classparser-v1.0.0/classparser-classparser-v1.0.0.tar.gz"
    
      47        "https://ftp.projecttick.org/Project-Tick/cmark/releases/download/cmark-v0.31.2/cmark-cmark-v0.31.2.tar.gz"
    
      48        "https://ftp.projecttick.org/Project-Tick/ganalytics/releases/download/ganalytics-v1.0.0/ganalytics-ganalytics-v1.0.0.tar.gz"
    
      49        "https://ftp.projecttick.org/Project-Tick/iconfix/releases/download/iconfix-v1.0.0/iconfix-iconfix-v1.0.0.tar.gz"
    
      50        "https://ftp.projecttick.org/Project-Tick/javacheck/releases/download/javacheck-v1.0.0/javacheck-javacheck-v1.0.0.tar.gz"
    
      51        "https://ftp.projecttick.org/Project-Tick/javalauncher/releases/download/javalauncher-v1.0.0/javalauncher-javalauncher-v1.0.0.tar.gz"
    
      52        "https://ftp.projecttick.org/Project-Tick/libnbtplusplus/releases/download/libnbtplusplus-v3.2/libnbtplusplus-libnbtplusplus-v3.2.tar.gz"
    
      53        "https://ftp.projecttick.org/Project-Tick/katabasis/releases/download/katabasis-v1.0.0/katabasis-katabasis-v1.0.0.tar.gz"
    
      54        "https://ftp.projecttick.org/Project-Tick/localpeer/releases/download/localpeer-v1.0.0/localpeer-localpeer-v1.0.0.tar.gz"
    
      55        "https://ftp.projecttick.org/Project-Tick/neozip/releases/download/neozip-v10.1.0/neozip-neozip-v10.1.0.tar.gz"
    
      56        "https://ftp.projecttick.org/Project-Tick/optional-bare/releases/download/optional-bare-v1.0.0/optional-bare-optional-bare-v1.0.0.tar.gz"
    
      57        "https://ftp.projecttick.org/Project-Tick/rainbow/releases/download/rainbow-v1.0.0/rainbow-rainbow-v1.0.0.tar.gz"
    
      58        "https://ftp.projecttick.org/Project-Tick/systeminfo/releases/download/systeminfo-v1.0.0/systeminfo-systeminfo-v1.0.0.tar.gz"
    
      59        "https://ftp.projecttick.org/Project-Tick/tomlplusplus/releases/download/tomlplusplus-v10.0.3/tomlplusplus-tomlplusplus-v10.0.3.tar.gz"
    
      60        "https://ftp.projecttick.org/Project-Tick/xz-embedded/releases/download/xzembedded-v1.0.0/xz-embedded-xzembedded-v1.0.0.tar.gz"
    
      61        {lionshead,batch,mdi}.license)
    
      62b2sums=('SKIP'
    
      63  'SKIP'
    
      64  'SKIP'
    
      65  'SKIP'
    
      66  'SKIP'
    
      67  'SKIP'
    
      68  'SKIP'
    
      69  'SKIP'
    
      70  'SKIP'
    
      71  'SKIP'
    
      72  'SKIP'
    
      73  'SKIP'
    
      74  'SKIP'
    
      75  'SKIP'
    
      76  'SKIP'
    
      77  'SKIP'
    
      78  'be4289832af95b1cd6e721dc16b84a034533de9718d9b43a49bd08dd6fe4e28eaa15228bfb311867b18fddbda1c9fc4c91f04c6d5c1a3bcc39aaa5161425e3ba'
    
      79  '356248a6b86f06d260e0920b49d34034f79f9bc504c7fdc1849d929d2ff9b169e693a8269a2c0b34656b3802970d9b8be41a92b35177eaa3c4ccc89a702f5c9d'
    
      80  'b35c447cd9223e096a2bb75e0741a7d0a3a1606af54c957e4f276f4e6861a9b3f06ae1d646137e8d2f24ba2238c9967c76eff8cc631a68d7e48e376056982cc6')
    
      81
    
      82cmake_options_deps() {
    
      83    local _dep_source="$1"
    
      84    local _dep_build="$2"
    
      85
    
      86    local cmake_config_options=(
    
      87        -D CMAKE_BUILD_TYPE=RelWithDebInfo
    
      88        -D CMAKE_INSTALL_PREFIX="${_faketarget}"
    
      89        -S "${_dep_source}"
    
      90        -B "${_dep_build}"
    
      91    )
    
      92
    
      93    cmake "${cmake_config_options[@]}"
    
      94
    
      95    cmake --build "${_dep_build}"
    
      96}
    
      97
    
      98build() {
    
      99
    
      100  local _faketarget="${srcdir}/fake-root"
    
      101  mkdir -p "${_faketarget}"
    
      102
    
      103  export PATH="/usr/lib/jvm/java-17-openjdk/bin/:$PATH"
    
      104
    
      105  local cmake_options_meshmc=(
    
      106    -B build
    
      107    -S "meshmc-meshmc-v$pkgver"
    
      108    -G Ninja
    
      109    -D CMAKE_CXX_FLAGS="-Wall -pedantic -Wno-deprecated-declarations -fstack-protector-strong --param=ssp-buffer-size=4 -O3"
    
      110    -D MeshMC_BUILD_PLATFORM=archlinux
    
      111    -D MeshMC_DISABLE_JAVA_DOWNLOADER=OFF
    
      112    -W no-dev
    
      113    -D CMAKE_BUILD_TYPE=None
    
      114    -D CMAKE_INSTALL_PREFIX=/usr
    
      115    -D CMAKE_PREFIX_PATH="${_faketarget}"
    
      116  )
    
      117
    
      118
    
      119  cmake_options_deps "neozip-neozip-v10.1.0" "neozip-neozip-v10.1.0/build"
    
      120  cmake --install "neozip-neozip-v10.1.0/build"
    
      121
    
      122  cmake_options_deps "cmark-cmark-v0.31.2" "cmark-cmark-v0.31.2/build"
    
      123  cmake --install "cmark-cmark-v0.31.2/build"
    
      124
    
      125  cmake_options_deps "libnbtplusplus-libnbtplusplus-v3.2" "libnbtplusplus-libnbtplusplus-v3.2/build"
    
      126  cmake --install "libnbtplusplus-libnbtplusplus-v3.2/build"
    
      127
    
      128  cmake_options_deps "optional-bare-optional-bare-v1.0.0" "optional-bare-optional-bare-v1.0.0/build"
    
      129  cmake --install "optional-bare-optional-bare-v1.0.0/build"
    
      130
    
      131  cmake_options_deps "xz-embedded-xzembedded-v1.0.0" "xz-embedded-xzembedded-v1.0.0/build"
    
      132  cmake --install "xz-embedded-xzembedded-v1.0.0/build"
    
      133
    
      134  cmake_options_deps "systeminfo-systeminfo-v1.0.0" "systeminfo-systeminfo-v1.0.0/build"
    
      135  cmake --install "systeminfo-systeminfo-v1.0.0/build"
    
      136
    
      137  cmake_options_deps "ganalytics-ganalytics-v1.0.0" "ganalytics-ganalytics-v1.0.0/build"
    
      138  cmake --install "ganalytics-ganalytics-v1.0.0/build"
    
      139
    
      140  cmake_options_deps "rainbow-rainbow-v1.0.0" "rainbow-rainbow-v1.0.0/build"
    
      141  cmake --install "rainbow-rainbow-v1.0.0/build"
    
      142
    
      143  cmake_options_deps "iconfix-iconfix-v1.0.0" "iconfix-iconfix-v1.0.0/build"
    
      144  cmake --install "iconfix-iconfix-v1.0.0/build"
    
      145
    
      146  cmake_options_deps "localpeer-localpeer-v1.0.0" "localpeer-localpeer-v1.0.0/build"
    
      147  cmake --install "localpeer-localpeer-v1.0.0/build"
    
      148
    
      149  cmake_options_deps "classparser-classparser-v1.0.0" "classparser-classparser-v1.0.0/build"
    
      150  cmake --install "classparser-classparser-v1.0.0/build"
    
      151
    
      152  cmake_options_deps "katabasis-katabasis-v1.0.0" "katabasis-katabasis-v1.0.0/build"
    
      153  cmake --install "katabasis-katabasis-v1.0.0/build"
    
      154
    
      155  cmake_options_deps "javacheck-javacheck-v1.0.0" "javacheck-javacheck-v1.0.0/build"
    
      156  cmake --install "javacheck-javacheck-v1.0.0/build"
    
      157
    
      158  cmake_options_deps "javalauncher-javalauncher-v1.0.0" "javalauncher-javalauncher-v1.0.0/build"
    
      159  cmake --install "javalauncher-javalauncher-v1.0.0/build"
    
      160
    
      161  cmake "${cmake_options_meshmc[@]}"
    
      162  cmake --build build
    
      163}
    
      164
    
      165check() {
    
      166  ctest --test-dir build
    
      167}
    
      168
    
      169package() {
    
      170  # licenses
    
      171  install -Dm644 lionshead.license -t "$pkgdir"/usr/share/licenses/$pkgname/
    
      172  install -Dm644 batch.license -t "$pkgdir"/usr/share/licenses/$pkgname/
    
      173  install -Dm644 mdi.license -t "$pkgdir"/usr/share/licenses/$pkgname/
    
      174
    
      175  DESTDIR="$pkgdir" cmake --install build
    
      176}
    
      177
    
      178# mnv:set ts=2 sw=2 et:
    
      179# vim:set ts=2 sw=2 et:
    
      180

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2