minimetro
MEDIUM
maintainer jmsq
10 votes
scanned 2026-11-03 16:05:05.794714
Why flagged
The package requires a prebuilt binary tarball from a non-standard, unverifiable source (Humble Bundle library), which is not publicly accessible or checksum-verified beyond the local file, creating a supply-chain risk if the source is compromised or swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
"${pkgname}.png::https://dinopoloclub.com/wp-content/uploads/2019/08/${_longname/ /-}-Icon.png")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package requires a prebuilt binary tarball from a non-standard, unverifiable source (Humble Bundle library), which is not publicly accessible or checksum-verified beyond the local file, creating a supply-chain risk if the source is compromised or swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: John-Michael Mulesa <jmulesa@gmail.com>
2
# Contributor: XZS <d dot f dot fischer at web dot de>
3
# Contributor: Martin Lukes <martin.meridius@gmail.com>
4
# Contributor: Samuel Littley <samuel.littley@toastwaffle.com>
5
# Contributor: William Giokas <1007380@gmail.com>
6
7
_longname="Mini Metro"
8
pkgname="${_longname,,}"
9
pkgname="${pkgname/ }"
10
pkgver=56
11
pkgrel=1
12
pkgdesc='minimalistic subway layout game'
13
url="https://dinopoloclub.com/games/mini-metro/"
14
license=('LicenseRef-Proprietary')
15
arch=('x86_64')
16
depends=('libgl' 'libx11' 'libxext' 'glu' 'hicolor-icon-theme')
17
makedepends=('imagemagick')
18
# Prebuilt Unity binaries: nothing to strip or debug.
19
options=('!strip' '!debug')
20
# Download the Linux tarball from your Humble Bundle library and put it next to
21
# this PKGBUILD (some browsers save it as .tar; rename it back to .tar.gz).
22
DLAGENTS+=("hib::/usr/bin/echo ==> ERROR: %u is missing; download it from your Humble library and place it next to the PKGBUILD.")
23
source=("hib://${_longname/ }-release-${pkgver}-linux.tar.gz"
24
"${pkgname}.desktop"
25
"starter.sh"
26
"${pkgname}.png::https://dinopoloclub.com/wp-content/uploads/2019/08/${_longname/ /-}-Icon.png")
27
sha256sums=('6f5c8526f2a1c2cf86030ad0e298f7f0bb3933b8af7ea5c6a579db6820e74b0c'
28
'b6353b9b373bd4ff23b11509c41b72cd28d5a8046546cd512a2dd7a62ef16dd3'
29
'5bef1047ade8fded513686f30fa378a22c4f8376325eb76e123c355a05ed059b'
30
'2498480f8ddfcb8a990431e01d98704aac9f88c5b733e2dc485e613e84de045b')
31
32
package() {
33
# Prepare variables.
34
destdir="$pkgdir/opt/$pkgname"
35
install -d "$destdir" "$pkgdir"/usr/{bin,share/applications}
36
37
# Install the game and data files.
38
cp -r --no-preserve=mode,ownership "${_longname}_Data" "$destdir"
39
install "$_longname" "$destdir"
40
install "UnityPlayer.so" "$destdir"
41
chmod -R a+rX "$destdir"
42
43
# Care for the icon.
44
for size in 16 22 24 32 36 48 64 72 96 128 192 256 384 512; do
45
size=${size}x${size}
46
install -d "$pkgdir/usr/share/icons/hicolor/$size/apps"
47
magick $pkgname.png -resize $size "$pkgdir/usr/share/icons/hicolor/$size/apps/$pkgname.png"
48
done
49
50
# Compose the desktop entry and starter.
51
export longname="$_longname" pkgname pkgdesc
52
envsubst < "$pkgname.desktop" > "$pkgdir/usr/share/applications/$pkgname.desktop"
53
envsubst < starter.sh > "$pkgdir/usr/bin/$pkgname"
54
chmod +x "$pkgdir/usr/bin/$pkgname"
55
}
56
Changes since previous scan
--- PKGBUILD @ 2026-06-18 16:11+++ PKGBUILD @ 2026-11-03 16:05@@ -7,21 +7,24 @@ _longname="Mini Metro" pkgname="${_longname,,}" pkgname="${pkgname/ }"-pkgver=52+pkgver=56 pkgrel=1 pkgdesc='minimalistic subway layout game'-url="http://dinopoloclub.com/${pkgname}/"-license=('custom:None')+url="https://dinopoloclub.com/games/mini-metro/"+license=('LicenseRef-Proprietary') arch=('x86_64')-depends=('libgl' 'libx11' 'glu' 'desktop-file-utils' 'gtk-update-icon-cache')+depends=('libgl' 'libx11' 'libxext' 'glu' 'hicolor-icon-theme') makedepends=('imagemagick')-DLAGENTS+=('hib::/usr/bin/echo "Could not find %u. Manually download it to \"$(pwd)\", or set up a hib:// DLAGENT in /etc/makepkg.conf."; exit 1')-install=desktop.install+# Prebuilt Unity binaries: nothing to strip or debug.+options=('!strip' '!debug')+# Download the Linux tarball from your Humble Bundle library and put it next to+# this PKGBUILD (some browsers save it as .tar; rename it back to .tar.gz).+DLAGENTS+=("hib::/usr/bin/echo ==> ERROR: %u is missing; download it from your Humble library and place it next to the PKGBUILD.") source=("hib://${_longname/ }-release-${pkgver}-linux.tar.gz" "${pkgname}.desktop" "starter.sh"- "${pkgname}.png::${url%/*/*}/wp-content/uploads/2019/08/${_longname/ /-}-Icon.png")-sha256sums=('7f7bdfbf22ac694c61e1fcd334a1368d17f192c4b380772a82e46950668716c8'+ "${pkgname}.png::https://dinopoloclub.com/wp-content/uploads/2019/08/${_longname/ /-}-Icon.png")+sha256sums=('6f5c8526f2a1c2cf86030ad0e298f7f0bb3933b8af7ea5c6a579db6820e74b0c' 'b6353b9b373bd4ff23b11509c41b72cd28d5a8046546cd512a2dd7a62ef16dd3' '5bef1047ade8fded513686f30fa378a22c4f8376325eb76e123c355a05ed059b' '2498480f8ddfcb8a990431e01d98704aac9f88c5b733e2dc485e613e84de045b')@@ -35,12 +38,13 @@ cp -r --no-preserve=mode,ownership "${_longname}_Data" "$destdir" install "$_longname" "$destdir" install "UnityPlayer.so" "$destdir"+ chmod -R a+rX "$destdir" # Care for the icon. for size in 16 22 24 32 36 48 64 72 96 128 192 256 384 512; do size=${size}x${size} install -d "$pkgdir/usr/share/icons/hicolor/$size/apps"- convert $pkgname.png -resize $size "$pkgdir/usr/share/icons/hicolor/$size/apps/$pkgname.png"+ magick $pkgname.png -resize $size "$pkgdir/usr/share/icons/hicolor/$size/apps/$pkgname.png" done # Compose the desktop entry and starter.Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-03 16:05:05 | Medium | 2 |
| 2026-06-18 16:11:54 | Clean | 0 |