moondust-project-stable-bin

maintainer chiyuki0325 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from a non-whitelisted but project-associated host (wohlsoft.ru), which is the developer's own domain; however, the binaries are checksum-verified and the project is open-source, reducing supply-chain risk to low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from a non-whitelisted but project-associated host (wohlsoft.ru), which is the developer's own domain; however, the binaries are checksum-verified and the project is open-source, reducing supply-chain risk to low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://wohlsoft.ru/projects/Moondust/_downloads/linux64/pge-project-stable-linux-ubuntu-18.04.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kirikaze Chiyuki <me@chyk.ink>
    
      2pkgname=moondust-project-stable-bin
    
      3pkgver=0.4.3
    
      4pkgrel=7
    
      5pkgdesc="Moondust Project (formerly known as PGE Project) is a free and open-source game engine and development kit for it, giving developers the ability to create platform games. (Binary package - stable branch)"
    
      6arch=('x86_64')
    
      7url="https://github.com/WohlSoft/Moondust-Project"
    
      8license=('GPLv3')
    
      9depends=('ffmpeg' 'sox' 'libtiff' 'desktop-file-utils' 'moondust-configpack')
    
      10#makedepends=('git')
    
      11optdepends=()
    
      12provides=('moondust-project')
    
      13conflicts=('moondust-project-master-bin' 'moondust-project-git')
    
      14install="moondust-project.install"
    
      15source=(
    
      16"https://wohlsoft.ru/projects/Moondust/_downloads/linux64/pge-project-stable-linux-ubuntu-18.04.tar.bz2"
    
      17"moondust-engine.png::https://github.com/WohlSoft/Moondust-Project/raw/master/Engine/_resources/icon/cat_256.png"
    
      18"moondust-editor.png::https://github.com/WohlSoft/Moondust-Project/raw/master/Editor/_resources/appicon/cat_builder_256.png"
    
      19"moondust-calibrator.png::https://github.com/WohlSoft/Moondust-Project/raw/master/PlayableCalibrator/_resources/icon/calibrator_256.png"
    
      20"moondust-musplay.png::https://github.com/WohlSoft/Moondust-Project/raw/master/MusicPlayer/_resources/cat_musplay/cat_musplay_256x256.png"
    
      21"moondust-maintainer.png::https://github.com/WohlSoft/Moondust-Project/raw/master/Maintainer/_resources/icon/maintainer256.png"
    
      22"moondust-editor.desktop"
    
      23"moondust-engine.desktop"
    
      24"moondust-musplay.desktop"
    
      25"moondust-calibrator.desktop"
    
      26"moondust-maintainer.desktop"
    
      27)
    
      28sha512sums=(
    
      29"7693291730d98785a9dee22c8770c458014d567a813f40cc4319f0643a62bab04718e93e7c55e477ecaf3ab20131232fa7362952909766fa2274271042838d48"
    
      30"c20deba3f580857a63d0ce2361188a0c137e9880334ddd2ddef779b1b0556019ea0ced113f5cf3658cf6174dd258c9e67df2cb79791c57509b8d563ace8eb92a"
    
      31"55d8cc501b8c759b6f4712268a2b07e01b7f49ae55d82cd916418d75b087d26fcfa9199cfbaa68bb8dbd7013f1e35ae9416ea7d2067eefd0a213f1e577d8000d"
    
      32"d208c4de44ac32cacb46736801e9c9437905791a17680ae2a3c52dd8f4fb16f48ad55b6d7dcfb603727db0bd97e0862802171d259dd9cadb62637aecfc956252"
    
      33"510af4bf95f1887b9940678916c88ad4e4e70a86932e8c30004619df1bce6c007b85be0d0421433defa95d5757ff717daec89d3004d65ccc2f70db828630d3fd"
    
      34"fd67c3e074fb2594d580e3420e7b12033e852650d5045672a99fcf1b5b68b286ad5a4d538de42e9e3939ef03caec14ac42216c9b908373c961ec23d1f2d421f7"
    
      35"1876fe0f0ddfc7ebfcd29c13dd3363ee2bafe77d133c38876e6c590a94114a1eae51eec9f2547aa2db3e6fc3acc0462faf4d8f1152c8abaab59ba850f963aeb5"
    
      36"c2b6ebf25baf2a657f203bb1208eeccbb889b469345f5f2f01949e7019834cf5af5b601a43fe4b171059cc7e0610be5f1b655e767d7c7face8cbcdb83bd364ca"
    
      37"97cbfe332e918d72845c11bb19c4a7150e05e2d7788cf0386a80d1e4da5eef6ea5ffa42f957a91823a82fe33c2092fcfd02a234387a8e8ebabeddc5b0d7ffdb0"
    
      38"6a390222644def5d58f4aac30afdc11b8e54b2da136d47fc69ed2e816fba063241a26449dbc474e93661c9d8af5b8b24b07f3f061e8a4e8f5b21e08a7b3cfaf7"
    
      39"9ee0eb2f735f16aea9412549d453949b17fcf68866e57b1ff578dd10a4a9e6ca26fdd19e868b11f79273c16050564a5bbc0a8e205448977f1c9fb08e6c101bc4"
    
      40)
    
      41
    
      42package() {
    
      43    mkdir -p "${pkgdir}/opt/moondust"
    
      44    cp -r "${srcdir}/PGE_Project/"*"" "${pkgdir}/opt/moondust"
    
      45    chmod 0755 "${pkgdir}/opt/moondust/pge_editor"
    
      46    chmod 0755 "${pkgdir}/opt/moondust/pge_engine"
    
      47    chmod 0755 "${pkgdir}/opt/moondust/pge_musplay"
    
      48    chmod 0755 "${pkgdir}/opt/moondust/pge_calibrator"
    
      49    chmod 0755 "${pkgdir}/opt/moondust/GIFs2PNG"
    
      50    chmod 0755 "${pkgdir}/opt/moondust/PNG2GIFs"
    
      51    chmod 0755 "${pkgdir}/opt/moondust/LazyFixTool"
    
      52    chmod 0755 "${pkgdir}/opt/moondust/PaletteFilter"
    
      53    chmod 0755 "${pkgdir}/opt/moondust/pge_maintainer"
    
      54
    
      55    mkdir -p "${pkgdir}/usr/bin"
    
      56    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/pge_editor" > "${pkgdir}/usr/bin/pge_editor"
    
      57    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/pge_engine" > "${pkgdir}/usr/bin/pge_engine"
    
      58    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/pge_musplay" > "${pkgdir}/usr/bin/pge_musplay"
    
      59    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/pge_calibrator" > "${pkgdir}/usr/bin/pge_calibrator"
    
      60    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/GIFs2PNG" > "${pkgdir}/usr/bin/GIFs2PNG"
    
      61    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/PNG2GIFs" > "${pkgdir}/usr/bin/PNG2GIFs"
    
      62    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/LazyFixTool" > "${pkgdir}/usr/bin/LazyFixTool"
    
      63    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/PaletteFilter" > "${pkgdir}/usr/bin/PaletteFilter"
    
      64    printf "#!/bin/bash\ncd /opt/moondust; /opt/moondust/pge_maintainer" > "${pkgdir}/usr/bin/pge_maintainer"
    
      65    chmod 0755 "${pkgdir}/usr/bin/pge_editor"
    
      66    chmod 0755 "${pkgdir}/usr/bin/pge_engine"
    
      67    chmod 0755 "${pkgdir}/usr/bin/pge_musplay"
    
      68    chmod 0755 "${pkgdir}/usr/bin/pge_calibrator"
    
      69    chmod 0755 "${pkgdir}/usr/bin/GIFs2PNG"
    
      70    chmod 0755 "${pkgdir}/usr/bin/PNG2GIFs"
    
      71    chmod 0755 "${pkgdir}/usr/bin/LazyFixTool"
    
      72    chmod 0755 "${pkgdir}/usr/bin/PaletteFilter"
    
      73    chmod 0755 "${pkgdir}/usr/bin/pge_maintainer"
    
      74
    
      75
    
      76    mkdir -p "${pkgdir}/usr/share/licenses"
    
      77    cp -r "${pkgdir}/opt/moondust/licenses" "${pkgdir}/usr/share/licenses/moondust"
    
      78    mv "${pkgdir}/opt/moondust/LICENSE.txt" "${pkgdir}/usr/share/licenses/moondust/LICENSE.txt"
    
      79    mv "${pkgdir}/opt/moondust/pge_engine.license.gpl3.txt" "${pkgdir}/usr/share/licenses/moondust/pge_engine.license.gpl3.txt"
    
      80    mv "${pkgdir}/opt/moondust/pge_engine.license.mit.txt" "${pkgdir}/usr/share/licenses/moondust/pge_engine.license.mit.txt"
    
      81
    
      82    mkdir -p "${pkgdir}/usr/share/doc"
    
      83    cp -r "${pkgdir}/opt/moondust/help" "${pkgdir}/usr/share/doc/moondust"
    
      84    cp "${pkgdir}/opt/moondust/"*".txt" "${pkgdir}/usr/share/doc/moondust/"
    
      85
    
      86    rm "${pkgdir}/opt/moondust/"*".ini"
    
      87
    
      88    install -Dm0644 "${srcdir}/moondust-editor.png" "${pkgdir}/usr/share/pixmaps/moondust-editor.png"
    
      89    install -Dm0644 "${srcdir}/moondust-engine.png" "${pkgdir}/usr/share/pixmaps/moondust-engine.png"
    
      90    install -Dm0644 "${srcdir}/moondust-musplay.png" "${pkgdir}/usr/share/pixmaps/moondust-musplay.png"
    
      91    install -Dm0644 "${srcdir}/moondust-calibrator.png" "${pkgdir}/usr/share/pixmaps/moondust-calibrator.png"
    
      92    install -Dm0644 "${srcdir}/moondust-maintainer.png" "${pkgdir}/usr/share/pixmaps/moondust-maintainer.png"
    
      93
    
      94    install -Dm0755 "${srcdir}/moondust-editor.desktop" "${pkgdir}/usr/share/applications/moondust-editor.desktop"
    
      95    install -Dm0755 "${srcdir}/moondust-engine.desktop" "${pkgdir}/usr/share/applications/moondust-engine.desktop"
    
      96    install -Dm0755 "${srcdir}/moondust-musplay.desktop" "${pkgdir}/usr/share/applications/moondust-musplay.desktop"
    
      97    install -Dm0755 "${srcdir}/moondust-calibrator.desktop" "${pkgdir}/usr/share/applications/moondust-calibrator.desktop"
    
      98    install -Dm0755 "${srcdir}/moondust-maintainer.desktop" "${pkgdir}/usr/share/applications/moondust-maintainer.desktop"
    
      99}
    
      100

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2