mspinball-bin

maintainer archolas · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a RAR archive from archive.org (a well-known, legitimate digital archive) containing the classic 3D Pinball Space Cadet game files. The archive has a pinned sha256sum, providing integrity verification. The extracted contents are game data files (PINBALL.EXE, etc.) run under Wine — not native binaries executed directly on the host system. Archive.org is a widely-used, reputable host for legacy software preservation and is commonly used in AUR packages. The 'mspinball' binary and desktop file referenced in package() appear to come from outside the source array (installed from $srcdir/../), suggesting they are provided by a companion package or the user, which is slightly unusual but not a security concern. The proprietary license is noted but this is abandonware/freeware that Microsoft has effectively released. No obfuscation, no unofficial personal hosting, no native code execution from untrusted sources. The cheaper model's concern about archive.org being 'non-standard' is a false positive — it is a legitimate and trusted host for this type of content.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The package downloads a RAR archive from archive.org (a well-known, legitimate digital archive) containing the classic 3D Pinball Space Cadet game files. The archive has a pinned sha256sum, providing integrity verification. The extracted contents are game data files (PINBALL.EXE, etc.) run under Wine — not native binaries executed directly on the host system. Archive.org is a widely-used, reputable host for legacy software preservation and is commonly used in AUR packages. The 'mspinball' binary and desktop file referenced in package() appear to come from outside the source array (installed from $srcdir/../), suggesting they are provided by a companion package or the user, which is slightly unusual but not a security concern. The proprietary license is noted but this is abandonware/freeware that Microsoft has effectively released. No obfuscation, no unofficial personal hosting, no native code execution from untrusted sources. The cheaper model's concern about archive.org being 'non-standard' is a false positive — it is a legitimate and trusted host for this type of content.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=('https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:Lucas Eduardo Wendt <lucas59356@gmail.com>
    
      2
    
      3pkgname=mspinball-bin
    
      4pkgver=v1
    
      5depends=('wine')
    
      6makedepends=('unrar')
    
      7pkgrel=2
    
      8arch=(x86_64)
    
      9pkgdesc="3D Pinball - Space Cadet"
    
      10license=("proprietary")
    
      11options=(!strip)
    
      12noextract=('Space_Cadet.rar')
    
      13url="https://archive.org/details/SpaceCadet_Plus95"
    
      14source=('https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar')
    
      15
    
      16sha256sums=("3cc5dfd914c2ac41b03f006c7ccbb59d6f9e4c32ecfd1906e718c8e47f130f4a")
    
      17
    
      18prepare() {
    
      19    unrar e -y Space_Cadet.rar
    
      20    rm $srcdir/Space_Cadet.rar
    
      21}
    
      22package() {
    
      23    install -D -m0755 $srcdir/../mspinball $pkgdir/usr/bin/mspinball
    
      24    install -D -m0644 $srcdir/../mspinball.desktop $pkgdir/usr/share/applications/mspinball.desktop
    
      25    mkdir -m755 -p $pkgdir/usr/share/mspinbal
    
      26    cp -r $srcdir $pkgdir/usr/share/mspinball
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2