mtgarena

maintainer starwort · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt MSI installer from the official game distributor's domain (wizards.com), which is plausibly the project's own release infrastructure, and the checksums are provided and verified, making the risk low despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt MSI installer from the official game distributor's domain (wizards.com), which is plausibly the project's own release infrastructure, and the checksums are provided and verified, making the risk low despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "${pkgname}-${pkgver}.msi::https://mtgarena.downloads.wizards.com/Live/Windows32/versions/${_shortver}/MTGAInstaller_${pkgver}.msi"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Toby Collier <firstname dot lastname at maths.ox.ac.uk>
    
      2
    
      3pkgname=mtgarena
    
      4_shortver=13636.1303683
    
      5pkgver=0.1.$_shortver
    
      6pkgrel=2
    
      7pkgdesc="Magic: the Gathering Arena (via Wine)"
    
      8arch=('x86_64')
    
      9url="https://magic.wizards.com/en/mtgarena"
    
      10license=('custom')
    
      11depends=('wine')
    
      12makedepends=('icoutils')
    
      13
    
      14source=(
    
      15    "${pkgname}-${pkgver}.msi::https://mtgarena.downloads.wizards.com/Live/Windows32/versions/${_shortver}/MTGAInstaller_${pkgver}.msi"
    
      16    "${pkgname}"
    
      17    "${pkgname}.desktop"
    
      18)
    
      19
    
      20sha256sums=(
    
      21    'fe35789830fe43c44c52ccb305f26ef7dcd99cceac262fd4720d9fa58b393938'
    
      22    'f7389c8dd1dba42a1af5f3fed0fe8f0bea591322a363bc981e9365c1df5e08fd'
    
      23    'b646e4cbbeefc6d5dab93991d87afa21de3b3e6e54a06b37d92d1a9bfc5528ae'
    
      24)
    
      25
    
      26prepare() {
    
      27    export WINEPREFIX="${srcdir}/wineprefix"
    
      28    export WINEARCH=win64
    
      29    export WINEDLLOVERRIDES="winemenubuilder.exe=d"
    
      30    wineboot -u
    
      31    wine "${srcdir}/${pkgname}-${pkgver}.msi" /quiet
    
      32
    
      33    appdir="${srcdir}/wineprefix/drive_c/Program Files (x86)/Wizards of the Coast/MTGA"
    
      34    exefile="${appdir}/MTGA.exe"
    
      35
    
      36    mkdir -p "${srcdir}/icons"
    
      37    wrestool -x -t14 -o "${srcdir}/icons" "$exefile"
    
      38    icotool -x -o "${srcdir}/icons" "${srcdir}/icons/MTGA.exe_14_103.ico"
    
      39}
    
      40
    
      41package() {
    
      42    install -dm755 "${pkgdir}/opt/${pkgname}"
    
      43
    
      44    cp -a \
    
      45        "${srcdir}/wineprefix/drive_c/Program Files (x86)/Wizards of the Coast/MTGA" \
    
      46        "${pkgdir}/opt/${pkgname}/"
    
      47    install -Dm755 \
    
      48        "${srcdir}/${pkgname}" \
    
      49        "${pkgdir}/usr/bin/${pkgname}"
    
      50    install -Dm644 \
    
      51        "${srcdir}/${pkgname}.desktop" \
    
      52        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      53
    
      54    find "${srcdir}/icons" -type f -name '*.png' | while read -r icon; do
    
      55        filename="$(basename "$icon")"
    
      56        size="$(sed -n 's/.*_\([0-9]\+\)x\1x.*/\1/p' <<< "$filename")"
    
      57
    
      58        if [[ -n "$size" ]]; then
    
      59            install -Dm644 \
    
      60                "$icon" \
    
      61                "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${pkgname}.png"
    
      62        fi
    
      63    done
    
      64}
    
      65

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Toby Collier <firstname dot lastname at maths.ox.ac.uk>
 
 pkgname=mtgarena
-_shortver=13547.1300161
+_shortver=13636.1303683
 pkgver=0.1.$_shortver
 pkgrel=2
 pkgdesc="Magic: the Gathering Arena (via Wine)"
@@ -18,7 +18,7 @@
 )
 
 sha256sums=(
-    '03389cc0ecb0159cf8668d3b2f521234bd0e5104222a86c646cbf2a9671a7b78'
+    'fe35789830fe43c44c52ccb305f26ef7dcd99cceac262fd4720d9fa58b393938'
     'f7389c8dd1dba42a1af5f3fed0fe8f0bea591322a363bc981e9365c1df5e08fd'
     'b646e4cbbeefc6d5dab93991d87afa21de3b3e6e54a06b37d92d1a9bfc5528ae'
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 23:22:13	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 19:17:41	MEDIUM	1
2026-06-21 22:10:50	CLEAN	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1