nice-boat

maintainer kokokoshka · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

piracy

Why flagged Two distinct issues: (1) A prebuilt binary ('nice_boat') is downloaded from a personal Nextcloud instance (cloud.kokokoshka.com) with 'SKIP' checksum and installed as an executable — a genuine supply-chain risk since the host owner can silently replace the binary at any time with no integrity check to catch it. (2) The package explicitly directs users to rutracker.org (a known piracy tracker) to obtain commercial game resources for School Days and Shiny Days, which are proprietary visual novels by 0verflow — this constitutes facilitation of piracy and warrants the piracy flag. The medium severity is appropriate for the unverified executed binary from an unofficial host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 "https://cloud.kokokoshka.com/s/FiprpDLgHT5EWEn/download"

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 85%): Two distinct issues: (1) A prebuilt binary ('nice_boat') is downloaded from a personal Nextcloud instance (cloud.kokokoshka.com) with 'SKIP' checksum and installed as an executable — a genuine supply-chain risk since the host owner can silently replace the binary at any time with no integrity check to catch it. (2) The package explicitly directs users to rutracker.org (a known piracy tracker) to obtain commercial game resources for School Days and Shiny Days, which are proprietary visual novels by 0verflow — this constitutes facilitation of piracy and warrants the piracy flag. The medium severity is appropriate for the unverified executed binary from an unofficial host.

PKGBUILD

1 offending line(s) highlighted

      1#Author: Andrey Leonchikov <andreil499@gmail.com>
    
      2#Maintainer: Ilya Chelyadin <ilya77105@gmail.com>
    
      3
    
      4pkgname=nice-boat
    
      5pkgver=1.0.1.7503
    
      6pkgrel=1
    
      7
    
      8source=(
    
      9         "https://cloud.kokokoshka.com/s/FiprpDLgHT5EWEn/download"
    
      10         "SchoolDays.desktop"
    
      11         "ShinyDays.desktop"
    
      12         "unpack_school.sh"
    
      13         "unpack_shiny.sh")
    
      14md5sums=(
    
      15         'SKIP'
    
      16         'c515095d4236a9090332ab5afada3326'
    
      17         'aae45fc657f09f033bb9a2b1a8cdb9fa'
    
      18         '121f2bc12e5ff51c3579c9ba54e8a0e8'
    
      19         'ceafb860d9752a7deaf6ef30cd7fc6e1')
    
      20pkgdesc="Fan-made game engine for 0verflow games (School Days, Shiny Days)"
    
      21url="https://cloud.kokokoshka.com/s/FiprpDLgHT5EWEn"
    
      22arch=(x86_64)
    
      23license=(GPL)
    
      24depends=(glibc libjpeg-turbo libpng freetype2 ffmpeg libvorbis libogg curl openssl zlib openal libglvnd glu libx11 gcc-libs)
    
      25optdepends=(
    
      26         'innoextract: for fast resources unpack without wine, used in unpack script'
    
      27         'grep: used in unpack script'
    
      28         'sed: used in unpack script')
    
      29package() {
    
      30    cd "$srcdir"
    
      31    install -Dm644 SchoolDays.desktop "$pkgdir/usr/share/applications/SchoolDays.desktop"
    
      32    install -Dm644 ShinyDays.desktop "$pkgdir/usr/share/applications/ShinyDays.desktop"
    
      33    install -Dm775 unpack_school.sh "$pkgdir/opt/SchoolDays/unpack.sh"
    
      34    install -Dm775 unpack_shiny.sh "$pkgdir/opt/ShinyDays/unpack.sh"
    
      35    cd "$srcdir/nice-boat"
    
      36    install -Dm644 school_days.png "$pkgdir/opt/SchoolDays/school_days.png"
    
      37    install -Dm644 shiny_days.png "$pkgdir/opt/ShinyDays/shiny_days.png"
    
      38    install -Dm775 nice_boat "$pkgdir/opt/SchoolDays/nice_boat"
    
      39    install -Dm775 nice_boat "$pkgdir/opt/ShinyDays/nice_boat"
    
      40
    
      41    echo "#################################################################"
    
      42    echo "Please, download game resources, install innoextract package and use unpack script!"
    
      43    echo "Visit https://rutracker.org/forum/viewtopic.php?t=5141773 for School Days"
    
      44    echo "and https://rutracker.org/forum/viewtopic.php?t=5009974 for Shiny Days"
    
      45    echo "Script usage:"
    
      46    echo "cd /your/path/SchoolDaysHQ or cd /your/path/ShinyDaysHQ"
    
      47    echo "run /opt/SchoolDays/unpack.sh or /opt/ShinyDaysHQ/unpack.sh as root"
    
      48    echo "#################################################################"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2