octr-nitrofueled-pc-bin

MEDIUM

maintainer orphaned 0 votes scanned 2026-10-24 15:40:54.697274

View on AUR

Why flagged

The package installs an unverifiable prebuilt AppImage from a GitHub release, which could be swapped with malicious code; while GitHub is generally trusted, the AppImage is not built from source and its integrity relies solely on the provided checksum.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs an unverifiable prebuilt AppImage from a GitHub release, which could be swapped with malicious code; while GitHub is generally trusted, the AppImage is not built from source and its integrity relies solely on the provided checksum.

PKGBUILD

      1# Maintainer: Oskar Gerlicz-Kowalczuk <oskar@gerlicz.space>
    
      2# Contributor: HyperPuppy
    
      3
    
      4pkgname=octr-nitrofueled-pc-bin
    
      5_pkgname=OCTR-NitroFueled-PC
    
      6pkgver=0.6.4
    
      7pkgrel=1
    
      8pkgdesc="Crash Team Racing: Nitro-Fueled (PS4) running natively on PC (SacredFire fork)"
    
      9arch=('x86_64')
    
      10url="https://github.com/Ryu7w7/OCTR-NitroFueled-PC"
    
      11license=('GPL-2.0-only')
    
      12depends=('fuse2' 'zlib' 'hicolor-icon-theme')
    
      13provides=('octr-nitrofueled-pc')
    
      14conflicts=('octr-nitrofueled-pc')
    
      15options=('!strip')
    
      16
    
      17source=("${pkgname}-${pkgver}.AppImage::https://github.com/Ryu7w7/${_pkgname}/releases/download/v${pkgver}/SacredFire-v${pkgver}-x86_64.AppImage")
    
      18sha256sums=('9af6d88b52735367029910472571b300561cd7e1617da1d3674249536f158f2e')
    
      19
    
      20prepare() {
    
      21  chmod +x "${pkgname}-${pkgver}.AppImage"
    
      22  ./"${pkgname}-${pkgver}.AppImage" --appimage-extract
    
      23}
    
      24
    
      25package() {
    
      26  install -d "${pkgdir}/opt/${pkgname}"
    
      27  cp -a squashfs-root/* "${pkgdir}/opt/${pkgname}/"
    
      28
    
      29  install -d "${pkgdir}/usr/bin"
    
      30  cat << 'EOFWRAP' > "${pkgdir}/usr/bin/sacredfire"
    
      31#!/bin/sh
    
      32exec /opt/octr-nitrofueled-pc-bin/AppRun "$@"
    
      33EOFWRAP
    
      34  chmod 755 "${pkgdir}/usr/bin/sacredfire"
    
      35  ln -s sacredfire "${pkgdir}/usr/bin/octr-nitrofueled-pc"
    
      36
    
      37  install -d "${pkgdir}/usr/share/applications"
    
      38  install -Dm644 squashfs-root/io.github.sacredfire.Launcher.desktop \
    
      39    "${pkgdir}/usr/share/applications/io.github.sacredfire.Launcher.desktop"
    
      40  sed -i 's|^Exec=.*|Exec=/usr/bin/sacredfire|' \
    
      41    "${pkgdir}/usr/share/applications/io.github.sacredfire.Launcher.desktop"
    
      42
    
      43  if [ -f squashfs-root/io.github.sacredfire.Launcher.png ]; then
    
      44    install -Dm644 squashfs-root/io.github.sacredfire.Launcher.png \
    
      45      "${pkgdir}/usr/share/icons/hicolor/256x256/apps/io.github.sacredfire.Launcher.png"
    
      46  fi
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 15:40:54	Medium	2