olympus-bin

maintainer crab2313 · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary artifact from Azure Pipelines without a verifiable upstream source or signature, creating a supply-chain risk if the build server is compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 source=("$pkgname-$pkgver.zip::https://dev.azure.com/EverestAPI/Olympus/_apis/build/builds/$pkgver/artifacts?artifactName=linux.main&\$format=zip")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary artifact from Azure Pipelines without a verifiable upstream source or signature, creating a supply-chain risk if the build server is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Moses Miller <Majora320@gmail.com>
    
      2
    
      3fetch_version() {
    
      4    python <<EOF
    
      5import requests,json
    
      6
    
      7response = requests.get("https://dev.azure.com/EverestAPI/Olympus/_apis/build/builds")
    
      8builds = json.loads(response.text)
    
      9stable_builds = -1
    
      10
    
      11for b in builds["value"]:
    
      12    if b["sourceBranch"] == "refs/heads/stable" :
    
      13        stable_builds = max(int(b["id"]), stable_builds)
    
      14
    
      15if stable_builds == -1:
    
      16    os.exit(1)
    
      17else:
    
      18    print(stable_builds)
    
      19EOF
    
      20}
    
      21
    
      22pkgname=olympus-bin
    
      23pkgver=$(fetch_version)
    
      24pkgrel=1
    
      25pkgdesc='A mod manager for Celeste'
    
      26arch=('x86_64')
    
      27url='https://github.com/EverestAPI/Olympus'
    
      28license=('MIT')
    
      29depends=('love' 'lua51-lsqlite3')
    
      30makedepends=('unzip' 'python' 'python-requests')
    
      31source=("$pkgname-$pkgver.zip::https://dev.azure.com/EverestAPI/Olympus/_apis/build/builds/$pkgver/artifacts?artifactName=linux.main&\$format=zip")
    
      32noextract=("$pkgname-$pkgver.zip")
    
      33sha256sums=('5599a1a4b7e3261d62c27bcff81a2f9269ec2209ba3d07c10a875763bd026539')
    
      34
    
      35
    
      36prepare() {
    
      37    unzip "$pkgname-$pkgver.zip"
    
      38    cd linux.main
    
      39    unzip dist.zip
    
      40}
    
      41
    
      42package() {
    
      43    cd linux.main
    
      44
    
      45    install -Dm755 subprocess.so "$pkgdir/usr/lib/olympus/subprocess.so"
    
      46    install -Dm755 nfd.so "$pkgdir/usr/lib/olympus/nfd.so"
    
      47    install -Dm755 olympus.love "$pkgdir/usr/lib/olympus/olympus.love"
    
      48    install -Dm644 olympus.desktop "$pkgdir/usr/share/applications/olympus.desktop"
    
      49    install -Dm644 olympus.png "$pkgdir/usr/share/icons/hicolor/128x128/apps/olympus.png"
    
      50    install -Dm755 olympus "$pkgdir/usr/lib/olympus/olympus"
    
      51    install -Dm755 find-love "$pkgdir/usr/lib/olympus/find-love"
    
      52    mkdir -p "$pkgdir/usr/bin"
    
      53    ln -s "/usr/lib/olympus/olympus" "$pkgdir/usr/bin/olympus"
    
      54    
    
      55    cp -r sharp "$pkgdir/usr/lib/olympus/sharp"
    
      56}
    
      57

Changes since previous scan

--- PKGBUILD @ 2026-07-26 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -30,7 +30,7 @@
 makedepends=('unzip' 'python' 'python-requests')
 source=("$pkgname-$pkgver.zip::https://dev.azure.com/EverestAPI/Olympus/_apis/build/builds/$pkgver/artifacts?artifactName=linux.main&\$format=zip")
 noextract=("$pkgname-$pkgver.zip")
-sha256sums=('0474096b6e770cf96d00ad86eab138fe88474dca913ee30aa7dfb6d4f55139d5')
+sha256sums=('5599a1a4b7e3261d62c27bcff81a2f9269ec2209ba3d07c10a875763bd026539')
 
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 17:32:42	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2