openstarbound-nightly

maintainer PoDiax · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt client from a CI/CD link (nightly.link) which is not on the whitelist, but it is a legitimate build artifact from the project's own GitHub repository; the source is not executed remotely, and the package does not install untrusted binaries beyond the project's official build, so the risk is low despite the non-standard host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt client from a CI/CD link (nightly.link) which is not on the whitelist, but it is a legitimate build artifact from the project's own GitHub repository; the source is not executed remotely, and the package does not install untrusted binaries beyond the project's official build, so the risk is low despite the non-standard host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 "$pkgname-$pkgver.zip::https://nightly.link/OpenStarbound/OpenStarbound/workflows/build/main/OpenStarbound-Linux-Clang-Client.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: PoDiax <pd@pdx.ovh>
    
      2pkgname=openstarbound-nightly
    
      3pkgver=0.3
    
      4pkgrel=6
    
      5pkgdesc="OpenStarbound Client (Nightly Build, requires original Starbound game assets)"
    
      6arch=('x86_64')
    
      7url="https://github.com/OpenStarbound/OpenStarbound"
    
      8license=('custom')
    
      9depends=('glibc')
    
      10source=(
    
      11  "$pkgname-$pkgver.zip::https://nightly.link/OpenStarbound/OpenStarbound/workflows/build/main/OpenStarbound-Linux-Clang-Client.zip"
    
      12  "starbound.png"
    
      13  )
    
      14sha256sums=('SKIP'
    
      15'c9c86ce8ee065e3a96e25778eb1212bf559affeef61c51f0ec4b2cad76ec9193'
    
      16)
    
      17
    
      18
    
      19build() {
    
      20  echo -e "\033[1;33mThis is a nightly build of OpenStarbound.\033[0m"
    
      21  echo -e "\033[1;33mExpect bugs and crashes.\033[0m"
    
      22  echo -e "\033[1;33mPlease report any issues to the OpenStarbound GitHub repository.\033[0m"
    
      23  read -rp "Do you want to continue with the installation? [y/N]: " confirm
    
      24  if [[ "$confirm" != "y" && "$confirm" != "Y" ]]; then
    
      25    echo "Installation aborted."
    
      26    exit 1
    
      27  fi
    
      28
    
      29  echo -e "\033[1;33mOpenStarbound requires the original Starbound game assets.\033[0m"
    
      30  echo -e "\033[1;33mYou must copy the \033[1;34mpacked.pak\033[1;33m file from the original game to \033[1;34m/opt/openstarbound-nightly/assets\033[1;33m.\033[0m"
    
      31  read -rp "Do you confirm you own Starbound on Steam or other legal platform and agree to these terms? [y/N]: " confirm
    
      32  if [[ "$confirm" != "y" && "$confirm" != "Y" ]]; then
    
      33    echo "Installation aborted."
    
      34    exit 1
    
      35  fi
    
      36
    
      37}
    
      38
    
      39pre_install() {
    
      40  if [[ -f "/opt/openstarbound-nightly/assets/packed.pak" ]]; then 
    
      41    echo "Removing old 'packed.pak' file..."
    
      42    rm -f "/opt/openstarbound-nightly/assets/packed.pak"
    
      43  fi
    
      44}
    
      45
    
      46
    
      47package() {
    
      48  local expected_hash="325d7d4210667b2a4738d805e858b80d7d55e8f834da773984ca6edb993577fe"
    
      49
    
      50  check_hash() {
    
      51    sha256sum "$1" | awk '{print $1}'
    
      52  }
    
      53
    
      54  if [[ -f "/opt/openstarbound-nightly/assets/packed.pak" ]]; then
    
      55    mkdir -p "$pkgdir/opt/openstarbound-nightly/assets"
    
      56
    
      57    if [[ "$(check_hash "/opt/openstarbound-nightly/assets/packed.pak")" == "$expected_hash" ]]; then
    
      58      echo "Existing 'packed.pak' is valid. Copying to the final package."
    
      59      cp "/opt/openstarbound-nightly/assets/packed.pak" "$pkgdir/opt/openstarbound-nightly/assets/packed.pak"
    
      60    else
    
      61      echo "Hash mismatch detected for existing 'packed.pak'."
    
      62      replace_pak_prompt=true
    
      63    fi
    
      64  else
    
      65    echo "'packed.pak' does not exist. Prompting user for input."
    
      66    replace_pak_prompt=true
    
      67  fi
    
      68
    
      69
    
      70
    
      71  if [[ "$replace_pak_prompt" == true ]]; then
    
      72    read -rp "Do you have the 'packed.pak' file from the original game? [y/N]: " has_pak
    
      73    if [[ "$has_pak" == "y" || "$has_pak" == "Y" ]]; then
    
      74      read -rp "Please provide the full path to your 'packed.pak' file: " pak_path
    
      75      if [[ -f "$pak_path" ]]; then
    
      76        if [[ "$(check_hash "$pak_path")" == "$expected_hash" ]]; then
    
      77          echo "Copying 'packed.pak' from provided path to build directory..."
    
      78          cp "$pak_path" "$srcdir/packed.pak"
    
      79        else
    
      80          echo "Hash mismatch! The provided 'packed.pak' is invalid. Aborting."
    
      81          exit 1
    
      82        fi
    
      83      else
    
      84        echo "Invalid path provided for 'packed.pak'. Installation aborted."
    
      85        exit 1
    
      86      fi
    
      87    else
    
      88      echo -e "'packed.pak' file is not provided, proceeding without it. \033[1;31mMake sure to copy it to /opt/openstarbound-nightly/assets/ before trying to launching the game.\033[0m"
    
      89    fi
    
      90  fi
    
      91
    
      92  cd "$srcdir"
    
      93
    
      94  unzip -o "$pkgname-$pkgver.zip" -d "$srcdir"
    
      95  tar -xf "$srcdir/client.tar" -C "$srcdir"
    
      96  mv "$srcdir/client_distribution" "$srcdir/openstarbound-nightly"
    
      97
    
      98  rm -rf "$srcdir/openstarbound-nightly/mods"
    
      99  rm -rf "$srcdir/openstarbound-nightly/assets/user"
    
      100
    
      101  install -dm755 "$pkgdir/opt/openstarbound-nightly"
    
      102  cp -r "$srcdir/openstarbound-nightly"/* "$pkgdir/opt/openstarbound-nightly"
    
      103
    
      104  chmod -R 777 "$pkgdir/opt/openstarbound-nightly"
    
      105
    
      106  mkdir -p "$HOME/.config/openstarbound-nightly/logs"
    
      107  mkdir -p "$HOME/.config/openstarbound-nightly/mods"
    
      108  mkdir -p "$HOME/.config/openstarbound-nightly/storage"
    
      109  mkdir -p "$HOME/.config/openstarbound-nightly/assets/user"
    
      110
    
      111
    
      112  ln -sf "$HOME/.config/openstarbound-nightly/logs" "$pkgdir/opt/openstarbound-nightly/logs"
    
      113  ln -sf "$HOME/.config/openstarbound-nightly/mods" "$pkgdir/opt/openstarbound-nightly/mods"
    
      114  ln -sf "$HOME/.config/openstarbound-nightly/storage" "$pkgdir/opt/openstarbound-nightly/storage"
    
      115  ln -sf "$HOME/.config/openstarbound-nightly/assets/user" "$pkgdir/opt/openstarbound-nightly/assets/user"
    
      116
    
      117  if [[ -f "$srcdir/packed.pak" ]]; then
    
      118    echo "Copying 'packed.pak' to the final package..."
    
      119    install -Dm644 "$srcdir/packed.pak" "$pkgdir/opt/openstarbound-nightly/assets/packed.pak"
    
      120  fi
    
      121
    
      122  install -Dm644 "$srcdir/starbound.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/starbound-nightly.png"
    
      123
    
      124  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/openstarbound-nightly.desktop" <<EOF
    
      125[Desktop Entry]
    
      126Name=OpenStarbound Nightly
    
      127Exec=/usr/bin/openstarbound-nightly
    
      128Icon=starbound-nightly
    
      129Type=Application
    
      130Categories=Game;
    
      131EOF
    
      132
    
      133  install -Dm755 /dev/stdin "$pkgdir/usr/bin/openstarbound-nightly" <<EOF
    
      134#!/bin/bash
    
      135cd /opt/openstarbound-nightly/linux || exit 1
    
      136export LD_LIBRARY_PATH="\$LD_LIBRARY_PATH:./"
    
      137exec ./starbound "\$@"
    
      138EOF
    
      139
    
      140  install -Dm644 /dev/stdin "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<EOF
    
      141OpenStarbound is distributed under a custom license.
    
      142For more information, visit: $url
    
      143EOF
    
      144}
    
      145

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2