osu

maintainer R0dn3yS · 67 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads the official osu! installer from ppy's own domain (m1.ppy.sh) and a terms file from GitHub; both are verifiable sources, and the installer is installed as data without being executed during build.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official osu! installer from ppy's own domain (m1.ppy.sh) and a terms file from GitHub; both are verifiable sources, and the installer is installed as data without being executed during build.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("${pkgname}-installer-${pkgver}.exe::https://m1.ppy.sh/r/osu!install.exe"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: envolution
    
      2# Contributor: fossdd <fossdd@pwned.life>
    
      3# Contributor: Rodney van den Velden <rodney@dfagaming.nl>
    
      4# shellcheck shell=bash disable=SC2034,SC2154
    
      5#
    
      6# https://github.com/ppy/osu is only for lazer, use the osu-lazer AUR package instead
    
      7
    
      8pkgname='osu'
    
      9pkgver=20260811
    
      10pkgrel=1
    
      11pkgdesc='A free-to-win rhythm game'
    
      12_terms_commit='b8a98fb740ed8251958f16d719138e96afa6e299'
    
      13arch=('i686' 'x86_64')
    
      14url='https://osu.ppy.sh'
    
      15license=('LicenseRef-custom')
    
      16depends=('lib32-gnutls' 'umu-launcher' 'lib32-libxcomposite' 'lib32-gst-plugins-base-libs')
    
      17makedepends=('icoutils')
    
      18optdepends=('pipewire-pulse: low-latency audio backend')
    
      19source=("${pkgname}-installer-${pkgver}.exe::https://m1.ppy.sh/r/osu!install.exe"
    
      20  "${pkgname}-terms-${_terms_commit}.md::https://raw.githubusercontent.com/ppy/osu-wiki/${_terms_commit}/wiki/Legal/Terms/en.md"
    
      21  "${pkgname}.sh"
    
      22  "${pkgname}.desktop"
    
      23  "${pkgname}.xml")
    
      24sha256sums=('6e182c10d1813209d12753dbc70b3a5bba00fef4ecf64bc42051870e6dfe4b7d'
    
      25            '0fc6b18923db85b82fa5da1cb40ccc8c0ffcaf65ee7e325af8969baa150a9fd2'
    
      26            'c96c4dc32356784f6100b201ec74d8f71b6959019624619177fb67790c7a8b2d'
    
      27            '3d98f5811539d652bf6378c2c76bff7b6d5ac82e6322942bb287ff9082f1715b'
    
      28            '030fb176a43f6cc3306c48123bbdeea6643ef4d0014f369b2bb16d5772feb076')
    
      29
    
      30build() {
    
      31  wrestool -x -t 3 -n 4 -R -o 'osu-stable.png' "${pkgname}-installer-${pkgver}.exe"
    
      32  wrestool -x -t 3 -n 15 -R -o 'osu-importable.png' "${pkgname}-installer-${pkgver}.exe"
    
      33}
    
      34
    
      35package() {
    
      36  install -D -m 755 "${pkgname}.sh" "${pkgdir}/usr/bin/osu-stable"
    
      37  install -D -m 644 "${pkgname}-installer-${pkgver}.exe" "${pkgdir}/usr/share/${pkgname}/osu-stable-installer.exe"
    
      38  install -D -m 644 "${pkgname}-terms-${_terms_commit}.md" "${pkgdir}/usr/share/licenses/${pkgname}/osu-terms.md"
    
      39  install -D -m 644 "${pkgname}.xml" "${pkgdir}/usr/share/mime/packages/osu-stable.xml"
    
      40  install -D -m 644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/sh.ppy.osu.stable.desktop"
    
      41  install -D -m 644 'osu-stable.png' "${pkgdir}/usr/share/icons/hicolor/256x256/apps/osu-stable.png"
    
      42  install -D -m 644 'osu-importable.png' "${pkgdir}/usr/share/icons/hicolor/256x256/mimetypes/application-x-osu-importable.png"
    
      43  # Add copyright notice as a text file
    
      44  install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      45  echo "https://osu.ppy.sh/legal/en/Copyright" >"${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      46}
    
      47# vim:set ts=2 sw=2 et:
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -6,7 +6,7 @@
 # https://github.com/ppy/osu is only for lazer, use the osu-lazer AUR package instead
 
 pkgname='osu'
-pkgver=20260517
+pkgver=20260811
 pkgrel=1
 pkgdesc='A free-to-win rhythm game'
 _terms_commit='b8a98fb740ed8251958f16d719138e96afa6e299'
@@ -21,7 +21,7 @@
   "${pkgname}.sh"
   "${pkgname}.desktop"
   "${pkgname}.xml")
-sha256sums=('c7b77c2f6fc458521114e06c197749601651e1bd4feebe503f457232702b16ab'
+sha256sums=('6e182c10d1813209d12753dbc70b3a5bba00fef4ecf64bc42051870e6dfe4b7d'
             '0fc6b18923db85b82fa5da1cb40ccc8c0ffcaf65ee7e325af8969baa150a9fd2'
             'c96c4dc32356784f6100b201ec74d8f71b6959019624619177fb67790c7a8b2d'
             '3d98f5811539d652bf6378c2c76bff7b6d5ac82e6322942bb287ff9082f1715b'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 17:21:34	MEDIUM	1
2026-06-20 16:03:41	CLEAN	2
2026-06-20 00:50:07	MEDIUM	2
2026-06-20 00:18:46	MEDIUM	2
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	LOW	2
2026-06-18 16:11:54	MEDIUM	1