osu

LOW

maintainer R0dn3yS 67 votes scanned 2026-10-03 00:23:04.761738

View on AUR

Why flagged

The package downloads the official osu! installer from ppy's own domain (m1.ppy.sh) and a terms file from GitHub; both are verifiable sources, and the installer is installed as data without being executed during build.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official osu! installer from ppy's own domain (m1.ppy.sh) and a terms file from GitHub; both are verifiable sources, and the installer is installed as data without being executed during build.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("${pkgname}-installer-${pkgver}.exe::https://m1.ppy.sh/r/osu!install.exe"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: envolution
    
      2# Contributor: fossdd <fossdd@pwned.life>
    
      3# Contributor: Rodney van den Velden <rodney@dfagaming.nl>
    
      4# shellcheck shell=bash disable=SC2034,SC2154
    
      5#
    
      6# https://github.com/ppy/osu is only for lazer, use the osu-lazer AUR package instead
    
      7
    
      8pkgname='osu'
    
      9pkgver=20260811
    
      10pkgrel=1
    
      11pkgdesc='A free-to-win rhythm game'
    
      12_terms_commit='b8a98fb740ed8251958f16d719138e96afa6e299'
    
      13arch=('i686' 'x86_64')
    
      14url='https://osu.ppy.sh'
    
      15license=('LicenseRef-custom')
    
      16depends=('lib32-gnutls' 'umu-launcher' 'lib32-libxcomposite' 'lib32-gst-plugins-base-libs')
    
      17makedepends=('icoutils')
    
      18optdepends=('pipewire-pulse: low-latency audio backend')
    
      19source=("${pkgname}-installer-${pkgver}.exe::https://m1.ppy.sh/r/osu!install.exe"
    
      20  "${pkgname}-terms-${_terms_commit}.md::https://raw.githubusercontent.com/ppy/osu-wiki/${_terms_commit}/wiki/Legal/Terms/en.md"
    
      21  "${pkgname}.sh"
    
      22  "${pkgname}.desktop"
    
      23  "${pkgname}.xml")
    
      24sha256sums=('6e182c10d1813209d12753dbc70b3a5bba00fef4ecf64bc42051870e6dfe4b7d'
    
      25            '0fc6b18923db85b82fa5da1cb40ccc8c0ffcaf65ee7e325af8969baa150a9fd2'
    
      26            'c96c4dc32356784f6100b201ec74d8f71b6959019624619177fb67790c7a8b2d'
    
      27            '3d98f5811539d652bf6378c2c76bff7b6d5ac82e6322942bb287ff9082f1715b'
    
      28            '030fb176a43f6cc3306c48123bbdeea6643ef4d0014f369b2bb16d5772feb076')
    
      29
    
      30build() {
    
      31  wrestool -x -t 3 -n 4 -R -o 'osu-stable.png' "${pkgname}-installer-${pkgver}.exe"
    
      32  wrestool -x -t 3 -n 15 -R -o 'osu-importable.png' "${pkgname}-installer-${pkgver}.exe"
    
      33}
    
      34
    
      35package() {
    
      36  install -D -m 755 "${pkgname}.sh" "${pkgdir}/usr/bin/osu-stable"
    
      37  install -D -m 644 "${pkgname}-installer-${pkgver}.exe" "${pkgdir}/usr/share/${pkgname}/osu-stable-installer.exe"
    
      38  install -D -m 644 "${pkgname}-terms-${_terms_commit}.md" "${pkgdir}/usr/share/licenses/${pkgname}/osu-terms.md"
    
      39  install -D -m 644 "${pkgname}.xml" "${pkgdir}/usr/share/mime/packages/osu-stable.xml"
    
      40  install -D -m 644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/sh.ppy.osu.stable.desktop"
    
      41  install -D -m 644 'osu-stable.png' "${pkgdir}/usr/share/icons/hicolor/256x256/apps/osu-stable.png"
    
      42  install -D -m 644 'osu-importable.png' "${pkgdir}/usr/share/icons/hicolor/256x256/mimetypes/application-x-osu-importable.png"
    
      43  # Add copyright notice as a text file
    
      44  install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      45  echo "https://osu.ppy.sh/legal/en/Copyright" >"${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      46}
    
      47# vim:set ts=2 sw=2 et:
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2