overte-server-bin
MEDIUM
maintainer robertfoster
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb binary from a non-whitelisted host (DigitalOcean Spaces) which is not the project's official release infrastructure, posing a supply-chain risk if the host were compromised or the binary swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
source_x86_64=("https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${_date}/overte-server_${_date}-${_hash}-debian-13-1_amd64.deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted host (DigitalOcean Spaces) which is not the project's official release infrastructure, posing a supply-chain risk if the host were compromised or the binary swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: robertfoster
2
3
pkgname=overte-server-bin
4
_date=2026.10.1 # renovate: datasource=github-releases depName=overte-org/overte
5
# Build hash is part of the package name and can't be derived from the tag; a Renovate
6
# bump of _date will fail updpkgsums until this is updated by hand.
7
_hash=9c51bae
8
pkgver="${_date}.${_hash}"
9
pkgrel=1
10
pkgdesc="Overte platform, based on the High Fidelity Engine (server)"
11
arch=('aarch64' 'x86_64')
12
url="https://overte.org"
13
license=('Apache-2.0')
14
depends=(
15
'libglvnd'
16
'libstdc++5'
17
'mesa'
18
'openssl'
19
'qt5-base'
20
'qt5-declarative'
21
'qt5-websockets'
22
)
23
provides=('overte' 'overte-server')
24
conflicts=('overte' 'overte-server')
25
source=(
26
'overte.sysusers'
27
'overte.tmpfiles'
28
)
29
source_x86_64=("https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${_date}/overte-server_${_date}-${_hash}-debian-13-1_amd64.deb")
30
source_aarch64=("https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${_date}/overte-server_${_date}-${_hash}-debian-13-1_arm64.deb")
31
noextract=("overte-server_${_date}-${_hash}-debian-13-1_"{amd64,arm64}.deb)
32
33
package() {
34
cd "${srcdir}"
35
bsdtar -xf overte-server_*.deb data.tar.xz
36
bsdtar -xf data.tar.xz -C "${pkgdir}" --no-same-owner ./opt ./usr
37
mkdir -p "${pkgdir}/etc/opt/overte"
38
39
install -D -m644 "${srcdir}/overte.sysusers" \
40
"${pkgdir}/usr/lib/sysusers.d/overte.conf"
41
install -D -m644 "${srcdir}/overte.tmpfiles" \
42
"${pkgdir}/usr/lib/tmpfiles.d/overte.conf"
43
}
44
45
sha256sums=('503dfd4562efdbb01f5e714a89d9b23a675e32f9733552532750393be85ca0e3'
46
'83b66df9d94878ca1de31e85a48e905501a7db202bee9950e6c2ab32b85b1461')
47
sha256sums_aarch64=('71b6ffb2290ba018df29412b29935b43373bce9b4d09f089903d5a92f50dea8d')
48
sha256sums_x86_64=('05c43ceb2160306142bac3eeedc243c0f1ca506033a26e256863b7fbf871af5b')
49
Changes since previous scan
--- PKGBUILD @ 2026-10-26 00:12+++ PKGBUILD @ 2026-11-01 00:21@@ -1,8 +1,11 @@ # Maintainer: robertfoster pkgname=overte-server-bin-_date=2025.05.1-pkgver="${_date}.53d2094"+_date=2026.10.1 # renovate: datasource=github-releases depName=overte-org/overte+# Build hash is part of the package name and can't be derived from the tag; a Renovate+# bump of _date will fail updpkgsums until this is updated by hand.+_hash=9c51bae+pkgver="${_date}.${_hash}" pkgrel=1 pkgdesc="Overte platform, based on the High Fidelity Engine (server)" arch=('aarch64' 'x86_64')@@ -17,20 +20,20 @@ 'qt5-declarative' 'qt5-websockets' )-makedepends=('rpmextract') provides=('overte' 'overte-server') conflicts=('overte' 'overte-server') source=( 'overte.sysusers' 'overte.tmpfiles' )-source_x86_64=("https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${_date}/overte-server-${pkgver}-1.fc41.x86_64.rpm")-source_aarch64=("https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${_date}/overte-server-${pkgver}-1.fc41.aarch64.rpm")+source_x86_64=("https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${_date}/overte-server_${_date}-${_hash}-debian-13-1_amd64.deb")+source_aarch64=("https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${_date}/overte-server_${_date}-${_hash}-debian-13-1_arm64.deb")+noextract=("overte-server_${_date}-${_hash}-debian-13-1_"{amd64,arm64}.deb) package() { cd "${srcdir}"- cp -rv opt usr "${pkgdir}"- rm -rf "${pkgdir}/usr/lib/.build-id"+ bsdtar -xf overte-server_*.deb data.tar.xz+ bsdtar -xf data.tar.xz -C "${pkgdir}" --no-same-owner ./opt ./usr mkdir -p "${pkgdir}/etc/opt/overte" install -D -m644 "${srcdir}/overte.sysusers" \@@ -41,6 +44,6 @@ sha256sums=('503dfd4562efdbb01f5e714a89d9b23a675e32f9733552532750393be85ca0e3' '83b66df9d94878ca1de31e85a48e905501a7db202bee9950e6c2ab32b85b1461')-sha256sums_aarch64=('f24cad2dcfae85ebc826493cceb41dd9d59ce1a8db6770e1c1893905f057c0b9')-sha256sums_x86_64=('84d5637a5531878ad4f99a99a6616f0698ea9b2b8c53f2880fbf9cde594d18a9')+sha256sums_aarch64=('71b6ffb2290ba018df29412b29935b43373bce9b4d09f089903d5a92f50dea8d')+sha256sums_x86_64=('05c43ceb2160306142bac3eeedc243c0f1ca506033a26e256863b7fbf871af5b') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 15:45:54 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |