playdate-mirror
LOW
maintainer zekesonxx
2 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from the official vendor's CDN (panic.com), which is a standard practice for proprietary software; the host is not whitelisted but is plausibly official, and the checksum is verified, making this a low-risk, normal AUR package.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official vendor's CDN (panic.com), which is a standard practice for proprietary software; the host is not whitelisted but is plausibly official, and the checksum is verified, making this a low-risk, normal AUR package.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:41
"https://download-cdn.panic.com/mirror/Linux/Mirror-${pkgver}.x86_64.deb"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Zoey Mertes (zmertes at zmertes dot net)
2
# shellcheck shell=bash disable=SC2034,SC2154
3
4
# release 1.4.0 notes
5
# * yay updated webkit2gtk, thanks for responding to my email panic <3
6
# * panic keeps changing the deb name capitalization
7
# release 1.2.0 notes
8
# * fresh binary and gamecontrollerdb.txt
9
# release 1.1.0 notes
10
# * yay finally a proper packaging, no more nabbing it out of the macos version
11
# * yay svg icon!
12
# * for some reason they think their app binary being `mirror` is okay, we're moving it back to `PlaydateMirror`
13
# * the /usr/share/doc/mirror/README.md contains nothing of value, so we don't package it
14
# * they put the udev rule in /etc instead of /usr/lib, so we move it to the right spot
15
# * though, their udev rule is wayyyy too broad, so we're using our own
16
# * the app always tries to read gamecontrollerdb.txt from /usr/share/mirror/gamecontrollerdb.txt, so we're stuck putting the file there
17
# (sorta felt like a wrapper env var script for that might be overkill)
18
19
# side note: are the playdate devs reading my pkgbuilds? because they did nearly every change I did in my original pkgbuild
20
# if so, can you make the binary named PlaydateMirror from the beginning pretty please? thanks <3
21
22
pkgname=playdate-mirror
23
pkgver=1.4.0
24
pkgrel=1
25
pkgdesc='Screen viewer and controller for the Playdate console'
26
arch=('x86_64')
27
url='https://play.date/mirror/'
28
license=('custom:proprietary')
29
depends=(
30
'gtk3'
31
'webkit2gtk-4.1'
32
)
33
makedepends=()
34
optdepends=()
35
options=()
36
37
source=(
38
# Panic is inconsistent about the package filename, sometimes it's Mirror sometimes it's mirror
39
# With 1.3.0 they changed it after release from mirror to Mirror
40
# if in doubt check the file listing here: https://download-cdn.panic.com/mirror/Linux/
41
"https://download-cdn.panic.com/mirror/Linux/Mirror-${pkgver}.x86_64.deb"
42
"50-playdate-mirror.rules"
43
)
44
45
sha512sums=('098630f1cf11d69274eb653c536afeabc4b649a6c5ffa6e41665d8b763cd4c5b10dbbff49ee086038e27c114d4b02e3c192006ab99ef64aa61d3269fc01eea43'
46
'84d348266722753a81bdf95e17917f4c4665c484fdb3ac258b0f46d5e3e92c62aff0df91b78c0e1d43ace9f2e15f3a9a6a24726a37302ddbf40499f5ca60864c')
47
48
build() {
49
echo >&2 "Extracting the deb"
50
cd "${srcdir}" || exit 2
51
tar xvf "${srcdir}/data.tar.zst"
52
53
echo >&2 "Patching the desktop file"
54
sed -i -e 's|/usr/bin/mirror|/usr/bin/PlaydateMirror|' \
55
-e 's/Name=Mirror/Name=Playdate Mirror/' \
56
./usr/share/applications/date.play.mirror.desktop
57
}
58
59
package() {
60
echo >&2 'Packaging the mirror binary'
61
install -D -m 755 "${srcdir}/usr/bin/mirror" "${pkgdir}/usr/bin/PlaydateMirror"
62
63
echo >&2 'Packaging the mirror assets'
64
mkdir -p "${pkgdir}/usr/share/"
65
cp -vr "${srcdir}/usr/share/mirror" "${pkgdir}/usr/share/mirror"
66
67
echo >&2 'Packaging the license'
68
install -D -m 644 "${srcdir}/usr/share/doc/mirror/LICENSE.md" "${pkgdir}/usr/share/licenses/playdate-mirror/LICENSE.md"
69
70
echo >&2 'Packaging the icon svg'
71
install -D -m 644 -T \
72
"${srcdir}/usr/share/icons/hicolor/scalable/apps/date.play.mirror.svg" \
73
"${pkgdir}/usr/share/icons/hicolor/scalable/apps/date.play.mirror.svg"
74
75
echo >&2 'Packaging the udev rule'
76
install -D -m 644 -T \
77
"${srcdir}/50-playdate-mirror.rules" \
78
"${pkgdir}/usr/lib/udev/rules.d/50-playdate-mirror.rules"
79
80
echo >&2 'Packaging the desktop file'
81
install -D -m 755 -T \
82
"${srcdir}/usr/share/applications/date.play.mirror.desktop" \
83
"${pkgdir}/usr/share/applications/${pkgname}.desktop"
84
85
}
86
87
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |