playkey-linux

MEDIUM

maintainer vilko 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt Windows installer (PlaykeySetup.exe) from static.playkey.net, which is the official CDN for the playkey.net game-streaming service. The URL uses an ASP.NET query-string redirect pattern common for vendor download portals. The sha256sum is pinned (d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451), which provides integrity verification at build time. The extracted Windows binaries are then run under Wine at runtime. The second source is a GitHub repo with SKIP checksum, which is a minor concern but the repo belongs to the listed maintainer. The main risk is that static.playkey.net is not a widely-known, independently-auditable host, and the package installs and executes proprietary prebuilt binaries (both the extracted Windows EXE contents and the launcher scripts). However, the pinned hash mitigates the supply-chain substitution risk significantly. This is a legitimate but non-ideal packaging pattern — prebuilt proprietary binaries from a vendor CDN with a pinned checksum — which warrants medium rather than clean, but is not a high-severity concern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 'https://static.playkey.net/clientdownload.aspx?file=windows-desktop/Release/PlaykeySetup.exe&name=PlaykeySetup.exe'

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows installer (PlaykeySetup.exe) from static.playkey.net, which is the official CDN for the playkey.net game-streaming service. The URL uses an ASP.NET query-string redirect pattern common for vendor download portals. The sha256sum is pinned (d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451), which provides integrity verification at build time. The extracted Windows binaries are then run under Wine at runtime. The second source is a GitHub repo with SKIP checksum, which is a minor concern but the repo belongs to the listed maintainer. The main risk is that static.playkey.net is not a widely-known, independently-auditable host, and the package installs and executes proprietary prebuilt binaries (both the extracted Windows EXE contents and the launcher scripts). However, the pinned hash mitigates the supply-chain substitution risk significantly. This is a legitimate but non-ideal packaging pattern — prebuilt proprietary binaries from a vendor CDN with a pinned checksum — which warrants medium rather than clean, but is not a high-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vitalii Rybalko <vilko dot a at gmail dot com>
    
      2# Maintainer: Pasha Finkelshteyn <pavel.finkelshtein+AUR@gmail.com>
    
      3
    
      4pkgname=playkey-linux
    
      5pkgver=1.10
    
      6pkgrel=4
    
      7pkgdesc='Client for game streaming service playkey.net'
    
      8arch=('x86_64')
    
      9url='https://www.playkey.net'
    
      10license=('custom')
    
      11options=('!strip')
    
      12provides=('playkey-linux')
    
      13conflicts=()
    
      14depends=(
    
      15	'chromium'
    
      16	'wine'
    
      17	'python3'
    
      18	'winetricks'
    
      19	'openal'
    
      20	'lib32-openal'
    
      21)
    
      22makedepends=(
    
      23	'git'
    
      24	'innoextract'
    
      25)
    
      26install=
    
      27source_x86_64=(
    
      28	'https://static.playkey.net/clientdownload.aspx?file=windows-desktop/Release/PlaykeySetup.exe&name=PlaykeySetup.exe'
    
      29	'git+https://github.com/vilkoz/playkey-linux-launcher.git'
    
      30)
    
      31sha256sums_x86_64=('d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451'
    
      32'SKIP')
    
      33
    
      34prepare() {
    
      35	msg2 'Extracting PlaykeySetup.exe'
    
      36	innoextract 'PlaykeySetup.exe&name=PlaykeySetup.exe'
    
      37}
    
      38
    
      39package() {
    
      40	msg2 'Creating installation folder'
    
      41	install -d -m755 $pkgdir/usr/share/playkey-linux
    
      42
    
      43	msg2 'Copying windows binaries'
    
      44	cp -ra app/* $pkgdir/usr/share/playkey-linux
    
      45	find $pkgdir/usr/share/playkey-linux -type d -exec chmod 755 "{}" \;
    
      46	find $pkgdir/usr/share/playkey-linux -type f -exec chmod 644 "{}" \;
    
      47
    
      48	msg2 'Copying playkey-linux-launcher scripts'
    
      49	install playkey-linux-launcher/xdg-open $pkgdir/usr/share/playkey-linux
    
      50	install -d -m755 $pkgdir/usr/bin
    
      51	install -m755 playkey-linux-launcher/playkey-linux $pkgdir/usr/bin
    
      52
    
      53	msg2 'Copying playkey-linux-launcher chrome user-agent extension'
    
      54	install -d -m755 $pkgdir/usr/share/playkey-linux/extension
    
      55	cp -ra playkey-linux-launcher/extension/* $pkgdir/usr/share/playkey-linux/extension/
    
      56	find $pkgdir/usr/share/playkey-linux/extension/ -type f -exec chmod 644 "{}" \;
    
      57}
    
      58
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2