playkey-linux

MEDIUM

maintainer vilko 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt Windows installer (PlaykeySetup.exe) from static.playkey.net, which is the official CDN for the playkey.net game-streaming service. The URL uses an ASP.NET query-string redirect pattern common for vendor download portals. The sha256sum is pinned (d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451), which provides integrity verification at build time. The extracted Windows binaries are then run under Wine at runtime. The second source is a GitHub repo with SKIP checksum, which is a minor concern but the repo belongs to the listed maintainer. The main risk is that static.playkey.net is not a widely-known, independently-auditable host, and the package installs and executes proprietary prebuilt binaries (both the extracted Windows EXE contents and the launcher scripts). However, the pinned hash mitigates the supply-chain substitution risk significantly. This is a legitimate but non-ideal packaging pattern — prebuilt proprietary binaries from a vendor CDN with a pinned checksum — which warrants medium rather than clean, but is not a high-severity concern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 'https://static.playkey.net/clientdownload.aspx?file=windows-desktop/Release/PlaykeySetup.exe&name=PlaykeySetup.exe'

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows installer (PlaykeySetup.exe) from static.playkey.net, which is the official CDN for the playkey.net game-streaming service. The URL uses an ASP.NET query-string redirect pattern common for vendor download portals. The sha256sum is pinned (d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451), which provides integrity verification at build time. The extracted Windows binaries are then run under Wine at runtime. The second source is a GitHub repo with SKIP checksum, which is a minor concern but the repo belongs to the listed maintainer. The main risk is that static.playkey.net is not a widely-known, independently-auditable host, and the package installs and executes proprietary prebuilt binaries (both the extracted Windows EXE contents and the launcher scripts). However, the pinned hash mitigates the supply-chain substitution risk significantly. This is a legitimate but non-ideal packaging pattern — prebuilt proprietary binaries from a vendor CDN with a pinned checksum — which warrants medium rather than clean, but is not a high-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vitalii Rybalko <vilko dot a at gmail dot com>
    
      2# Maintainer: Pasha Finkelshteyn <pavel.finkelshtein+AUR@gmail.com>
    
      3
    
      4pkgname=playkey-linux
    
      5pkgver=1.10
    
      6pkgrel=4
    
      7pkgdesc='Client for game streaming service playkey.net'
    
      8arch=('x86_64')
    
      9url='https://www.playkey.net'
    
      10license=('custom')
    
      11options=('!strip')
    
      12provides=('playkey-linux')
    
      13conflicts=()
    
      14depends=(
    
      15	'chromium'
    
      16	'wine'
    
      17	'python3'
    
      18	'winetricks'
    
      19	'openal'
    
      20	'lib32-openal'
    
      21)
    
      22makedepends=(
    
      23	'git'
    
      24	'innoextract'
    
      25)
    
      26install=
    
      27source_x86_64=(
    
      28	'https://static.playkey.net/clientdownload.aspx?file=windows-desktop/Release/PlaykeySetup.exe&name=PlaykeySetup.exe'
    
      29	'git+https://github.com/vilkoz/playkey-linux-launcher.git'
    
      30)
    
      31sha256sums_x86_64=('d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451'
    
      32'SKIP')
    
      33
    
      34prepare() {
    
      35	msg2 'Extracting PlaykeySetup.exe'
    
      36	innoextract 'PlaykeySetup.exe&name=PlaykeySetup.exe'
    
      37}
    
      38
    
      39package() {
    
      40	msg2 'Creating installation folder'
    
      41	install -d -m755 $pkgdir/usr/share/playkey-linux
    
      42
    
      43	msg2 'Copying windows binaries'
    
      44	cp -ra app/* $pkgdir/usr/share/playkey-linux
    
      45	find $pkgdir/usr/share/playkey-linux -type d -exec chmod 755 "{}" \;
    
      46	find $pkgdir/usr/share/playkey-linux -type f -exec chmod 644 "{}" \;
    
      47
    
      48	msg2 'Copying playkey-linux-launcher scripts'
    
      49	install playkey-linux-launcher/xdg-open $pkgdir/usr/share/playkey-linux
    
      50	install -d -m755 $pkgdir/usr/bin
    
      51	install -m755 playkey-linux-launcher/playkey-linux $pkgdir/usr/bin
    
      52
    
      53	msg2 'Copying playkey-linux-launcher chrome user-agent extension'
    
      54	install -d -m755 $pkgdir/usr/share/playkey-linux/extension
    
      55	cp -ra playkey-linux-launcher/extension/* $pkgdir/usr/share/playkey-linux/extension/
    
      56	find $pkgdir/usr/share/playkey-linux/extension/ -type f -exec chmod 644 "{}" \;
    
      57}
    
      58
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2