playkey-linux

maintainer vilko · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows installer (PlaykeySetup.exe) from static.playkey.net, which is the official CDN for the playkey.net game-streaming service. The URL uses an ASP.NET query-string redirect pattern common for vendor download portals. The sha256sum is pinned (d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451), which provides integrity verification at build time. The extracted Windows binaries are then run under Wine at runtime. The second source is a GitHub repo with SKIP checksum, which is a minor concern but the repo belongs to the listed maintainer. The main risk is that static.playkey.net is not a widely-known, independently-auditable host, and the package installs and executes proprietary prebuilt binaries (both the extracted Windows EXE contents and the launcher scripts). However, the pinned hash mitigates the supply-chain substitution risk significantly. This is a legitimate but non-ideal packaging pattern — prebuilt proprietary binaries from a vendor CDN with a pinned checksum — which warrants medium rather than clean, but is not a high-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 'https://static.playkey.net/clientdownload.aspx?file=windows-desktop/Release/PlaykeySetup.exe&name=PlaykeySetup.exe'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows installer (PlaykeySetup.exe) from static.playkey.net, which is the official CDN for the playkey.net game-streaming service. The URL uses an ASP.NET query-string redirect pattern common for vendor download portals. The sha256sum is pinned (d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451), which provides integrity verification at build time. The extracted Windows binaries are then run under Wine at runtime. The second source is a GitHub repo with SKIP checksum, which is a minor concern but the repo belongs to the listed maintainer. The main risk is that static.playkey.net is not a widely-known, independently-auditable host, and the package installs and executes proprietary prebuilt binaries (both the extracted Windows EXE contents and the launcher scripts). However, the pinned hash mitigates the supply-chain substitution risk significantly. This is a legitimate but non-ideal packaging pattern — prebuilt proprietary binaries from a vendor CDN with a pinned checksum — which warrants medium rather than clean, but is not a high-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vitalii Rybalko <vilko dot a at gmail dot com>
    
      2# Maintainer: Pasha Finkelshteyn <pavel.finkelshtein+AUR@gmail.com>
    
      3
    
      4pkgname=playkey-linux
    
      5pkgver=1.10
    
      6pkgrel=4
    
      7pkgdesc='Client for game streaming service playkey.net'
    
      8arch=('x86_64')
    
      9url='https://www.playkey.net'
    
      10license=('custom')
    
      11options=('!strip')
    
      12provides=('playkey-linux')
    
      13conflicts=()
    
      14depends=(
    
      15	'chromium'
    
      16	'wine'
    
      17	'python3'
    
      18	'winetricks'
    
      19	'openal'
    
      20	'lib32-openal'
    
      21)
    
      22makedepends=(
    
      23	'git'
    
      24	'innoextract'
    
      25)
    
      26install=
    
      27source_x86_64=(
    
      28	'https://static.playkey.net/clientdownload.aspx?file=windows-desktop/Release/PlaykeySetup.exe&name=PlaykeySetup.exe'
    
      29	'git+https://github.com/vilkoz/playkey-linux-launcher.git'
    
      30)
    
      31sha256sums_x86_64=('d53f9a016635f5c72e8fae86023a4e612f94c8399ee27df7c013c7dc043ad451'
    
      32'SKIP')
    
      33
    
      34prepare() {
    
      35	msg2 'Extracting PlaykeySetup.exe'
    
      36	innoextract 'PlaykeySetup.exe&name=PlaykeySetup.exe'
    
      37}
    
      38
    
      39package() {
    
      40	msg2 'Creating installation folder'
    
      41	install -d -m755 $pkgdir/usr/share/playkey-linux
    
      42
    
      43	msg2 'Copying windows binaries'
    
      44	cp -ra app/* $pkgdir/usr/share/playkey-linux
    
      45	find $pkgdir/usr/share/playkey-linux -type d -exec chmod 755 "{}" \;
    
      46	find $pkgdir/usr/share/playkey-linux -type f -exec chmod 644 "{}" \;
    
      47
    
      48	msg2 'Copying playkey-linux-launcher scripts'
    
      49	install playkey-linux-launcher/xdg-open $pkgdir/usr/share/playkey-linux
    
      50	install -d -m755 $pkgdir/usr/bin
    
      51	install -m755 playkey-linux-launcher/playkey-linux $pkgdir/usr/bin
    
      52
    
      53	msg2 'Copying playkey-linux-launcher chrome user-agent extension'
    
      54	install -d -m755 $pkgdir/usr/share/playkey-linux/extension
    
      55	cp -ra playkey-linux-launcher/extension/* $pkgdir/usr/share/playkey-linux/extension/
    
      56	find $pkgdir/usr/share/playkey-linux/extension/ -type f -exec chmod 644 "{}" \;
    
      57}
    
      58
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2