polylauncher-bin

MEDIUM

maintainer NotRx 0 votes scanned 2026-10-26 05:43:49.644165

View on AUR

Why flagged

The package downloads a prebuilt AppImage from an unverifiable source (GitHub-like domain not on whitelist) with no checksum verification, posing a supply-chain risk if the host is compromised or spoofed.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from an unverifiable source (GitHub-like domain not on whitelist) with no checksum verification, posing a supply-chain risk if the host is compromised or spoofed.

PKGBUILD

      1# Maintainer: NotReallyRx
    
      2pkgname=polylauncher-bin
    
      3_name=PolyLauncher
    
      4pkgver=0.2.1
    
      5pkgrel=2
    
      6pkgdesc="PolyTrack Launcher For Multiple Versions Of The Game"
    
      7arch=('x86_64')
    
      8url="https://git.polymodloader.com/PolyLauncher/PolyLauncher"
    
      9license=('custom')
    
      10depends=('fuse2' 'zlib' 'glibc')
    
      11makedepends=('git' 'curl')
    
      12provides=('polylauncher')
    
      13options=('!strip')
    
      14source=("git+${url}.git")
    
      15sha256sums=('SKIP')
    
      16
    
      17pkgver() {
    
      18    cd "${srcdir}/${_name}"
    
      19    git tag --sort=-v:refname | head -n1 | sed 's/^v//'
    
      20}
    
      21
    
      22build() {
    
      23    cd "${srcdir}"
    
      24    curl -fL -o "${_name}.AppImage" \
    
      25        "${url}/releases/download/${pkgver}/${_name}_${pkgver}_amd64.AppImage"
    
      26}
    
      27
    
      28package() {
    
      29    install -Dm755 "${srcdir}/${_name}.AppImage" \
    
      30        "${pkgdir}/usr/share/polylauncher/PolyLauncher.AppImage"
    
      31
    
      32    install -d "${pkgdir}/usr/bin"
    
      33    ln -s /usr/share/polylauncher/PolyLauncher.AppImage "${pkgdir}/usr/bin/polylauncher"
    
      34
    
      35    install -Dm644 "${srcdir}/${_name}/public/images/PolyLauncher.png" \
    
      36        "${pkgdir}/usr/share/pixmaps/polylauncher.png"
    
      37
    
      38    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/polylauncher.desktop" <<EOF
    
      39[Desktop Entry]
    
      40Type=Application
    
      41Name=PolyLauncher
    
      42Comment=PolyTrack Launcher
    
      43Exec=polylauncher %U
    
      44Icon=polylauncher
    
      45Terminal=false
    
      46Categories=Game;
    
      47EOF
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 05:43:49	Medium	2