polylauncher-git

MEDIUM

maintainer orphaned 0 votes scanned 2026-10-26 05:43:49.644165

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt AppImage from an unofficial release infrastructure not covered by the project's main Git repository, creating a supply-chain risk if the release host is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The PKGBUILD downloads a prebuilt AppImage from an unofficial release infrastructure not covered by the project's main Git repository, creating a supply-chain risk if the release host is compromised.

PKGBUILD

      1# Maintainer: NotReallyRx
    
      2pkgname=polylauncher-git
    
      3_name=PolyLauncher
    
      4pkgver=0.2.1
    
      5pkgrel=2
    
      6pkgdesc="PolyTrack Launcher"
    
      7arch=('x86_64')
    
      8url="https://git.polymodloader.com/PolyLauncher/PolyLauncher"
    
      9license=('custom')
    
      10depends=('fuse2' 'zlib' 'glibc')
    
      11makedepends=('git' 'curl')
    
      12provides=('polylauncher')
    
      13conflicts=('polylauncher' 'polylauncher-bin')
    
      14options=('!strip')
    
      15source=("git+${url}.git")
    
      16sha256sums=('SKIP')
    
      17
    
      18pkgver() {
    
      19    cd "${srcdir}/${_name}"
    
      20    git tag --sort=-v:refname | head -n1 | sed 's/^v//'
    
      21}
    
      22
    
      23build() {
    
      24    cd "${srcdir}"
    
      25    curl -fL -o "${_name}.AppImage" \
    
      26        "${url}/releases/download/${pkgver}/${_name}_${pkgver}_amd64.AppImage"
    
      27}
    
      28
    
      29package() {
    
      30    install -Dm755 "${srcdir}/${_name}.AppImage" \
    
      31        "${pkgdir}/usr/share/polylauncher/PolyLauncher.AppImage"
    
      32
    
      33    install -d "${pkgdir}/usr/bin"
    
      34    ln -s /usr/share/polylauncher/PolyLauncher.AppImage "${pkgdir}/usr/bin/polylauncher"
    
      35
    
      36    install -Dm644 "${srcdir}/${_name}/public/images/PolyLauncher.png" \
    
      37        "${pkgdir}/usr/share/pixmaps/polylauncher.png"
    
      38
    
      39    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/polylauncher.desktop" <<EOF
    
      40[Desktop Entry]
    
      41Type=Application
    
      42Name=PolyLauncher
    
      43Comment=PolyTrack Launcher
    
      44Exec=polylauncher %U
    
      45Icon=polylauncher
    
      46Terminal=false
    
      47Categories=Game;
    
      48EOF
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 05:43:49	Medium	2