portal-mc-commit-bin
MEDIUM
maintainer tiouo
0 votes
scanned 2026-10-03 00:23:04.761738
Why flagged
The package installs a prebuilt AppImage from a non-whitelisted host (GitHub release under a personal account), which is an unverifiable executable with SKIP'd checksums, posing a supply-chain risk if the source were compromised.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"portal.png::https://portal.tiouo.cc/portal-logo.png"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt AppImage from a non-whitelisted host (GitHub release under a personal account), which is an unverifiable executable with SKIP'd checksums, posing a supply-chain risk if the source were compromised.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: tiouoo <tiouo@qq.com>
2
3
pkgname=portal-mc-commit-bin
4
pkgver=0.79.14.46
5
pkgrel=1
6
pkgdesc="Portal - Minecraft launcher/manager (commit build, prerelease)"
7
arch=('x86_64')
8
url="https://portal.tiouo.cc/"
9
license=('GPL-3.0-or-later')
10
depends=('fuse2' 'hicolor-icon-theme' 'xdg-utils')
11
provides=("portal-mc=$pkgver")
12
conflicts=('portal-mc' 'portal-mc-cnb-bin' 'portal-mc-nightly-bin' 'portal-mc-bin')
13
options=('!strip' '!emptydirs')
14
_appimg="Portal-0.79.14.46.AppImage"
15
source_x86_64=(
16
"$_appimg::https://github.com/tiouoo/Portal/releases/download/publish-commit/Portal.linux.x64.AppImage"
17
"portal.png::https://portal.tiouo.cc/portal-logo.png"
18
)
19
sha256sums_x86_64=('SKIP' 'SKIP')
20
noextract=("$_appimg")
21
22
package() {
23
install -Dm755 "$srcdir/$_appimg" "$pkgdir/opt/portal/Portal.AppImage"
24
install -Dm755 /dev/stdin "$pkgdir/usr/bin/portal" <<'EOF'
25
#!/bin/sh
26
exec /opt/portal/Portal.AppImage "$@"
27
EOF
28
install -Dm644 "$srcdir/portal.png" \
29
"$pkgdir/usr/share/icons/hicolor/512x512/apps/portal.png"
30
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/portal.desktop" <<'EOF'
31
[Desktop Entry]
32
Type=Application
33
Name=Portal
34
Comment=Portal - Minecraft launcher/manager
35
Icon=portal
36
Exec=portal %U
37
Terminal=false
38
Categories=Game;
39
MimeType=x-scheme-handler/portal;application/zip;application/x-zip-compressed;
40
EOF
41
}
42
Changes since previous scan
--- PKGBUILD @ 2026-09-27 00:07+++ PKGBUILD @ 2026-10-03 00:23@@ -1,7 +1,7 @@ # Maintainer: tiouoo <tiouo@qq.com> pkgname=portal-mc-commit-bin-pkgver=0.76.20.11+pkgver=0.79.14.46 pkgrel=1 pkgdesc="Portal - Minecraft launcher/manager (commit build, prerelease)" arch=('x86_64')@@ -11,7 +11,7 @@ provides=("portal-mc=$pkgver") conflicts=('portal-mc' 'portal-mc-cnb-bin' 'portal-mc-nightly-bin' 'portal-mc-bin') options=('!strip' '!emptydirs')-_appimg="Portal-0.76.20.11.AppImage"+_appimg="Portal-0.79.14.46.AppImage" source_x86_64=( "$_appimg::https://github.com/tiouoo/Portal/releases/download/publish-commit/Portal.linux.x64.AppImage" "portal.png::https://portal.tiouo.cc/portal-logo.png"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-03 00:23:04 | Medium | 2 |
| 2026-10-02 00:00:32 | Medium | 2 |
| 2026-10-01 00:02:06 | Medium | 2 |
| 2026-09-30 00:20:07 | Medium | 2 |
| 2026-09-29 00:07:46 | Medium | 2 |
| 2026-09-28 00:28:32 | Medium | 2 |
| 2026-09-27 07:16:53 | Medium | 2 |
| 2026-09-27 00:07:07 | Medium | 2 |
| 2026-09-26 00:12:15 | Medium | 2 |
| 2026-09-25 00:03:36 | Medium | 2 |
| 2026-09-24 13:43:45 | Medium | 2 |
| 2026-09-24 00:24:14 | Medium | 2 |
| 2026-09-23 00:28:13 | Medium | 2 |
| 2026-09-22 00:15:14 | Medium | 2 |
| 2026-09-21 00:26:32 | Medium | 2 |
| 2026-09-20 00:25:31 | Medium | 2 |
| 2026-09-19 07:30:30 | Medium | 2 |
| 2026-09-19 05:30:22 | Medium | 2 |
| 2026-09-19 00:25:36 | Medium | 2 |
| 2026-09-18 17:28:51 | Medium | 2 |