project-sushi

maintainer ThePirate42 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt Windows executable (ProjectSushi_a1.2.4.exe) from Patreon's file hosting, which is an unofficial/personal content host rather than a canonical software distribution channel. The binary is then installed and run via Wine. While sha256sums are present (providing integrity verification against the specific file at time of packaging), Patreon file links can be replaced by the uploader at any time without changing the URL, making the checksum the only protection. The executable itself is a closed-source binary from an unknown/unverifiable source. This is a genuine medium-severity supply-chain concern: a prebuilt executable from a non-canonical personal host that is executed (via Wine) on the user's system. The license is listed as 'unknown', which is also a concern but not a security issue. This is not clearly malicious, but the combination of an opaque binary from a personal Patreon host with no source code availability represents a real supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("$pkgname-$pkgver.zip::https://www.patreon.com/file?h=33983587&i=5219261" "$pkgname.desktop" "$pkgname")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Windows executable (ProjectSushi_a1.2.4.exe) from Patreon's file hosting, which is an unofficial/personal content host rather than a canonical software distribution channel. The binary is then installed and run via Wine. While sha256sums are present (providing integrity verification against the specific file at time of packaging), Patreon file links can be replaced by the uploader at any time without changing the URL, making the checksum the only protection. The executable itself is a closed-source binary from an unknown/unverifiable source. This is a genuine medium-severity supply-chain concern: a prebuilt executable from a non-canonical personal host that is executed (via Wine) on the user's system. The license is listed as 'unknown', which is also a concern but not a security issue. This is not clearly malicious, but the combination of an opaque binary from a personal Patreon host with no source code availability represents a real supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ThePirate42 <aur@thepirate42.org>
    
      2
    
      3pkgname=project-sushi
    
      4pkgver=a1.2.4
    
      5pkgrel=2
    
      6pkgdesc="A short but challenging 2D platformer game"
    
      7arch=('i686' 'x86_64')
    
      8url="https://www.patreon.com/posts/33983587"
    
      9license=('unknown')
    
      10depends=('wine' 'sh' 'hicolor-icon-theme')
    
      11makedepends=('icoutils')
    
      12options=('!strip')
    
      13source=("$pkgname-$pkgver.zip::https://www.patreon.com/file?h=33983587&i=5219261" "$pkgname.desktop" "$pkgname")
    
      14sha256sums=('25130969828988141c1da20dbe92322216c6c918c90a8105156592a435ddec8d'
    
      15            '24b3f56c0ec3205278f0d34250258aae4f9e9349a0105a8c20411efe397defe1'
    
      16            '78f7e9e4cb1e2358e058414baf06bf78a5027cbdd42b357dabc80d5a2c023090')
    
      17
    
      18prepare() {
    
      19
    
      20	wrestool -x --output="$srcdir"/$pkgname.ico -t14 "$srcdir"/ProjectSushi_$pkgver.exe
    
      21	icotool -x --output="$srcdir" "$srcdir"/$pkgname.ico
    
      22
    
      23}
    
      24
    
      25package() {
    
      26
    
      27	install -d -m755 "$pkgdir/opt/$pkgname"
    
      28	install -m644 "$srcdir/"{data.win,options.ini} "$pkgdir/opt/$pkgname"
    
      29	install -m644 "$srcdir/ProjectSushi_$pkgver.exe" "$pkgdir/opt/$pkgname/$pkgname.exe"
    
      30
    
      31	install -d -m755 "$pkgdir/usr/share/applications"
    
      32	install -m644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications"
    
      33
    
      34	install -d -m755 "$pkgdir/usr/share/icons/hicolor/"{16x16,24x24,32x32,48x48,128x128}"/apps"
    
      35	install -m644 "$srcdir/${pkgname}_1_16x16x32.png" "$pkgdir/usr/share/icons/hicolor/16x16/apps/$pkgname.png"
    
      36	install -m644 "$srcdir/${pkgname}_2_24x24x32.png" "$pkgdir/usr/share/icons/hicolor/24x24/apps/$pkgname.png"
    
      37	install -m644 "$srcdir/${pkgname}_3_32x32x32.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/$pkgname.png"
    
      38	install -m644 "$srcdir/${pkgname}_4_48x48x32.png" "$pkgdir/usr/share/icons/hicolor/48x48/apps/$pkgname.png"
    
      39	install -m644 "$srcdir/${pkgname}_5_128x128x32.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/$pkgname.png"
    
      40
    
      41	install -d -m755 "$pkgdir/usr/bin"
    
      42	install -m755 "$srcdir/$pkgname" "$pkgdir/usr/bin"
    
      43
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2