puzsion

maintainer jose1711 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a ZIP archive from dl.openhandhelds.org, which is a known community archive/mirror site for open handheld gaming content (GP2X, Wiz, etc.), not a random personal host. The package installs a BennuGD game (a scripted game engine); the .dcb file is compiled BennuGD bytecode, not a native binary. The PKGBUILD actually compiles the .prg source via bgdc at install time and runs it via bgdi interpreter, so there is no arbitrary native code execution from the downloaded archive. The md5sum provides basic integrity checking. The non-standard host is a legitimate community archive for this niche platform, not a personal dropbox. The main concern is the non-HTTPS URL and the obscure host, but this is a low-risk game asset package, not an executed native binary from an untrusted source. Rating as low rather than medium.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The source is a ZIP archive from dl.openhandhelds.org, which is a known community archive/mirror site for open handheld gaming content (GP2X, Wiz, etc.), not a random personal host. The package installs a BennuGD game (a scripted game engine); the .dcb file is compiled BennuGD bytecode, not a native binary. The PKGBUILD actually compiles the .prg source via bgdc at install time and runs it via bgdi interpreter, so there is no arbitrary native code execution from the downloaded archive. The md5sum provides basic integrity checking. The non-standard host is a legitimate community archive for this niche platform, not a personal dropbox. The main concern is the non-HTTPS URL and the obscure host, but this is a low-risk game asset package, not an executed native binary from an untrusted source. Rating as low rather than medium.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("http://dl.openhandhelds.org/cgi-bin/wiz.cgi?0,1,2,0,25,350"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jose <jose1711 [at] gmail (dot) com>
    
      2
    
      3pkgname=puzsion
    
      4pkgver=1
    
      5pkgrel=4
    
      6pkgdesc="a little bejeweled-like game"
    
      7arch=('any')
    
      8url="http://www.gp32x.com/board/index.php?/topic/52332-wiz-bennugdgph-contest-winners/page__p__823581"
    
      9license=("custom:unknown")
    
      10install="puzsion.install"
    
      11#source=("http://betatester.bennugd.org/contest-2009-bennugd-wiz/Wiz/PUZSION%20(hokutoy).zip" "puzsion.desktop")
    
      12#source=("https://dl.dropboxusercontent.com/u/29095940/oss/PUZSION%2520(hokutoy).zip" "puzsion.desktop")
    
      13source=("http://dl.openhandhelds.org/cgi-bin/wiz.cgi?0,1,2,0,25,350"
    
      14        "puzsion.desktop")
    
      15md5sums=('3df808edaec385285609c1179ab03c4d'
    
      16         'dc1ce1453069244df465f6ee0bb51619')
    
      17depends=('bennugd-core' 'bennugd-modules')
    
      18
    
      19package() {
    
      20  mkdir -p $pkgdir/usr/{share/puzsion,bin}
    
      21  cd $srcdir/puzsion
    
      22  cp -r * $pkgdir/usr/share/puzsion
    
      23  find $pkgdir/usr/share/puzsion -type f \( -name 'puzsion.dcb' -o -name 'Thumbs.db' -o -name 'puzsion*gpe' \) -exec rm '{}' \;
    
      24  # fix file permissions (zip does not preserve those)
    
      25  find $pkgdir/usr/share/puzsion -type f -print0 | xargs -0 chmod 644
    
      26  echo "#!/bin/sh
    
      27cd /usr/share/puzsion
    
      28/usr/bin/bgdc puzsion.prg
    
      29/usr/bin/bgdi puzsion.dcb" > $pkgdir/usr/bin/puzsion
    
      30  chmod 755 $pkgdir/usr/bin/puzsion
    
      31  install -D -m644 $srcdir/puzsion/puzsion.png $pkgdir/usr/share/pixmaps/puzsion.png
    
      32  install -D -m644 $srcdir/puzsion.desktop $pkgdir/usr/share/applications/puzsion.desktop
    
      33  rm $srcdir/puzsion/puzsion.png
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2