riichi-city

maintainer martoko · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 binary from a CloudFront CDN URL (d3qgi0t347dz44.cloudfront.net) rather than from the official project domain (mahjong-jp.com). While CloudFront is commonly used by vendors to distribute binaries, this specific distribution URL is not verifiable as the official upstream release host from the project's website, making it a non-standard host for a directly executed binary. The binary is chmod +x'd and symlinked into /usr/bin, meaning it runs with full user privileges. The sha256sum provides integrity checking against tampering in transit, but does not protect against the upstream host serving a malicious binary. This is a genuine medium-severity supply-chain concern: a prebuilt game executable from an unverifiable CDN subdomain. It is not clearly malicious, but the risk is real if the CDN bucket or distribution were compromised or repurposed. The license is distributed as a PNG image rather than text, which is unusual but not a security issue.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(https://d3qgi0t347dz44.cloudfront.net/release/linuxpack/default_prod_Linux_$pkgver.zip
PKGBUILD:12 https://www.mahjong-jp.com/static/img/common/termsofService_en.png)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 binary from a CloudFront CDN URL (d3qgi0t347dz44.cloudfront.net) rather than from the official project domain (mahjong-jp.com). While CloudFront is commonly used by vendors to distribute binaries, this specific distribution URL is not verifiable as the official upstream release host from the project's website, making it a non-standard host for a directly executed binary. The binary is chmod +x'd and symlinked into /usr/bin, meaning it runs with full user privileges. The sha256sum provides integrity checking against tampering in transit, but does not protect against the upstream host serving a malicious binary. This is a genuine medium-severity supply-chain concern: a prebuilt game executable from an unverifiable CDN subdomain. It is not clearly malicious, but the risk is real if the CDN bucket or distribution were compromised or repurposed. The license is distributed as a PNG image rather than text, which is unusual but not a security issue.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: martoko <mbastholm at gmail dot com>
    
      2
    
      3pkgname=riichi-city
    
      4pkgver=2.0.1
    
      5pkgrel=1
    
      6pkgdesc='Riichi City is a competitive urban-style Anime mahjong game.'
    
      7url='https://www.mahjong-jp.com'
    
      8license=('custom')
    
      9arch=('x86_64')
    
      10depends=('libsecret')
    
      11source=(https://d3qgi0t347dz44.cloudfront.net/release/linuxpack/default_prod_Linux_$pkgver.zip
    
      12        https://www.mahjong-jp.com/static/img/common/termsofService_en.png)
    
      13sha256sums=('c351f01fbb2ef2ec70d4cf29961155d25e27b2e59c89c2961bd298e3d61c02f2'
    
      14            '20983b5d5ed2dc4cfd6043f7f36eff2314be3e0e1664105fc2cb1301d2c3ddfd')
    
      15
    
      16package() {
    
      17	chmod +x "default_prod_Linux_$pkgver/Mahjong-JP.x86_64"
    
      18
    
      19	mkdir -p "$pkgdir/opt"
    
      20	cp -r "$srcdir/default_prod_Linux_$pkgver" "$pkgdir/opt/riichi-city"
    
      21	mkdir -p "$pkgdir/usr/bin"
    
      22	ln -s /opt/riichi-city/Mahjong-JP.x86_64 "$pkgdir/usr/bin/$pkgname"
    
      23
    
      24	install -Dm644 termsofService_en.png "$pkgdir/usr/share/licenses/$pkgname/LICENSE.png"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2