runescape-launcher

maintainer cypriangula · 56 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a .deb and associated metadata from Jagex's official domain with PGP and SHA256 verification, building from the project's own release infrastructure, which is a normal and safe AUR practice despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a .deb and associated metadata from Jagex's official domain with PGP and SHA256 verification, building from the project's own release infrastructure, which is a normal and safe AUR practice despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:51 source=("${pkgname}_${pkgver}_Release::https://content.runescape.com/downloads/ubuntu/dists/trusty/Release"

PKGBUILD

1 offending line(s) highlighted

      1# Upstream: RuneScape Linux <noreply@jagex.com>
    
      2# Contributor: Ivan Puntiy <ivan.puntiy-at-gmail>
    
      3# Contributor: Mantas Mikulėnas <grawity@gmail.com>
    
      4
    
      5pkgname=runescape-launcher
    
      6pkgver=2.2.12
    
      7pkgrel=1
    
      8pkgdesc="RuneScape Game Client (NXT)"
    
      9arch=(x86_64)
    
      10license=(custom)
    
      11url="https://www.runescape.com/"
    
      12depends=(
    
      13    cairo       # libcairo2
    
      14        #libcairo.so=2
    
      15    libgcc      # libgcc1
    
      16    gdk-pixbuf2 # libgdk-pixbuf2.0-0
    
      17        #libgdk_pixbuf-2.0.so=0
    
      18    glib2       # libglib2.0-0
    
      19        #libglib-2.0.so=0
    
      20        #libgobject-2.0.so=0
    
      21    glibc       # libc6
    
      22        #ld-linux-x86-64.so=2
    
      23        #libc.so=6
    
      24        #libdl.so=2
    
      25        #libm.so=6
    
      26        #libpthread.so=0
    
      27    gtk2        # libgtk2.0-0
    
      28        #libgdk-x11-2.0.so=0
    
      29        #libgtk-x11-2.0.so=0
    
      30    libcap      # libcap2-bin
    
      31        #libcap.so=2
    
      32    libglvnd    # libopengl0, libegl1
    
      33        #libOpenGL.so=0
    
      34        #libEGL.so=1
    
      35    libsm       # libsm6
    
      36        #libSM.so=6
    
      37    libx11      # libx11-6
    
      38        #libX11.so=6
    
      39    libxxf86vm  # libxxf86vm1
    
      40        #libXxf86vm.so=1
    
      41    openssl-1.1 # libssl1.1
    
      42        #libcrypto.so=1.1
    
      43        #libssl.so=1.1
    
      44    pango       # libpango-1.0-0, libpangocairo-1.0-0
    
      45        #libpango-1.0.so=0
    
      46        #libpangocairo-1.0.so=0
    
      47    sdl2        # libsdl2-2.0-0
    
      48    zlib        # zlib1g
    
      49        #libz.so=1
    
      50)
    
      51source=("${pkgname}_${pkgver}_Release::https://content.runescape.com/downloads/ubuntu/dists/trusty/Release"
    
      52        "${pkgname}_${pkgver}_Release.gpg::https://content.runescape.com/downloads/ubuntu/dists/trusty/Release.gpg")
    
      53source_x86_64=("${pkgname}_${pkgver}_Packages::https://content.runescape.com/downloads/ubuntu/dists/trusty/non-free/binary-amd64/Packages"
    
      54               "${pkgname}_${pkgver}_amd64.deb::https://content.runescape.com/downloads/ubuntu/pool/non-free/r/$pkgname/${pkgname}_${pkgver}_amd64.deb")
    
      55sha256sums=('SKIP'
    
      56            'SKIP')
    
      57sha256sums_x86_64=('SKIP'
    
      58                   'SKIP')
    
      59validpgpkeys=("AAC9264309E4D717441DB9527373B12CE03BEB4B")
    
      60install="install.sh"
    
      61
    
      62# avoid caching in makepkg!
    
      63SRCDEST=$startdir
    
      64
    
      65_msg() {
    
      66    printf '%s\n' "$*"
    
      67}
    
      68
    
      69_err() {
    
      70    printf '\e[1;31mError:\e[m %s\n' "$*" >&2
    
      71}
    
      72
    
      73_verify_repo() {
    
      74    if (( SKIPPGPCHECK )); then
    
      75        return 0
    
      76    fi
    
      77
    
      78    local Release=${source[0]%%::*}
    
      79    local Packages=${source_x86_64[0]%%::*}
    
      80    local debfile=${source_x86_64[1]%%::*}
    
      81    local jagexpgpkey=${validpgpkeys[0]}
    
      82    local _out
    
      83
    
      84    _msg "Verifying 'Release' file (PGP)..."
    
      85
    
      86    if ! _out=$(gpg --batch --status-fd 1 \
    
      87                    --trust-model always \
    
      88                    --verify "$Release.gpg" "$Release" \
    
      89                    2>&1); then
    
      90        _err "PGP signature of 'Release' could not be verified"
    
      91        echo "$_out" | grep -v "^\\[GNUPG:\\]"
    
      92        return 1
    
      93    elif ! grep -Eqs "^\\[GNUPG:\\] VALIDSIG $jagexpgpkey " <<< "$_out"; then
    
      94        _err "PGP signature of 'Release' was not made by Jagex"
    
      95        echo "$_out" | grep -v "^\\[GNUPG:\\]"
    
      96        return 1
    
      97    fi
    
      98
    
      99    _msg "Parsing 'Release' file..."
    
      100
    
      101    _out=$(awk 'ok && $3 == "non-free/binary-amd64/Packages" {print $1; exit}
    
      102                /^[^[:space:]]/ {ok=0}
    
      103                /^SHA256:$/ {ok=1}' < "$Release")
    
      104    if ! [[ $_out =~ ^[0-9a-f]{64}$ ]]; then
    
      105        _err "Could not find hash of 'non-free/binary-amd64/Packages' in the 'Release' file"
    
      106        return 1
    
      107    fi
    
      108
    
      109    _msg "Verifying 'Packages' file (SHA256)..."
    
      110
    
      111    if ! sha256sum --quiet --check <<< "$_out *$Packages"; then
    
      112        _err "Hash sum of 'Packages' did not match expected"
    
      113        return 1
    
      114    fi
    
      115
    
      116    _msg "Parsing 'Packages' file..."
    
      117
    
      118    _out=$(awk 'ok && /^SHA256:/ {print $2; exit}
    
      119                /^Package:/ {ok=0}
    
      120                /^Package: runescape-launcher$/ {ok=1}' < "$Packages")
    
      121    if ! [[ $_out =~ ^[0-9a-f]{64}$ ]]; then
    
      122        _err "Could not find hash of '$debfile' in the 'Packages' file"
    
      123        return 1
    
      124    fi
    
      125
    
      126    _msg "Verifying '$debfile' (SHA256)..."
    
      127
    
      128    if ! sha256sum --quiet --check <<< "$_out *$debfile"; then
    
      129        _err "Hash sum of '$debfile' did not match expected"
    
      130        return 1
    
      131    fi
    
      132}
    
      133
    
      134prepare() {
    
      135    _verify_repo
    
      136
    
      137    rm -rf "$srcdir/$pkgname-$pkgver"
    
      138    mkdir "$srcdir/$pkgname-$pkgver"
    
      139    cd "$srcdir/$pkgname-$pkgver"
    
      140
    
      141    _msg "Extracting control files..."
    
      142    bsdtar xvf ../control.tar.xz
    
      143
    
      144    _msg "Extracting data files..."
    
      145    bsdtar xvf ../data.tar.xz
    
      146}
    
      147
    
      148package() {
    
      149    cd "$srcdir/$pkgname-$pkgver"
    
      150
    
      151    cp -a usr "$pkgdir"
    
      152
    
      153    # XXX: maybe move the binary out of /usr/share to where it belongs
    
      154    #mkdir -p "$pkgdir"/usr/lib/runescape-launcher
    
      155    #mv "$pkgdir"/usr/{share/games,lib}/runescape-launcher/runescape
    
      156    #sed -i 's,/usr/share/games,/usr/lib,' "$pkgdir"/usr/bin/runescape-launcher
    
      157
    
      158    install -Dm0644 copyright "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      159    install -Dm0644 changelog "$pkgdir"/usr/share/doc/$pkgname/changelog
    
      160}
    
      161
    
      162# vim: ft=sh:ts=4:sw=4:et:nowrap
    
      163

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2