runescape-launcher
LOW
maintainer cypriangula
56 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a .deb and associated metadata from Jagex's official domain with PGP and SHA256 verification, building from the project's own release infrastructure, which is a normal and safe AUR practice despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a .deb and associated metadata from Jagex's official domain with PGP and SHA256 verification, building from the project's own release infrastructure, which is a normal and safe AUR practice despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:51
source=("${pkgname}_${pkgver}_Release::https://content.runescape.com/downloads/ubuntu/dists/trusty/Release"
PKGBUILD
1 offending line(s) highlighted
1
# Upstream: RuneScape Linux <noreply@jagex.com>
2
# Contributor: Ivan Puntiy <ivan.puntiy-at-gmail>
3
# Contributor: Mantas Mikulėnas <grawity@gmail.com>
4
5
pkgname=runescape-launcher
6
pkgver=2.2.12
7
pkgrel=1
8
pkgdesc="RuneScape Game Client (NXT)"
9
arch=(x86_64)
10
license=(custom)
11
url="https://www.runescape.com/"
12
depends=(
13
cairo # libcairo2
14
#libcairo.so=2
15
libgcc # libgcc1
16
gdk-pixbuf2 # libgdk-pixbuf2.0-0
17
#libgdk_pixbuf-2.0.so=0
18
glib2 # libglib2.0-0
19
#libglib-2.0.so=0
20
#libgobject-2.0.so=0
21
glibc # libc6
22
#ld-linux-x86-64.so=2
23
#libc.so=6
24
#libdl.so=2
25
#libm.so=6
26
#libpthread.so=0
27
gtk2 # libgtk2.0-0
28
#libgdk-x11-2.0.so=0
29
#libgtk-x11-2.0.so=0
30
libcap # libcap2-bin
31
#libcap.so=2
32
libglvnd # libopengl0, libegl1
33
#libOpenGL.so=0
34
#libEGL.so=1
35
libsm # libsm6
36
#libSM.so=6
37
libx11 # libx11-6
38
#libX11.so=6
39
libxxf86vm # libxxf86vm1
40
#libXxf86vm.so=1
41
openssl-1.1 # libssl1.1
42
#libcrypto.so=1.1
43
#libssl.so=1.1
44
pango # libpango-1.0-0, libpangocairo-1.0-0
45
#libpango-1.0.so=0
46
#libpangocairo-1.0.so=0
47
sdl2 # libsdl2-2.0-0
48
zlib # zlib1g
49
#libz.so=1
50
)
51
source=("${pkgname}_${pkgver}_Release::https://content.runescape.com/downloads/ubuntu/dists/trusty/Release"
52
"${pkgname}_${pkgver}_Release.gpg::https://content.runescape.com/downloads/ubuntu/dists/trusty/Release.gpg")
53
source_x86_64=("${pkgname}_${pkgver}_Packages::https://content.runescape.com/downloads/ubuntu/dists/trusty/non-free/binary-amd64/Packages"
54
"${pkgname}_${pkgver}_amd64.deb::https://content.runescape.com/downloads/ubuntu/pool/non-free/r/$pkgname/${pkgname}_${pkgver}_amd64.deb")
55
sha256sums=('SKIP'
56
'SKIP')
57
sha256sums_x86_64=('SKIP'
58
'SKIP')
59
validpgpkeys=("AAC9264309E4D717441DB9527373B12CE03BEB4B")
60
install="install.sh"
61
62
# avoid caching in makepkg!
63
SRCDEST=$startdir
64
65
_msg() {
66
printf '%s\n' "$*"
67
}
68
69
_err() {
70
printf '\e[1;31mError:\e[m %s\n' "$*" >&2
71
}
72
73
_verify_repo() {
74
if (( SKIPPGPCHECK )); then
75
return 0
76
fi
77
78
local Release=${source[0]%%::*}
79
local Packages=${source_x86_64[0]%%::*}
80
local debfile=${source_x86_64[1]%%::*}
81
local jagexpgpkey=${validpgpkeys[0]}
82
local _out
83
84
_msg "Verifying 'Release' file (PGP)..."
85
86
if ! _out=$(gpg --batch --status-fd 1 \
87
--trust-model always \
88
--verify "$Release.gpg" "$Release" \
89
2>&1); then
90
_err "PGP signature of 'Release' could not be verified"
91
echo "$_out" | grep -v "^\\[GNUPG:\\]"
92
return 1
93
elif ! grep -Eqs "^\\[GNUPG:\\] VALIDSIG $jagexpgpkey " <<< "$_out"; then
94
_err "PGP signature of 'Release' was not made by Jagex"
95
echo "$_out" | grep -v "^\\[GNUPG:\\]"
96
return 1
97
fi
98
99
_msg "Parsing 'Release' file..."
100
101
_out=$(awk 'ok && $3 == "non-free/binary-amd64/Packages" {print $1; exit}
102
/^[^[:space:]]/ {ok=0}
103
/^SHA256:$/ {ok=1}' < "$Release")
104
if ! [[ $_out =~ ^[0-9a-f]{64}$ ]]; then
105
_err "Could not find hash of 'non-free/binary-amd64/Packages' in the 'Release' file"
106
return 1
107
fi
108
109
_msg "Verifying 'Packages' file (SHA256)..."
110
111
if ! sha256sum --quiet --check <<< "$_out *$Packages"; then
112
_err "Hash sum of 'Packages' did not match expected"
113
return 1
114
fi
115
116
_msg "Parsing 'Packages' file..."
117
118
_out=$(awk 'ok && /^SHA256:/ {print $2; exit}
119
/^Package:/ {ok=0}
120
/^Package: runescape-launcher$/ {ok=1}' < "$Packages")
121
if ! [[ $_out =~ ^[0-9a-f]{64}$ ]]; then
122
_err "Could not find hash of '$debfile' in the 'Packages' file"
123
return 1
124
fi
125
126
_msg "Verifying '$debfile' (SHA256)..."
127
128
if ! sha256sum --quiet --check <<< "$_out *$debfile"; then
129
_err "Hash sum of '$debfile' did not match expected"
130
return 1
131
fi
132
}
133
134
prepare() {
135
_verify_repo
136
137
rm -rf "$srcdir/$pkgname-$pkgver"
138
mkdir "$srcdir/$pkgname-$pkgver"
139
cd "$srcdir/$pkgname-$pkgver"
140
141
_msg "Extracting control files..."
142
bsdtar xvf ../control.tar.xz
143
144
_msg "Extracting data files..."
145
bsdtar xvf ../data.tar.xz
146
}
147
148
package() {
149
cd "$srcdir/$pkgname-$pkgver"
150
151
cp -a usr "$pkgdir"
152
153
# XXX: maybe move the binary out of /usr/share to where it belongs
154
#mkdir -p "$pkgdir"/usr/lib/runescape-launcher
155
#mv "$pkgdir"/usr/{share/games,lib}/runescape-launcher/runescape
156
#sed -i 's,/usr/share/games,/usr/lib,' "$pkgdir"/usr/bin/runescape-launcher
157
158
install -Dm0644 copyright "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
159
install -Dm0644 changelog "$pkgdir"/usr/share/doc/$pkgname/changelog
160
}
161
162
# vim: ft=sh:ts=4:sw=4:et:nowrap
163
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |