salwyrr

maintainer kitic · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt JAR binary from salwyrr.com (the project's own website) and installs it to be executed via 'java -jar'. The JAR is a Minecraft launcher with 'built-in client features' and 'PvP optimizations' — language commonly associated with cheating/hacked clients, but not necessarily piracy of Minecraft itself (it's a launcher wrapper). The core supply-chain concern is real: a prebuilt, closed-source JAR from a single commercial host with no reproducible build, no source code, and a 'custom:unknown' license. If the host were compromised or the maintainer updated the JAR without updating checksums, arbitrary Java code would execute on users' machines. The sha512sums provide integrity at packaging time but not ongoing protection. The checksums also appear truncated (127 hex chars instead of 128 for sha512), which is a minor red flag. This is a legitimate medium-risk pattern: executed binary from a non-standard/personal project host with no source transparency.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("salwyrr.jar::https://salwyrr.com/$pkgver/Salwyrr%20Minecraft%20Launcher%20$pkgver.jar"
PKGBUILD:12 "salwyrr.png::https://www.salwyrr.com/img/salwyrrclient/min.png")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt JAR binary from salwyrr.com (the project's own website) and installs it to be executed via 'java -jar'. The JAR is a Minecraft launcher with 'built-in client features' and 'PvP optimizations' — language commonly associated with cheating/hacked clients, but not necessarily piracy of Minecraft itself (it's a launcher wrapper). The core supply-chain concern is real: a prebuilt, closed-source JAR from a single commercial host with no reproducible build, no source code, and a 'custom:unknown' license. If the host were compromised or the maintainer updated the JAR without updating checksums, arbitrary Java code would execute on users' machines. The sha512sums provide integrity at packaging time but not ongoing protection. The checksums also appear truncated (127 hex chars instead of 128 for sha512), which is a minor red flag. This is a legitimate medium-risk pattern: executed binary from a non-standard/personal project host with no source transparency.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: kitic
    
      2pkgname=salwyrr
    
      3pkgver=4
    
      4pkgrel=1
    
      5pkgdesc='Minecraft launcher with built-in client features, mod support and PvP optimizations'
    
      6arch=('any')
    
      7url='https://salwyrr.com'
    
      8license=('custom:unknown')
    
      9depends=('java-environment')
    
      10
    
      11source=("salwyrr.jar::https://salwyrr.com/$pkgver/Salwyrr%20Minecraft%20Launcher%20$pkgver.jar"
    
      12        "salwyrr.png::https://www.salwyrr.com/img/salwyrrclient/min.png")
    
      13
    
      14sha512sums=('130337c5738e9cee84dff629c5d4a34f9b2bbf587e7b0eaa518075a76a8086854e7604c9ae23455eca239fbbf36c3c1472b477d306a347a1dba9b1c63c61ee3d'
    
      15            'fbfb75ee33d31cee6bc547e2654164ba053947574e5bd3bf7ce2606dea32a89c82d76bf7c77ff8d9a7f2370da5b1fcf79775b23d12b5198541543538e87dfcfa')
    
      16
    
      17package() {
    
      18  install -dm 755 "$pkgdir/usr/bin"
    
      19  install -dm 755 "$pkgdir/usr/share/$pkgname"
    
      20  install -dm 755 "$pkgdir/usr/share/pixmaps"
    
      21  install -dm 755 "$pkgdir/usr/share/applications"
    
      22
    
      23  install -Dm 644 "salwyrr.jar" "$pkgdir/usr/share/$pkgname/salwyrr.jar"
    
      24  install -Dm 644 "salwyrr.png" "$pkgdir/usr/share/pixmaps/salwyrr.png"
    
      25
    
      26  cat > "$pkgdir/usr/bin/$pkgname" << EOF
    
      27#!/bin/sh
    
      28exec java -jar /usr/share/$pkgname/salwyrr.jar "\$@"
    
      29EOF
    
      30  chmod +x "$pkgdir/usr/bin/$pkgname"
    
      31
    
      32  cat > "$pkgdir/usr/share/applications/$pkgname.desktop" << EOF
    
      33[Desktop Entry]
    
      34Name=Salwyrr
    
      35Exec=$pkgname
    
      36Icon=salwyrr
    
      37Type=Application
    
      38StartupNotify=true
    
      39Categories=Game;
    
      40EOF
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2