scrolls

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball (linux.tar.gz) from download.scrolls.com with 'SKIP' for its checksum, then installs the extracted 'Scrolls' binary as an executable. This is a real supply-chain concern: no integrity verification is performed on the executed binary, meaning any compromise or substitution of the artifact at the source host would result in arbitrary code execution on the user's system. The host (download.scrolls.com) is the official game vendor's download server for 'Scrolls' (a Mojang game), so it is not a random personal host, but the SKIP checksum still means there is no protection against tampering or MITM. This is a classic medium-severity pattern: official-ish vendor binary with no checksum verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=( scrolls http://download.scrolls.com/client/linux.tar.gz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball (linux.tar.gz) from download.scrolls.com with 'SKIP' for its checksum, then installs the extracted 'Scrolls' binary as an executable. This is a real supply-chain concern: no integrity verification is performed on the executed binary, meaning any compromise or substitution of the artifact at the source host would result in arbitrary code execution on the user's system. The host (download.scrolls.com) is the official game vendor's download server for 'Scrolls' (a Mojang game), so it is not a random personal host, but the SKIP checksum still means there is no protection against tampering or MITM. This is a classic medium-severity pattern: official-ish vendor binary with no checksum verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tanguy ALEXIS <tanguy@metatux.fr>
    
      2
    
      3pkgname=scrolls
    
      4pkgver=latest
    
      5pkgrel=3
    
      6pkgdesc="You use the power of creatures, spells, and ancient machines to gain the edge in battle, deploying your forces by using scrolls."
    
      7arch=('x86_64')
    
      8license=('custom')
    
      9url="https://www.scrolls.com/"
    
      10depends=('glu')
    
      11source=( scrolls http://download.scrolls.com/client/linux.tar.gz
    
      12         scrolls.desktop scrolls.png LICENSE)
    
      13md5sums=('906032d3d16ad73b1204d086b0a59e0c'
    
      14         'SKIP'
    
      15         '747f834cfc610de38986a47d95289f8e'
    
      16         '73f17d8db78f23e135effae241e1f2a8'
    
      17         'be2ab8f5aba79a6060c12cc23b9c8a2c')
    
      18
    
      19package() {
    
      20    cd "$srcdir"
    
      21    tar xvzf "${srcdir}/linux.tar.gz"
    
      22    mkdir -p "${pkgdir}/usr/share/scrolls"
    
      23    cp -r "${srcdir}/Scrolls_Data" "${pkgdir}/usr/share/scrolls/Scrolls_Data"
    
      24    chmod -R 755 "${pkgdir}/usr/share/scrolls/Scrolls_Data"
    
      25    install -D -m755 "${srcdir}/Scrolls"     "${pkgdir}/usr/share/scrolls/Scrolls"
    
      26    install -D -m755 "${srcdir}/scrolls"         "${pkgdir}/usr/bin/scrolls"
    
      27
    
      28    # Desktop launcher with icon
    
      29    install -D -m644 "${srcdir}/scrolls.desktop" "${pkgdir}/usr/share/applications/scrolls.desktop"
    
      30    install -D -m644 "${srcdir}/scrolls.png"     "${pkgdir}/usr/share/pixmaps/scrolls.png"
    
      31
    
      32    # License
    
      33    install -D -m644 "${srcdir}/LICENSE"           "${pkgdir}/usr/share/licenses/scrolls/LICENSE"
    
      34}
    
      35
    
      36# vim:set ts=4 sw=4 et:

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2