shipwright-bin

MEDIUM

maintainer lukerb52 0 votes scanned 2026-11-05 06:08:20.373456

View on AUR

Why flagged

The package installs a prebuilt AppImage from GitHub Releases, which is an unverifiable binary executable; if the source were swapped, it could lead to arbitrary code execution, though the project appears legitimate and is hosted on an official platform.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt AppImage from GitHub Releases, which is an unverifiable binary executable; if the source were swapped, it could lead to arbitrary code execution, though the project appears legitimate and is hosted on an official platform.

PKGBUILD

      1# Maintainer: Luke Bubar <luke@coldmail.xyz>
    
      2pkgname=shipwright-bin
    
      3pkgver=9.3.1
    
      4pkgrel=1
    
      5_codename=Dewey-Bravo
    
      6pkgdesc="An unofficial PC port of The Legend of Zelda: Ocarina of Time"
    
      7arch=('x86_64')
    
      8url="https://www.shipofharkinian.com"
    
      9license=('custom')
    
      10depends=('fuse2' 'sdl2' 'libpng' 'libzip' 'lsb-release')
    
      11optdepends=(
    
      12    'zenity: for file picker dialogs'
    
      13    'kdialog: for file picker dialogs (KDE)'
    
      14)
    
      15provides=('soh')
    
      16conflicts=('soh' 'soh-git')
    
      17options=('!strip')
    
      18source=("soh-${pkgver}.appimage::https://github.com/HarbourMasters/Shipwright/releases/download/${pkgver}/SoH-${_codename}.appimage"
    
      19        "soh.desktop"
    
      20        "soh.png::https://raw.githubusercontent.com/HarbourMasters/Shipwright/develop/soh/macosx/sohIcon.png")
    
      21sha256sums=('e4bb775c9a0c3629ebac57e4b6ccba6d0b621d71ab201e9105aceef9141ad1f4'
    
      22            'd2aa81872c6176dd747bee8962a27371b090ac8904bb12352660127092e3792a'
    
      23            '33ffca9a886629700bce92f334d3d460da48f41b2194854c0280dea3f6451850')
    
      24noextract=("soh-${pkgver}.appimage")
    
      25
    
      26package() {
    
      27    install -Dm755 "soh-${pkgver}.appimage" "${pkgdir}/opt/soh/soh.appimage"
    
      28    install -Dm644 "soh.desktop" "${pkgdir}/usr/share/applications/soh.desktop"
    
      29    install -Dm644 "soh.png" "${pkgdir}/usr/share/pixmaps/soh.png"
    
      30
    
      31    # Create launcher script
    
      32    install -dm755 "${pkgdir}/usr/bin"
    
      33    cat > "${pkgdir}/usr/bin/soh" << 'EOF'
    
      34#!/bin/sh
    
      35exec /opt/soh/soh.appimage "$@"
    
      36EOF
    
      37    chmod 755 "${pkgdir}/usr/bin/soh"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 06:08:20	Medium	2