sinerider

maintainer swyter · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Unity3D binary from an S3 bucket (s3.amazonaws.com/sinerider) rather than from the official game website (sineridergame.com) or a verifiable release page. The binary is executed directly and installed to /opt. While S3 is a common distribution mechanism for indie games and the checksum is pinned (md5, though weak), the host is not the project's canonical domain and there is no way to verify the binary's provenance or integrity beyond the md5sum. This is a genuine supply-chain concern: if the S3 bucket were taken over or the object replaced, users would install a malicious binary. The md5 checksum provides minimal protection. This fits the medium category: a prebuilt binary from an unofficial/personal host with no source build option.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://s3.amazonaws.com/sinerider/SineRider+Linux.zip" "sinerider.desktop")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Unity3D binary from an S3 bucket (s3.amazonaws.com/sinerider) rather than from the official game website (sineridergame.com) or a verifiable release page. The binary is executed directly and installed to /opt. While S3 is a common distribution mechanism for indie games and the checksum is pinned (md5, though weak), the host is not the project's canonical domain and there is no way to verify the binary's provenance or integrity beyond the md5sum. This is a genuine supply-chain concern: if the S3 bucket were taken over or the object replaced, users would install a malicious binary. The md5 checksum provides minimal protection. This fits the medium category: a prebuilt binary from an unofficial/personal host with no source build option.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: swyter <swyterzone+aur@gmail.com>
    
      2# Note: Haven't really tested it with i686, but it should work all the same... at least in theory. :)
    
      3
    
      4pkgname=sinerider
    
      5pkgver=0.4
    
      6pkgrel=1
    
      7epoch=
    
      8pkgdesc="A game of numerical sledding. It will make you see math the way mathematicians see it: a creative process of exploration and discovery. Math is the ultimate puzzle, and SineRider is the ultimate math puzzle game."
    
      9arch=('x86_64' 'i686')
    
      10url="http://sineridergame.com/"
    
      11license=('custom:freeware' 'unknown')
    
      12groups=()
    
      13depends=('glibc' 'glu' 'libgl' 'libx11' 'libxext' 'libxcursor' 'libxrandr' 'gcc-libs' 'expat' 'libxdamage' 'libxfixes' 'libxcb' 'libxshmfence' 'libxxf86vm' 'libdrm' 'libxrender' 'libxau' 'libxdmcp')
    
      14makedepends=()
    
      15checkdepends=()
    
      16optdepends=()
    
      17provides=()
    
      18conflicts=()
    
      19replaces=()
    
      20backup=()
    
      21options=()
    
      22source=("https://s3.amazonaws.com/sinerider/SineRider+Linux.zip" "sinerider.desktop")
    
      23md5sums=("36071911e1f861c017004feca55f4f10"
    
      24         "778d8fd98d2a051882220c7b55bd0846")
    
      25install=sinerider.install
    
      26
    
      27package()
    
      28{
    
      29	# look up table from unity3d's silly arch nomenclature
    
      30	declare -A archlut=([x86_64]="x86_64" [i686]="x86")
    
      31
    
      32	# mosly optional
    
      33	cd "$srcdir"
    
      34
    
      35	# create the main folder
    
      36	install -d "$pkgdir/opt/sinerider"
    
      37
    
      38	# copy the engine assets...
    
      39	cp -rp "$srcdir/SineRider_Data" "$pkgdir/opt/sinerider/"
    
      40
    
      41	# ...and the right executable, depending on our current arch
    
      42	install -Dm 755 "SineRider.${archlut[$CARCH]}" "$pkgdir/opt/sinerider/SineRider.$CARCH"
    
      43
    
      44	# remove unneeded stuff from the other arch
    
      45	# unset the platform we're using from the look-up array,
    
      46	# get the value of the other index and use it to delete anything we want.
    
      47
    
      48	unset archlut[$CARCH]
    
      49	otherarch=${archlut[${!archlut[@]}]}
    
      50
    
      51	rm -rf "$pkgdir/opt/sinerider/SineRider_Data/Mono/$otherarch"
    
      52	rm -rf "$pkgdir/opt/sinerider/SineRider_Data/Plugins/$otherarch"
    
      53
    
      54	# sundry icons and symlinked launcher
    
      55	install -d "$pkgdir/usr/bin"
    
      56	echo "/opt/sinerider/SineRider.$CARCH" > "$pkgdir/usr/bin/sinerider"
    
      57	chmod +x "$pkgdir/usr/bin/sinerider"
    
      58
    
      59	install -Dm 755 "sinerider.desktop" "$pkgdir/usr/share/applications/sinerider.desktop"
    
      60	install -Dm 644 "$srcdir/SineRider_Data/Resources/UnityPlayer.png" "$pkgdir/usr/share/pixmaps/sinerider.png"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2