slune

maintainer davygora · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged This PKGBUILD is a legitimate (if sloppy) packaging of the 'slune' racing game using miniconda to provide a Python 2.7 environment, since Python 2.7 is EOL and unavailable in standard Arch repos. The patterns flagged are real but not malicious: (1) curl https://bootstrap.pypa.io/pip/2.7/get-pip.py | python fetches from the official PyPI bootstrap URL for Python 2.7 pip - this is the canonical method recommended by PyPA for Python 2.7; (2) pip install of 'cython<3' and 'slune' from PyPI are legitimate packages; (3) conda-forge is an official, well-known conda channel. The main security concern is the absence of checksums for downloaded content (get-pip.py, PyPI packages, conda packages), which is a supply-chain hygiene issue but not active malware or exfiltration. The overall pattern is a known workaround for packaging EOL Python 2.7 software. No obfuscation, no attacker-controlled hosts, no data exfiltration, no source substitution. The HIGH rating was a false positive driven by the curl|python pattern and external downloads without checksums.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): This PKGBUILD is a legitimate (if sloppy) packaging of the 'slune' racing game using miniconda to provide a Python 2.7 environment, since Python 2.7 is EOL and unavailable in standard Arch repos. The patterns flagged are real but not malicious: (1) curl https://bootstrap.pypa.io/pip/2.7/get-pip.py | python fetches from the official PyPI bootstrap URL for Python 2.7 pip - this is the canonical method recommended by PyPA for Python 2.7; (2) pip install of 'cython<3' and 'slune' from PyPI are legitimate packages; (3) conda-forge is an official, well-known conda channel. The main security concern is the absence of checksums for downloaded content (get-pip.py, PyPI packages, conda packages), which is a supply-chain hygiene issue but not active malware or exfiltration. The overall pattern is a known workaround for packaging EOL Python 2.7 software. No obfuscation, no attacker-controlled hosts, no data exfiltration, no source substitution. The HIGH rating was a false positive driven by the curl|python pattern and external downloads without checksums.

4 higher static findings superseded - not the current verdict (shown for transparency)

HIGH Remote download executed by a shell curl_pipe_shell

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

PKGBUILD:41 curl https://bootstrap.pypa.io/pip/2.7/get-pip.py | python && \

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:41 curl https://bootstrap.pypa.io/pip/2.7/get-pip.py | python && \

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:42 pip install 'cython<3' && \
PKGBUILD:43 pip install slune

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:39 conda install 'python=2.7.18' -y && \
PKGBUILD:40 conda install -c conda-forge conda-pack -y && \

PKGBUILD

5 offending line(s) highlighted

      1# Maintainer: Yuriy Davygora <davygora@gmail.com>
    
      2
    
      3_pkgname="slune"
    
      4pkgname="$_pkgname"
    
      5pkgver=1.0.16
    
      6pkgrel=4
    
      7pkgdesc='A racing game'
    
      8arch=(x86_64)
    
      9url='http://www.lesfleursdunormal.fr/static/informatique/old/slune/index_en.html'
    
      10license=(GPL2)
    
      11
    
      12_condaenv=slune_conda
    
      13_installpath=/opt/slune
    
      14
    
      15makedepends=(
    
      16  'miniconda3'
    
      17  'base-devel'
    
      18  'tar'
    
      19  'gzip'
    
      20  'curl'
    
      21)
    
      22depends=(
    
      23  'cal3d'
    
      24  'glew'
    
      25  'sdl12-compat'
    
      26  'freetype2'
    
      27  'openal'
    
      28  'ode'
    
      29)
    
      30
    
      31build() {
    
      32  # Create a relocatable conda env
    
      33
    
      34  . /opt/miniconda3/etc/profile.d/conda.sh &&
    
      35    conda tos accept --override-channels --channel https://repo.anaconda.com/pkgs/main &&
    
      36    conda tos accept --override-channels --channel https://repo.anaconda.com/pkgs/r &&
    
      37    conda create -p "$_condaenv" -y && \
    
      38    conda activate "$_condaenv/" && \
    
      39    conda install 'python=2.7.18' -y && \
    
      40    conda install -c conda-forge conda-pack -y && \
    
      41    curl https://bootstrap.pypa.io/pip/2.7/get-pip.py | python && \
    
      42    pip install 'cython<3' && \
    
      43    pip install slune
    
      44    conda-pack --ignore-missing-files -f
    
      45
    
      46  # Create a launcher file
    
      47
    
      48  cat << EOF > slune
    
      49#!/bin/sh
    
      50$_installpath/bin/python $_installpath/bin/slune
    
      51EOF
    
      52
    
      53  # Create a .desktop file
    
      54
    
      55  cat << 'EOF' > "slune.desktop"
    
      56[Desktop Entry]
    
      57Encoding=UTF-8
    
      58Name=Slune
    
      59GenericName=Arcade Game
    
      60Comment=A racing game.
    
      61Exec=slune
    
      62Icon=slune
    
      63MiniIcon=slune
    
      64Type=Application
    
      65Terminal=0
    
      66Categories=Game
    
      67EOF
    
      68}
    
      69
    
      70package() {
    
      71  # Unpack conda env at the correct location
    
      72
    
      73  install -Dm644 "$_condaenv.tar.gz" "$pkgdir$_installpath/$_condaenv.tar.gz"
    
      74  tar -xvzf "$pkgdir$_installpath/$_condaenv.tar.gz" -C "$pkgdir$_installpath"
    
      75  rm "$pkgdir$_installpath/$_condaenv.tar.gz"
    
      76
    
      77  # Install launcher
    
      78
    
      79  install -Dm755 "slune" "$pkgdir/usr/bin/slune"
    
      80
    
      81  # Install icons
    
      82
    
      83  for i in 16 32 48 ; do
    
      84    install -Dm644 "$_condaenv/lib/python2.7/site-packages/slune/images/slune.$i.png" \
    
      85      "$pkgdir/usr/share/icons/hicolor/${i}x$i/apps/slune.png"
    
      86  done
    
      87
    
      88  # Install .desktop file
    
      89
    
      90  install -Dm644 "slune.desktop" "$pkgdir/usr/share/applications/slune.desktop"
    
      91}
    
      92

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	5
2026-08-02 00:16:08	LOW	5
2026-08-01 00:11:18	LOW	5
2026-07-31 00:14:10	LOW	5
2026-07-30 00:17:23	LOW	5
2026-07-29 00:25:53	LOW	5
2026-07-28 00:07:28	LOW	5
2026-07-27 00:24:32	LOW	5
2026-07-26 00:07:32	LOW	5
2026-07-25 00:13:44	LOW	5
2026-07-24 00:02:28	LOW	5
2026-07-23 00:14:47	LOW	5
2026-07-22 00:29:32	LOW	5
2026-07-21 00:24:15	LOW	5
2026-07-20 00:19:49	LOW	5
2026-07-19 00:17:08	LOW	5
2026-07-18 00:14:48	LOW	5
2026-07-17 00:06:16	LOW	5
2026-07-16 00:05:41	LOW	5
2026-07-15 00:09:25	LOW	5