smsadvance

maintainer Sterophonick · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Windows executable (SMSAdvance.exe) and GBA ROM files from zophar.net, which is a well-known emulation/ROM hosting site but is not the official upstream source for this tool. The binary is executed via Wine at runtime. The md5sum is provided for the zip archive, which offers some integrity protection, but md5 is cryptographically weak and the host is not the official developer's distribution channel. The three local source files (smsadvance wrapper script, .desktop, .png) have SKIP checksums, meaning the wrapper script that gets installed as an executable at /usr/bin/smsadvance has no integrity check at all — this is a real concern since that script is what actually runs. Overall: prebuilt binary from a third-party host (medium supply-chain risk) combined with an unchecked executable wrapper script keeps this at MEDIUM.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=(https://www.zophar.net/fileuploads/2/16428iussy/SMSAdvance25Bin.zip

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Windows executable (SMSAdvance.exe) and GBA ROM files from zophar.net, which is a well-known emulation/ROM hosting site but is not the official upstream source for this tool. The binary is executed via Wine at runtime. The md5sum is provided for the zip archive, which offers some integrity protection, but md5 is cryptographically weak and the host is not the official developer's distribution channel. The three local source files (smsadvance wrapper script, .desktop, .png) have SKIP checksums, meaning the wrapper script that gets installed as an executable at /usr/bin/smsadvance has no integrity check at all — this is a real concern since that script is what actually runs. Overall: prebuilt binary from a third-party host (medium supply-chain risk) combined with an unchecked executable wrapper script keeps this at MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sterophonick
    
      2pkgname=smsadvance
    
      3_pkgname='smsadvance'
    
      4pkgver=2.5
    
      5pkgrel=1
    
      6pkgdesc='SMSAdvance ROM Builder'
    
      7arch=(x86_64 i686)
    
      8depends=('wine' 'winetricks')
    
      9source=(https://www.zophar.net/fileuploads/2/16428iussy/SMSAdvance25Bin.zip
    
      10        smsadvance
    
      11        smsadvance.desktop
    
      12        smsadvance.png)
    
      13md5sums=('91ece0acb6f5a3b7e83d22904dceccce'
    
      14         'SKIP'
    
      15         'SKIP'
    
      16         'SKIP')
    
      17options=(!debug !strip)
    
      18
    
      19package() {
    
      20  install -Dm755 smsadvance $pkgdir/usr/bin/smsadvance
    
      21  install -Dm644 smsadvance.desktop $pkgdir/usr/share/applications/smsadvance.desktop
    
      22  install -Dm644 smsadvance.png $pkgdir/usr/share/pixmaps/smsadvance.png
    
      23
    
      24  mkdir -p $pkgdir/usr/share/smsadvance
    
      25
    
      26  cp -r $srcdir/Formats.txt $pkgdir/usr/share/smsadvance
    
      27  cp -r $srcdir/SEGA_GBA.raw $pkgdir/usr/share/smsadvance
    
      28  cp -r $srcdir/SMSAdvance.exe $pkgdir/usr/share/smsadvance
    
      29  cp -r $srcdir/gamelist.txt $pkgdir/usr/share/smsadvance
    
      30  cp -r $srcdir/history.txt $pkgdir/usr/share/smsadvance
    
      31  cp -r $srcdir/readme.txt $pkgdir/usr/share/smsadvance
    
      32  cp -r $srcdir/segabox.raw $pkgdir/usr/share/smsadvance
    
      33  cp -r $srcdir/smsadvance.gba $pkgdir/usr/share/smsadvance
    
      34  cp -r $srcdir/smsadvance.mbz $pkgdir/usr/share/smsadvance
    
      35  cp -r $srcdir/smsasplash.raw $pkgdir/usr/share/smsadvance
    
      36
    
      37  chmod -R 777 $pkgdir/usr/share/smsadvance
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2