sporemodder-fx-bin

LOW

maintainer lapsus 0 votes scanned 2026-09-05 01:59:11.792876

View on AUR

Why flagged

The package downloads a prebuilt JAR from the project's official GitHub releases, which is normal for AUR packages; the flagged low votes and recent upload are metadata concerns, not security risks, and no malicious behavior or unverifiable remote code execution is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt JAR from the project's official GitHub releases, which is normal for AUR packages; the flagged low votes and recent upload are metadata concerns, not security risks, and no malicious behavior or unverifiable remote code execution is present.

PKGBUILD

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=sporemodder-fx-bin
    
      4pkgver=2.2.27
    
      5pkgrel=1
    
      6pkgdesc="Spore data modding tool: unpack, edit and repack game packages with a JavaFX editor or the smfx CLI (prebuilt jar)"
    
      7arch=('x86_64')
    
      8url="https://github.com/Spore-Community/SporeModder-FX"
    
      9license=('GPL-3.0-or-later')
    
      10# The jar bundles JavaFX 17 with its Linux natives; these are their direct NEEDED libraries.
    
      11depends=('java-runtime>=11' 'gtk3' 'cairo' 'gdk-pixbuf2' 'glib2' 'libx11' 'libxtst'
    
      12         'libglvnd' 'freetype2' 'pango')
    
      13optdepends=('meld: compare a mod file against its original from the editor'
    
      14            'git: publish mod bundles to GitHub from the editor')
    
      15makedepends=('zip')
    
      16provides=("${pkgname%-bin}")
    
      17conflicts=("${pkgname%-bin}")
    
      18options=('!debug')
    
      19install="${pkgname}.install"
    
      20
    
      21_name=${pkgname%-bin}
    
      22_release_dir="SporeModder FX"
    
      23source=("${_name}-${pkgver}.zip::${url}/releases/download/v${pkgver}/SporeModder.FX.zip"
    
      24        "${_name}"
    
      25        "${_name}.desktop"
    
      26        'winmerge-shim')
    
      27sha256sums=('bd7908996b8022cd7452edefbdb2d62dbbe626d1e22962e83fe30def215e6669'
    
      28            'b02822a931fc84598f0f8152bce10250890e99a26a5a81a810230827a25e7415'
    
      29            'd3d22def1761610a736a5fb7ffd5d85f2b17a95f810574bccce69b1eec55e107'
    
      30            '8d475e055bdef5b9eb18f13eab13b8ae498e284e00ec4f802aa0e8c32c281154')
    
      31
    
      32latestver() {
    
      33    curl -fsSL "https://api.github.com/repos/Spore-Community/SporeModder-FX/releases/latest" |
    
      34    jq -r '.tag_name // empty' | sed 's/^v//'
    
      35}
    
      36
    
      37prepare() {
    
      38    cd "${_release_dir}"
    
      39    # The jar ships JavaFX natives for Windows, macOS and both GTK generations; the GTK 3
    
      40    # Linux set is the one the runtime loads on Arch.
    
      41    zip -q -d SporeModderFX.jar '*.dll' '*.dylib' libglassgtk2.so
    
      42    # advect.py is a developer plotting script (matplotlib) with no role at runtime
    
      43    rm -r SporeModderFX.exe smfx.exe smfx.sh WinMerge advect.py
    
      44    # The zip nests the styles matching the release tag under Styles/Styles beside a stale
    
      45    # top-level copy, which the editor would additionally list as a bogus "Styles" theme.
    
      46    rm -r Styles/Default Styles/Dark
    
      47    mv Styles/Styles/* Styles/
    
      48    rmdir Styles/Styles
    
      49}
    
      50
    
      51package() {
    
      52    local share="${pkgdir}/usr/share/${_name}"
    
      53
    
      54    install -d "${share}"
    
      55    cp -r --no-preserve=ownership,mode "${_release_dir}"/. "${share}/"
    
      56    install -Dm755 winmerge-shim "${share}/WinMerge/WinMergeU.exe"
    
      57
    
      58    install -Dm755 "${_name}" "${pkgdir}/usr/bin/${_name}"
    
      59    ln -s "${_name}" "${pkgdir}/usr/bin/smfx"
    
      60
    
      61    install -Dm644 "${_name}.desktop" -t "${pkgdir}/usr/share/applications"
    
      62    install -Dm644 "${_release_dir}/Styles/Default/program-icon.png" \
    
      63        "${pkgdir}/usr/share/icons/hicolor/64x64/apps/${_name}.png"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 01:59:11	Low	2