springro-launcher

MEDIUM

maintainer xAsh 0 votes scanned 2026-10-19 03:25:43.156184

View on AUR

Why flagged

A prebuilt binary executable (.deb containing a 'launcher' binary) is downloaded from patches.springro.com, which is a non-standard/personal-project host unrelated to a major vendor's official release infrastructure; while it appears to be the project's own domain, the binary is installed and run directly with no way to verify its provenance beyond a SHA256 checksum, and the host could be silently swapped — this is a typical medium-risk prebuilt binary from a small project's own server.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "springro-launcher-${pkgver}.deb::https://patches.springro.com/launcher/SpringRO_Linux_Launcher2.1.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): A prebuilt binary executable (.deb containing a 'launcher' binary) is downloaded from patches.springro.com, which is a non-standard/personal-project host unrelated to a major vendor's official release infrastructure; while it appears to be the project's own domain, the binary is installed and run directly with no way to verify its provenance beyond a SHA256 checksum, and the host could be silently swapped — this is a typical medium-risk prebuilt binary from a small project's own server.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ash <xash at riseup d0t net>
    
      2pkgname=springro-launcher
    
      3pkgver=0.1.11
    
      4pkgrel=1
    
      5pkgdesc='SpringRO launcher for Ragnarok Online'
    
      6arch=('x86_64')
    
      7url='https://springro.com/'
    
      8license=('unknown')
    
      9depends=(
    
      10  'cairo'
    
      11  'dbus'
    
      12  'gdk-pixbuf2'
    
      13  'glib2'
    
      14  'glibc'
    
      15  'gst-plugins-base'
    
      16  'gst-plugins-good'
    
      17  'gtk3'
    
      18  'hicolor-icon-theme'
    
      19  'libgcc'
    
      20  'libsecret'
    
      21  'libsoup3'
    
      22  'webkit2gtk-4.1'
    
      23)
    
      24optdepends=('wine: run the Windows game client (alternatively, use Proton)')
    
      25provides=('springro')
    
      26conflicts=('springro')
    
      27source=(
    
      28  "springro-launcher-${pkgver}.deb::https://patches.springro.com/launcher/SpringRO_Linux_Launcher2.1.deb"
    
      29  'springro.desktop'
    
      30)
    
      31noextract=("springro-launcher-${pkgver}.deb")
    
      32sha256sums=('14262865aaf5f4ec1c67d01345e09618db5249e4150ecfd4cabda468b5a8abe2'
    
      33            '08bc78a8138f54dfac48dd3ea0fc9850481b29d6069250244bb6e601692bc274')
    
      34
    
      35prepare() {
    
      36  bsdtar -xf "${srcdir}/springro-launcher-${pkgver}.deb" -C "${srcdir}" data.tar.gz
    
      37  bsdtar -xf "${srcdir}/data.tar.gz" -C "${srcdir}"
    
      38}
    
      39
    
      40package() {
    
      41  install -Dm755 "${srcdir}/usr/bin/launcher" "${pkgdir}/usr/lib/springro/launcher"
    
      42  install -d "${pkgdir}/usr/bin"
    
      43  ln -s ../lib/springro/launcher "${pkgdir}/usr/bin/springro"
    
      44
    
      45  install -Dm644 "${srcdir}/springro.desktop" \
    
      46    "${pkgdir}/usr/share/applications/springro.desktop"
    
      47  local size
    
      48  for size in 32x32 128x128 256x256@2; do
    
      49    install -Dm644 \
    
      50      "${srcdir}/usr/share/icons/hicolor/${size}/apps/launcher.png" \
    
      51      "${pkgdir}/usr/share/icons/hicolor/${size}/apps/springro.png"
    
      52  done
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 03:25:43	Medium	3
2026-10-19 03:23:49	Medium	3