steam-beta
LOW
maintainer nojo
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
All downloads come from Valve's official CDN (client-update.steamstatic.com) and the official Steam repo; the SKIP'd checksums for local/bundled files (steam.sh, reaper64.c, manifest) are mildly sloppy but not dangerous, and the client zips are verified against the manifest's own sha2 hashes from Valve's infrastructure.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): All downloads come from Valve's official CDN (client-update.steamstatic.com) and the official Steam repo; the SKIP'd checksums for local/bundled files (steam.sh, reaper64.c, manifest) are mildly sloppy but not dangerous, and the client zips are verified against the manifest's own sha2 hashes from Valve's infrastructure.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:42
https://repo.steampowered.com/steam/archive/beta/steam_${_launcher}{.tar.gz,.dsc}
PKGBUILD
1 offending line(s) highlighted
1
# Arch's steam, but bootstrapping the 64-bit (SteamRT3) client beta so nothing needs lib32.
2
# Update the client: curl -fsSO "$_cdn/$_manifest", then rebuild.
3
#
4
# Good to know:
5
# - Building downloads the pinned client from Valve's CDN, about 740 MB.
6
# - /usr/bin/steam opts every Steam install into the client beta and its 64-bit client,
7
# and defaults PROTON_USE_WOW64=1; a game's launch options can set it to 0.
8
# - A system-wide binfmt_misc rule (/usr/lib/binfmt.d/steam-reaper.conf) runs Steam's
9
# i386 reaper, and only that binary, as /usr/lib/steam/reaper64.
10
# - lib32 packages are optional: 32-bit native games, and Proton without WoW64, need them.
11
# Maintainer: Nikolay Bryskin <nikicat@users.noreply.github.com>
12
# Contributor: Levente Polyak <anthraxx[at]archlinux[dot]org>
13
# Contributor: Giancarlo Razzolini <grazzolini@archlinux.org>
14
# Contributor: Christian Heusel <gromit@archlinux.org>
15
# Contributor: Daniel Wallace <danielwallace at gtmanfred dot com>
16
# Contributor: K900 <k0009000@gmail.com>
17
18
pkgname=steam-beta
19
_launcher=1.0.0.87
20
_branch=publicbeta
21
_manifest=steam_client_${_branch}_ubuntu12
22
_cdn=https://client-update.steamstatic.com
23
_reaper64=/usr/lib/steam/reaper64
24
_binfmt=steam-reaper
25
# Prints every value the pinned manifest gives key $1, in manifest order.
26
_manifest_values() { awk -F'"' -v k="$1" '$2 == k {print $4}' $_manifest; }
27
# smell: zips and hashes paired by position — kept, mirrors makepkg's parallel source/sha256sums.
28
# A manifest entry without sha2 shifts them; makepkg's checksum failure is the tripwire.
29
mapfile -t _client_zips < <(_manifest_values file)
30
mapfile -t _client_sha256 < <(_manifest_values sha2)
31
pkgver=${_launcher}.$(_manifest_values version)
32
pkgrel=5
33
pkgdesc="Valve's digital software delivery system (64-bit client beta, no lib32)"
34
url='https://steampowered.com/'
35
arch=('x86_64')
36
license=('LicenseRef-steam-subscriber-agreement' 'MIT')
37
# steam-devices' udev rules ship here: the repo package lives in multilib only beside steam
38
provides=("steam=$_launcher" "steam-devices=$_launcher")
39
conflicts=(steam steam-devices)
40
# the beta directory is a superset of stable and also contains the stable releases
41
source=(
42
https://repo.steampowered.com/steam/archive/beta/steam_${_launcher}{.tar.gz,.dsc}
43
steam.sh
44
reaper64.c
45
$_manifest
46
"${_client_zips[@]/#/$_cdn/}"
47
)
48
noextract=("${_client_zips[@]}")
49
sha256sums=('649375d2f9377f8009aaf3e2ff09978041eb9114897d9c5a3886f1d82e27ba1f'
50
'39f27cb743899372b790be1601e748e9e2c5f3140e80b19723fc421d3081e3fb'
51
SKIP
52
SKIP
53
SKIP
54
"${_client_sha256[@]}")
55
validpgpkeys=('BA1816EF8E75005FCF5E27A1F24AEA9FB05498B7') # linux@steampowered.com
56
57
# Passes on those of the NUL-separated paths on stdin that are ELF binaries or scripts.
58
_programs() {
59
local f magic
60
while IFS= read -rd '' f; do
61
IFS= read -rd '' -n4 magic < "$f" || true # files under 4 bytes hit EOF
62
case $magic in $'\177ELF' | '#!'*) printf '%s\0' "$f" ;; esac
63
done
64
}
65
66
# Builds reaper64, which stands in for exactly the i386 reaper at $1.
67
_build_reaper64() {
68
local crc
69
crc=$(python3 -c 'import sys, zlib; print(zlib.crc32(open(sys.argv[1], "rb").read()))' "$1")
70
${CC:-cc} $CPPFLAGS $CFLAGS $LDFLAGS -DSTEAM_REAPER_SIZE=$(stat -c %s "$1") -DSTEAM_REAPER_CRC32=${crc}u \
71
-o reaper64 reaper64.c -lz
72
}
73
74
# Prints the binfmt_misc rule that sends the i386 reaper at $1 to reaper64.
75
_binfmt_rule() {
76
# the whole ELF header: its entry point and section layout single the reaper out among i386 programs
77
local magic
78
magic=$(head -c 52 "$1" | od -An -v -tx1 | tr -d '\n' | sed 's/ /\\x/g')
79
echo ":$_binfmt:M::$magic::$_reaper64:P"
80
}
81
82
build() {
83
set -o pipefail
84
local tree=client
85
rm -rf $tree
86
mkdir $tree
87
for f in "${_client_zips[@]}"; do
88
bsdtar -xf "$f" -C $tree
89
done
90
# the zips carry no mode bits; the client marks programs executable
91
find $tree -type f -print0 | _programs | xargs -0 chmod +x
92
tar -C $tree --owner=0 --group=0 -cf - . | xz -T0 -0 > steam-launcher/bootstraplinux_ubuntu12_32.tar.xz
93
local reaper=$tree/steamrt64/reaper
94
_build_reaper64 $reaper
95
_binfmt_rule $reaper > $_binfmt.conf
96
}
97
98
package() {
99
depends=(
100
bash
101
coreutils
102
curl
103
dbus
104
desktop-file-utils
105
diffutils
106
freetype2
107
gdk-pixbuf2
108
glibc
109
hicolor-icon-theme
110
libgcc
111
libxcrypt
112
libxcrypt-compat
113
libxkbcommon-x11
114
lsb-release
115
lsof
116
nss
117
python
118
ttf-font
119
udev
120
usbutils
121
vulkan-driver
122
vulkan-icd-loader
123
xdg-user-dirs
124
xorg-xrandr
125
xz
126
zenity
127
zlib
128
)
129
local lib32=(
130
lib32-alsa-plugins
131
lib32-fontconfig
132
lib32-gcc-libs
133
lib32-glibc
134
lib32-libgl
135
lib32-libgpg-error
136
lib32-libnm
137
lib32-libva
138
lib32-libx11
139
lib32-libxcrypt
140
lib32-libxcrypt-compat
141
lib32-libxinerama
142
lib32-libxss
143
lib32-nss
144
lib32-pipewire
145
lib32-systemd
146
lib32-vulkan-driver
147
lib32-vulkan-icd-loader
148
)
149
optdepends=(
150
'ntsync-autoload: for NTSync support'
151
'polkit: to setup SteamVR without root access'
152
'xdg-desktop-portal-impl: file & folder picker'
153
'xorg-fonts-misc: for non-latin locales'
154
"${lib32[@]/%/: 32-bit native games, or Proton with PROTON_USE_WOW64=0}"
155
)
156
157
cd steam-launcher
158
make DESTDIR="${pkgdir}" install
159
160
mv "${pkgdir}/usr/bin/steam" "${pkgdir}/usr/lib/steam/steam"
161
sed "s/@BRANCH@/$_branch/" "${srcdir}/steam.sh" | install -Dm 755 /dev/stdin "${pkgdir}/usr/bin/steam"
162
if grep -n '@[A-Z]*@' "${pkgdir}/usr/bin/steam"; then
163
echo "steam.sh has a placeholder package() does not fill" >&2
164
return 1
165
fi
166
167
install -d "${pkgdir}/usr/share/licenses/${pkgname}"
168
ln -s ../../doc/steam/steam_subscriber_agreement.txt "${pkgdir}/usr/share/licenses/${pkgname}/"
169
install -Dm 644 debian/changelog -t "${pkgdir}/usr/share/doc/steam"
170
171
# steamrt64/reaper, which starts every game, is still i386: ValveSoftware/steam-for-linux#13015
172
install -Dm 755 "${srcdir}/reaper64" "${pkgdir}${_reaper64}"
173
install -Dm 644 "${srcdir}/${_binfmt}.conf" -t "${pkgdir}/usr/lib/binfmt.d"
174
175
local devices=subprojects/steam-devices
176
install -Dm 644 $devices/60-steam-{input,vr}.rules -t "${pkgdir}/usr/lib/udev/rules.d"
177
install -Dm 644 $devices/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.steam-devices"
178
179
# blank steamdeps because apt-get
180
ln -sf true "${pkgdir}/usr/bin/steamdeps"
181
}
182
183
# vim: ts=2 sw=2 et:
184
Changes since previous scan
--- PKGBUILD @ 2026-10-12 19:16+++ PKGBUILD @ 2026-10-17 00:21@@ -29,13 +29,14 @@ mapfile -t _client_zips < <(_manifest_values file) mapfile -t _client_sha256 < <(_manifest_values sha2) pkgver=${_launcher}.$(_manifest_values version)-pkgrel=4+pkgrel=5 pkgdesc="Valve's digital software delivery system (64-bit client beta, no lib32)" url='https://steampowered.com/' arch=('x86_64')-license=('LicenseRef-steam-subscriber-agreement')-provides=("steam=$_launcher")-conflicts=(steam)+license=('LicenseRef-steam-subscriber-agreement' 'MIT')+# steam-devices' udev rules ship here: the repo package lives in multilib only beside steam+provides=("steam=$_launcher" "steam-devices=$_launcher")+conflicts=(steam steam-devices) # the beta directory is a superset of stable and also contains the stable releases source=( https://repo.steampowered.com/steam/archive/beta/steam_${_launcher}{.tar.gz,.dsc}@@ -114,8 +115,8 @@ lsof nss python- steam-devices ttf-font+ udev usbutils vulkan-driver vulkan-icd-loader@@ -171,6 +172,10 @@ install -Dm 755 "${srcdir}/reaper64" "${pkgdir}${_reaper64}" install -Dm 644 "${srcdir}/${_binfmt}.conf" -t "${pkgdir}/usr/lib/binfmt.d" + local devices=subprojects/steam-devices+ install -Dm 644 $devices/60-steam-{input,vr}.rules -t "${pkgdir}/usr/lib/udev/rules.d"+ install -Dm 644 $devices/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.steam-devices"+ # blank steamdeps because apt-get ln -sf true "${pkgdir}/usr/bin/steamdeps" }Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |
| 2026-10-13 00:23:45 | Low | 3 |
| 2026-10-12 21:17:14 | Low | 3 |
| 2026-10-12 21:14:41 | Medium | 2 |
| 2026-10-12 19:16:59 | Low | 3 |
| 2026-10-12 19:14:29 | Medium | 2 |