steamcommunity302

MEDIUM

maintainer lingdianshiren 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a non-whitelisted, non-standard host (dogfight360.com), which is not the project's official release infrastructure (e.g., GitHub/GitLab), and the checksum is skipped for the local 's302' script, increasing supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "steamcommunity302-${pkgver}.AppImage::https://www.dogfight360.com/Usbeam/V15/Steamcommunity_302_${pkgver}_Linux_WebKit_x64.AppImage"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt AppImage from a non-whitelisted, non-standard host (dogfight360.com), which is not the project's official release infrastructure (e.g., GitHub/GitLab), and the checksum is skipped for the local 's302' script, increasing supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lingdianshiren <ldsrwu@foxmail.com>
    
      2# 上游从 tar.gz(脚本启动器)换为 linuxdeploy AppImage(Wails v3 GUI):
    
      3# - 提权内置(pkexec/polkit/sudo transient daemon),无需旧版 launcher hack
    
      4# - 捆绑 198 个库(含 webkit2gtk/GTK3),运行时依赖 fuse2
    
      5# 打包采用 AUR 主流 AppImage 方式:本体装 /opt + /usr/bin wrapper(同 obsidian-appimage)
    
      6pkgname=steamcommunity302
    
      7pkgver=15.0.4
    
      8pkgrel=1
    
      9#epoch=
    
      10pkgdesc="羽翼城制作的Steam、Github等反代加速工具,使用s302命令启动"
    
      11url="https://www.dogfight360.com/blog/18682/"
    
      12arch=('x86_64' 'aarch64')
    
      13license=('CC-BY-NC-4.0')
    
      14# nss 提供 certutil(证书导入),libnetfilter_queue 用于 DNS 重定向——
    
      15# 均为功能依赖,AppImage 捆绑库仅覆盖 GUI 层
    
      16depends=('fuse2' 'nss' 'libnetfilter_queue')
    
      17optdepends=(
    
      18  # Netfilter/DNS 重定向后端(程序提示至少安装一种)
    
      19  'iptables: Netfilter backend for DNS redirection'
    
      20  'nftables: Netfilter backend for DNS redirection'
    
      21  'firewalld: Netfilter backend for DNS redirection'
    
      22  'ufw: Netfilter backend for DNS redirection'
    
      23  # 新版内置提权(transient daemon),任选其一
    
      24  'polkit: pkexec graphical privilege elevation'
    
      25  'sudo: CLI privilege elevation'
    
      26)
    
      27source=('s302')
    
      28source_x86_64=(
    
      29  "steamcommunity302-${pkgver}.AppImage::https://www.dogfight360.com/Usbeam/V15/Steamcommunity_302_${pkgver}_Linux_WebKit_x64.AppImage"
    
      30)
    
      31source_aarch64=(
    
      32  "steamcommunity302-${pkgver}.AppImage::https://www.dogfight360.com/Usbeam/V15/Steamcommunity_302_${pkgver}_Linux_WebKit_arm64.AppImage"
    
      33)
    
      34md5sums=('SKIP')
    
      35md5sums_x86_64=('9224ec5639ad07276aeb6c4aef5a5b9e')
    
      36md5sums_aarch64=('9224ec5639ad07276aeb6c4aef5a5b9e')
    
      37options=(!strip)
    
      38install=steamcommunity302.install
    
      39
    
      40_install_dir="/opt/steamcommunity302"
    
      41
    
      42prepare() {
    
      43  # 解包 AppImage 提取 desktop 与图标(本体仍按 AppImage 安装)
    
      44  chmod +x "${srcdir}/steamcommunity302-${pkgver}.AppImage"
    
      45  "${srcdir}/steamcommunity302-${pkgver}.AppImage" --appimage-extract >/dev/null 2>&1
    
      46  local _root="${srcdir}/squashfs-root"
    
      47
    
      48  # desktop:修正 Exec 指向系统 wrapper,Icon 用安装后的 png。
    
      49  # 上游命名:15.0.3 为 com.dogfight360.steamcommunity302.desktop,
    
      50  # 15.0.4 改为 Steamcommunity_302.desktop——用 glob 兼容两种
    
      51  local _desktop
    
      52  _desktop="$(find "${_root}" -maxdepth 1 -name '*.desktop' -print -quit)"
    
      53  [ -n "$_desktop" ] || { msg2 "ERROR: 上游缺失 desktop"; return 1; }
    
      54  sed -E \
    
      55    -e 's|^[[:space:]]*Exec=.*|Exec=/usr/bin/s302|' \
    
      56    -e 's|^[[:space:]]*Icon=.*|Icon=steamcommunity302|' \
    
      57    "$_desktop" > "${srcdir}/steamcommunity302.desktop"
    
      58
    
      59  # 图标(png)
    
      60  [ -f "${_root}/com.dogfight360.steamcommunity302.png" ] || { msg2 "ERROR: 上游缺失图标"; return 1; }
    
      61  cp "${_root}/com.dogfight360.steamcommunity302.png" "${srcdir}/steamcommunity302.png"
    
      62}
    
      63
    
      64package() {
    
      65  # AppImage 本体(与旧版同目录,升级平滑)
    
      66  install -Dm755 "${srcdir}/steamcommunity302-${pkgver}.AppImage" \
    
      67    "${pkgdir}${_install_dir}/steamcommunity302.AppImage"
    
      68
    
      69  # s302 控制命令:无参/ui 开 GUI(exec AppImage),管理命令走 systemd+config
    
      70  install -Dm755 "${srcdir}/s302" "${pkgdir}/usr/bin/s302"
    
      71
    
      72  install -Dm644 "${srcdir}/steamcommunity302.desktop" \
    
      73    "${pkgdir}/usr/share/applications/steamcommunity302.desktop"
    
      74  install -Dm644 "${srcdir}/steamcommunity302.png" \
    
      75    "${pkgdir}/usr/share/pixmaps/steamcommunity302.png"
    
      76}
    
      77

Changes since previous scan

--- PKGBUILD @ 2026-09-05 00:16
+++ PKGBUILD @ 2026-09-17 00:27
@@ -24,12 +24,14 @@
   'polkit: pkexec graphical privilege elevation'
   'sudo: CLI privilege elevation'
 )
+source=('s302')
 source_x86_64=(
   "steamcommunity302-${pkgver}.AppImage::https://www.dogfight360.com/Usbeam/V15/Steamcommunity_302_${pkgver}_Linux_WebKit_x64.AppImage"
 )
 source_aarch64=(
   "steamcommunity302-${pkgver}.AppImage::https://www.dogfight360.com/Usbeam/V15/Steamcommunity_302_${pkgver}_Linux_WebKit_arm64.AppImage"
 )
+md5sums=('SKIP')
 md5sums_x86_64=('9224ec5639ad07276aeb6c4aef5a5b9e')
 md5sums_aarch64=('9224ec5639ad07276aeb6c4aef5a5b9e')
 options=(!strip)
@@ -64,13 +66,8 @@
   install -Dm755 "${srcdir}/steamcommunity302-${pkgver}.AppImage" \
     "${pkgdir}${_install_dir}/steamcommunity302.AppImage"
 
-  # wrapper:exec AppImage(依赖 fuse2)
-  install -dm755 "${pkgdir}/usr/bin"
-  cat > "${pkgdir}/usr/bin/s302" <<'EOF'
-#!/bin/bash
-exec /opt/steamcommunity302/steamcommunity302.AppImage "$@"
-EOF
-  chmod 755 "${pkgdir}/usr/bin/s302"
+  # s302 控制命令:无参/ui 开 GUI(exec AppImage),管理命令走 systemd+config
+  install -Dm755 "${srcdir}/s302" "${pkgdir}/usr/bin/s302"
 
   install -Dm644 "${srcdir}/steamcommunity302.desktop" \
     "${pkgdir}/usr/share/applications/steamcommunity302.desktop"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 14:00:22	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 07:57:01	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2