streamcraft

maintainer lapsus · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The JAR is downloaded from an S3 bucket (s3.streamcraft.net) that is a personal/project-controlled object store rather than a well-known official release infrastructure, and the package description explicitly states the bootstrap 'self-downloads' additional JRE and game payload at runtime from unspecified sources with no checksum verification possible; the prebuilt JAR itself runs arbitrary code at launch time, making a silently swapped artifact a realistic supply-chain risk.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:29 curl -fsSL "https://streamcraft.net/api/pages/download" |

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("streamcraft-bootstrap-${pkgver}.jar::https://s3.streamcraft.net/uploads/launcher-download/streamcraft-bootstrap-${pkgver}-all.jar"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 70%): The JAR is downloaded from an S3 bucket (s3.streamcraft.net) that is a personal/project-controlled object store rather than a well-known official release infrastructure, and the package description explicitly states the bootstrap 'self-downloads' additional JRE and game payload at runtime from unspecified sources with no checksum verification possible; the prebuilt JAR itself runs arbitrary code at launch time, making a silently swapped artifact a realistic supply-chain risk.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=streamcraft
    
      4pkgver=2.0.1
    
      5pkgrel=1
    
      6pkgdesc="Proprietary Minecraft launcher (Linux bootstrap)"
    
      7# x86_64 only: the bootstrap self-downloads an x64-only JRE8 and game payload at
    
      8# runtime (no aarch64 Linux runtime is offered upstream), so it only functions
    
      9# there. Contents are arch-independent (a JAR), hence namcap's "no ELF / not any"
    
      10# warning; x86_64 is the honest, broken-on-ARM-preventing choice.
    
      11arch=('x86_64')
    
      12url="https://streamcraft.net"
    
      13# Proprietary: upstream ships no license/EULA file, so none is installed (blocker).
    
      14license=('LicenseRef-proprietary')
    
      15# gtk2: the launcher is JavaFX 8 forced to GTK2 by the wrapper (see streamcraft.sh).
    
      16depends=('java-runtime>=8' 'gtk2' 'hicolor-icon-theme')
    
      17source=("streamcraft-bootstrap-${pkgver}.jar::https://s3.streamcraft.net/uploads/launcher-download/streamcraft-bootstrap-${pkgver}-all.jar"
    
      18        'streamcraft.sh'
    
      19        'streamcraft.desktop')
    
      20noextract=("streamcraft-bootstrap-${pkgver}.jar")
    
      21sha256sums=('62aa9ff211577d278ebb696e523c247e3e877bfecb47b1dee15dab50180a7b0c'
    
      22            '4541ed1ffd1bed4f0ac74b3c240bf0daf76429c4d8d1b15271d3d686f265f556'
    
      23            'e842335b2abfc3cee9f7765d36a219446348ce1b653958b8048d7b3bb9ea1e86')
    
      24options=('!debug')
    
      25
    
      26# Canonical version source: the download page API embeds the Linux bootstrap
    
      27# jar filename with its version (plain curl, no auth).
    
      28latestver() {
    
      29    curl -fsSL "https://streamcraft.net/api/pages/download" |
    
      30        grep -aoE 'streamcraft-bootstrap-[0-9.]+-all\.jar' |
    
      31        grep -aoE '[0-9]+(\.[0-9]+)+' | sort -V | tail -1
    
      32}
    
      33
    
      34package() {
    
      35    install -Dm644 "streamcraft-bootstrap-${pkgver}.jar" \
    
      36        "${pkgdir}/usr/share/streamcraft/streamcraft-bootstrap.jar"
    
      37    install -Dm755 streamcraft.sh "${pkgdir}/usr/bin/streamcraft"
    
      38    install -Dm644 streamcraft.desktop "${pkgdir}/usr/share/applications/streamcraft.desktop"
    
      39    bsdtar -xOf "streamcraft-bootstrap-${pkgver}.jar" assets/icons/icon.png |
    
      40        install -Dm644 /dev/stdin "${pkgdir}/usr/share/icons/hicolor/64x64/apps/streamcraft.png"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	4
2026-07-25 00:13:44	MEDIUM	4
2026-07-24 00:02:28	MEDIUM	4
2026-07-23 00:14:47	MEDIUM	4
2026-07-22 00:29:32	MEDIUM	4
2026-07-21 00:24:15	MEDIUM	4
2026-07-20 00:19:49	MEDIUM	4
2026-07-19 00:17:08	MEDIUM	4
2026-07-18 00:14:48	MEDIUM	4
2026-07-17 00:06:16	MEDIUM	4
2026-07-16 00:05:41	MEDIUM	4
2026-07-15 00:09:25	MEDIUM	4