streamcraft

MEDIUM

maintainer lapsus 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The JAR is downloaded from an S3 bucket (s3.streamcraft.net) that is a personal/project-controlled object store rather than a well-known official release infrastructure, and the package description explicitly states the bootstrap 'self-downloads' additional JRE and game payload at runtime from unspecified sources with no checksum verification possible; the prebuilt JAR itself runs arbitrary code at launch time, making a silently swapped artifact a realistic supply-chain risk.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:29 curl -fsSL "https://streamcraft.net/api/pages/download" |

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("streamcraft-bootstrap-${pkgver}.jar::https://s3.streamcraft.net/uploads/launcher-download/streamcraft-bootstrap-${pkgver}-all.jar"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 70%): The JAR is downloaded from an S3 bucket (s3.streamcraft.net) that is a personal/project-controlled object store rather than a well-known official release infrastructure, and the package description explicitly states the bootstrap 'self-downloads' additional JRE and game payload at runtime from unspecified sources with no checksum verification possible; the prebuilt JAR itself runs arbitrary code at launch time, making a silently swapped artifact a realistic supply-chain risk.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=streamcraft
    
      4pkgver=2.0.1
    
      5pkgrel=1
    
      6pkgdesc="Proprietary Minecraft launcher (Linux bootstrap)"
    
      7# x86_64 only: the bootstrap self-downloads an x64-only JRE8 and game payload at
    
      8# runtime (no aarch64 Linux runtime is offered upstream), so it only functions
    
      9# there. Contents are arch-independent (a JAR), hence namcap's "no ELF / not any"
    
      10# warning; x86_64 is the honest, broken-on-ARM-preventing choice.
    
      11arch=('x86_64')
    
      12url="https://streamcraft.net"
    
      13# Proprietary: upstream ships no license/EULA file, so none is installed (blocker).
    
      14license=('LicenseRef-proprietary')
    
      15# gtk2: the launcher is JavaFX 8 forced to GTK2 by the wrapper (see streamcraft.sh).
    
      16depends=('java-runtime>=8' 'gtk2' 'hicolor-icon-theme')
    
      17source=("streamcraft-bootstrap-${pkgver}.jar::https://s3.streamcraft.net/uploads/launcher-download/streamcraft-bootstrap-${pkgver}-all.jar"
    
      18        'streamcraft.sh'
    
      19        'streamcraft.desktop')
    
      20noextract=("streamcraft-bootstrap-${pkgver}.jar")
    
      21sha256sums=('62aa9ff211577d278ebb696e523c247e3e877bfecb47b1dee15dab50180a7b0c'
    
      22            '4541ed1ffd1bed4f0ac74b3c240bf0daf76429c4d8d1b15271d3d686f265f556'
    
      23            'e842335b2abfc3cee9f7765d36a219446348ce1b653958b8048d7b3bb9ea1e86')
    
      24options=('!debug')
    
      25
    
      26# Canonical version source: the download page API embeds the Linux bootstrap
    
      27# jar filename with its version (plain curl, no auth).
    
      28latestver() {
    
      29    curl -fsSL "https://streamcraft.net/api/pages/download" |
    
      30        grep -aoE 'streamcraft-bootstrap-[0-9.]+-all\.jar' |
    
      31        grep -aoE '[0-9]+(\.[0-9]+)+' | sort -V | tail -1
    
      32}
    
      33
    
      34package() {
    
      35    install -Dm644 "streamcraft-bootstrap-${pkgver}.jar" \
    
      36        "${pkgdir}/usr/share/streamcraft/streamcraft-bootstrap.jar"
    
      37    install -Dm755 streamcraft.sh "${pkgdir}/usr/bin/streamcraft"
    
      38    install -Dm644 streamcraft.desktop "${pkgdir}/usr/share/applications/streamcraft.desktop"
    
      39    bsdtar -xOf "streamcraft-bootstrap-${pkgver}.jar" assets/icons/icon.png |
    
      40        install -Dm644 /dev/stdin "${pkgdir}/usr/share/icons/hicolor/64x64/apps/streamcraft.png"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	3
2026-09-16 00:03:17	Medium	3
2026-09-15 00:25:31	Medium	3
2026-09-14 00:27:57	Medium	3
2026-09-13 00:19:54	Medium	3
2026-09-12 00:25:17	Medium	3
2026-09-11 00:19:22	Medium	3
2026-09-10 00:22:44	Medium	3
2026-09-09 00:04:09	Medium	3
2026-09-08 00:18:08	Medium	3
2026-09-07 00:30:15	Medium	3
2026-09-06 00:17:06	Medium	3
2026-09-05 00:16:27	Medium	3
2026-09-04 00:03:13	Medium	3
2026-09-03 00:15:47	Medium	3
2026-09-02 00:02:31	Medium	3
2026-09-01 00:11:19	Medium	3
2026-08-31 00:19:57	Medium	3
2026-08-30 00:04:14	Medium	3
2026-08-29 00:29:17	Medium	3