syrinscape-boardgame-player

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

• PKGBUILD:21 /usr/bin/curl "https://syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz?type=linux&version=${pkgver//_/-}" 2>&1 | /usr/bin/grep -P "\tlocation.href" | /usr/bin/cut -d "'" -f 2 | /usr/bin/xargs -n1 /usr/bin/curl -o syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz::https://www.syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-scifi.tar.gz?type=linux&version=${pkgver//_/-}"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt proprietary binary from syrinscape.com, which is the official vendor domain. The sha256sum is pinned for the tarball, providing integrity verification. However, the custom DLAGENTS trick is notable: it overrides the https download agent with a bash function that first fetches a redirect URL via curl/grep/cut/xargs, then downloads the actual binary from whatever URL is extracted from the response. This means the actual binary downloaded could come from any host returned in the redirect (e.g., a CDN or S3 bucket), and that secondary URL is not integrity-checked independently — only the final file hash is checked. The sha256sum check does provide a meaningful integrity guarantee for the final artifact, which mitigates the redirect concern significantly. The pattern is unusual and 'gross' as the maintainer admits, but the end result is a hash-verified binary from the official vendor. This is a medium concern due to the indirect download mechanism and prebuilt binary execution, but not high since the checksum is present and the domain is the official vendor site.