syrinscape-boardgame-player
The PKGBUILD downloads a prebuilt proprietary binary from syrinscape.com, which is the official vendor domain. The sha256sum is pinned for the tarball, providing integrity verification. However, the custom DLAGENTS trick is notable: it overrides the https download agent with a bash function that first fetches a redirect URL via curl/grep/cut/xargs, then downloads the actual binary from whatever URL is extracted from the response. This means the actual binary downloaded could come from any host returned in the redirect (e.g., a CDN or S3 bucket), and that secondary URL is not integrity-checked independently — only the final file hash is checked. The sha256sum check does provide a meaningful integrity guarantee for the final artifact, which mitigates the redirect concern significantly. The pattern is unusual and 'gross' as the maintainer admits, but the end result is a hash-verified binary from the official vendor. This is a medium concern due to the indirect download mechanism and prebuilt binary execution, but not high since the checksum is present and the domain is the official vendor site.
Triggered rules
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:21
/usr/bin/curl "https://syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz?type=linux&version=${pkgver//_/-}" 2>&1 | /usr/bin/grep -P "\tlocation.href" | /usr/bin/cut -d "'" -f 2 | /usr/bin/xargs -n1 /usr/bin/curl -o syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
source=("syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz::https://www.syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-scifi.tar.gz?type=linux&version=${pkgver//_/-}"
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt proprietary binary from syrinscape.com, which is the official vendor domain. The sha256sum is pinned for the tarball, providing integrity verification. However, the custom DLAGENTS trick is notable: it overrides the https download agent with a bash function that first fetches a redirect URL via curl/grep/cut/xargs, then downloads the actual binary from whatever URL is extracted from the response. This means the actual binary downloaded could come from any host returned in the redirect (e.g., a CDN or S3 bucket), and that secondary URL is not integrity-checked independently — only the final file hash is checked. The sha256sum check does provide a meaningful integrity guarantee for the final artifact, which mitigates the redirect concern significantly. The pattern is unusual and 'gross' as the maintainer admits, but the end result is a hash-verified binary from the official vendor. This is a medium concern due to the indirect download mechanism and prebuilt binary execution, but not high since the checksum is present and the domain is the official vendor site.
PKGBUILD
2 offending line(s) highlighted# Maintainer: Thomas Mashos <thomas at mashos dot com>
pkgname=syrinscape-boardgame-player
pkgver=1.5.0_p1
pkgrel=1
pkgdesc="Soundscape creator and sound design app for boardgame games"
arch=('x86_64')
url="https://www.syrinscape.com"
license=('Proprietary')
groups=()
depends=()
options=(!strip)
source=("syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz::https://www.syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-scifi.tar.gz?type=linux&version=${pkgver//_/-}"
"local://syrinscape-boardgame-player.desktop"
)
sha256sums=('dfa03eef76673b2a167864c1bb50cce3eee6c7e70fb8b5b78eb9cc346af0019e' ## syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz
'SKIP' ## syrinscape-boardgame-player.desktop
)
# Look away, this is gross
download_func() {
/usr/bin/curl "https://syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz?type=linux&version=${pkgver//_/-}" 2>&1 | /usr/bin/grep -P "\tlocation.href" | /usr/bin/cut -d "'" -f 2 | /usr/bin/xargs -n1 /usr/bin/curl -o syrinscape-${pkgver//_/-}-linux-boardgame.tar.gz
}
export -f download_func; export pkgver; DLAGENTS=('https::/bin/bash -c download_func %o %u')
prepare() {
mkdir -p "${srcdir}/usr/share/applications"
cp "syrinscape-boardgame-player.desktop" "${srcdir}/usr/share/applications/syrinscape-boardgame-player.desktop"
sed -i "s/VERSIONNUM/${pkgver//_/-}/g" "${srcdir}/usr/share/applications/syrinscape-boardgame-player.desktop"
}
package() {
mkdir -p "${pkgdir}/opt"
mv "Syrinscape Board Game Player" "${pkgdir}/opt/Syrinscape Board Game Player"
mkdir -p "${pkgdir}/usr/share/applications"
mv "usr/share/applications/syrinscape-boardgame-player.desktop" "${pkgdir}/usr/share/applications/syrinscape-boardgame-player.desktop"
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 3 |
| 2026-09-16 00:03:17 | Medium | 3 |
| 2026-09-15 00:25:31 | Medium | 3 |
| 2026-09-14 00:27:57 | Medium | 3 |
| 2026-09-13 00:19:54 | Medium | 3 |
| 2026-09-12 00:25:17 | Medium | 3 |
| 2026-09-11 00:19:22 | Medium | 3 |
| 2026-09-10 00:22:44 | Medium | 3 |
| 2026-09-09 00:04:09 | Medium | 3 |
| 2026-09-08 00:18:08 | Medium | 3 |
| 2026-09-07 00:30:15 | Medium | 3 |
| 2026-09-06 00:17:06 | Medium | 3 |
| 2026-09-05 00:16:27 | Medium | 3 |
| 2026-09-04 00:03:13 | Medium | 3 |
| 2026-09-03 00:15:47 | Medium | 3 |
| 2026-09-02 00:02:31 | Medium | 3 |
| 2026-09-01 00:11:19 | Medium | 3 |
| 2026-08-31 00:19:57 | Medium | 3 |
| 2026-08-30 00:04:14 | Medium | 3 |
| 2026-08-29 00:29:17 | Medium | 3 |