syrinscape-fantasy-player

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

• PKGBUILD:21 /usr/bin/curl "https://syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-fantasy.tar.gz?type=linux&version=${pkgver//_/-}" 2>&1 | /usr/bin/grep -P "\tlocation.href" | /usr/bin/cut -d "'" -f 2 | /usr/bin/xargs -n1 /usr/bin/curl -o syrinscape-${pkgver//_/-}-linux-fantasy.tar.gz

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 source=("syrinscape-${pkgver//_/-}-linux-fantasy.tar.gz::https://www.syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-scifi.tar.gz?type=linux&version=${pkgver//_/-}"

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs a proprietary prebuilt binary (a Syrinscape player tarball) from the official vendor domain syrinscape.com, which is legitimate. However, the custom DLAGENT is genuinely unusual and worth noting: it overrides ALL https:// downloads with a bash function that first fetches a page, greps for a JavaScript redirect URL, then fetches the actual binary from that redirected URL. This means the actual binary URL is not known at review time and is not covered by the sha256sum in source=() — the checksum listed is for the fantasy tarball but the source=() entry actually points to the scifi URL (note the mismatch: source uses 'linux-scifi' but the filename says 'linux-fantasy', while download_func fetches 'linux-fantasy'). The sha256sum provides some integrity guarantee for whatever ends up downloaded, but the redirect-following download mechanism bypasses normal makepkg verification and the source URL mismatch is a red flag. This is a real, if probably unintentional, supply-chain concern: the binary actually installed comes from a dynamically resolved redirect URL, not the checksummed source entry. The vendor domain is official, so this is not clearly malicious, but the pattern is a genuine medium-risk packaging issue.