syrinscape-online-player

maintainer tgm4883 · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD downloads a proprietary prebuilt binary tarball from the official syrinscape.com domain using a custom DLAGENT that follows a redirect from the vendor's own download endpoint. The sha256sum for the tarball is hardcoded and verified, which is the primary integrity check. The custom DLAGENT is unusual but not malicious — it simply follows a vendor redirect to fetch the actual tarball URL, which is a common pattern for proprietary software that uses token-based or redirect-based download links. The 'local://' source for the desktop file means it must already exist locally (it's not fetched from the network), so SKIP for its checksum is acceptable. The host is official (syrinscape.com), the tarball has a pinned sha256sum, and the indirect download method is a workaround for the vendor's redirect-based download system rather than a supply-chain risk. The main concern is that the DLAGENT overrides ALL https downloads globally during the build, which is sloppy and could affect other sources if added, but in practice only one https source exists here. This is low-risk sloppy packaging, not a genuine supply-chain threat.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The PKGBUILD downloads a proprietary prebuilt binary tarball from the official syrinscape.com domain using a custom DLAGENT that follows a redirect from the vendor's own download endpoint. The sha256sum for the tarball is hardcoded and verified, which is the primary integrity check. The custom DLAGENT is unusual but not malicious — it simply follows a vendor redirect to fetch the actual tarball URL, which is a common pattern for proprietary software that uses token-based or redirect-based download links. The 'local://' source for the desktop file means it must already exist locally (it's not fetched from the network), so SKIP for its checksum is acceptable. The host is official (syrinscape.com), the tarball has a pinned sha256sum, and the indirect download method is a workaround for the vendor's redirect-based download system rather than a supply-chain risk. The main concern is that the DLAGENT overrides ALL https downloads globally during the build, which is sloppy and could affect other sources if added, but in practice only one https source exists here. This is low-risk sloppy packaging, not a genuine supply-chain threat.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:23 /usr/bin/curl "https://syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-online.tar.gz?type=linux&version=${pkgver//_/-}" 2>&1 | /usr/bin/grep -P "\tlocation.href" | /usr/bin/cut -d "'" -f 2 | /usr/bin/xargs -n1 /usr/bin/curl -o syrinscape-${pkgver//_/-}-linux-online.tar.gz

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("syrinscape-${pkgver//_/-}-linux-online.tar.gz::https://www.syrinscape.com/online/"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Thomas Mashos <thomas at mashos dot com>
    
      2pkgname=syrinscape-online-player
    
      3pkgver=1.5.0_p1
    
      4pkgrel=1
    
      5pkgdesc="Soundscape creator and sound design app for online games"
    
      6arch=('x86_64')
    
      7url="https://www.syrinscape.com"
    
      8license=('Proprietary')
    
      9groups=()
    
      10makedepends=('recode')
    
      11depends=()
    
      12options=(!strip)
    
      13source=("syrinscape-${pkgver//_/-}-linux-online.tar.gz::https://www.syrinscape.com/online/"
    
      14        "local://syrinscape-online-player.desktop"
    
      15        )
    
      16sha256sums=('77af8ad0b582063c2ee8da849e1c029c86953cce1f6e297ef38f551bb4774a6c'  ## syrinscape-${pkgver//_/-}-linux-online.tar.gz
    
      17            'SKIP'  ## syrinscape-online-player.desktop
    
      18          ) 
    
      19
    
      20# Look away, this is gross
    
      21download_func() {
    
      22  #/usr/bin/curl "https://syrinscape.com/online/" 2>&1 | /usr/bin/grep "tar.gz" | /usr/bin/cut -d '"' -f 2 | /usr/bin/recode html..ascii | /usr/bin/xargs -n1 /usr/bin/curl -o syrinscape-${pkgver//_/-}-linux-online.tar.gz
    
      23  /usr/bin/curl "https://syrinscape.com/get-download/syrinscape-${pkgver//_/-}-linux-online.tar.gz?type=linux&version=${pkgver//_/-}" 2>&1 | /usr/bin/grep -P "\tlocation.href" | /usr/bin/cut -d "'" -f 2 | /usr/bin/xargs -n1 /usr/bin/curl -o syrinscape-${pkgver//_/-}-linux-online.tar.gz
    
      24}
    
      25export -f download_func; export pkgver; DLAGENTS=('https::/bin/bash -c download_func %o %u')
    
      26
    
      27prepare() {
    
      28  mkdir -p "${srcdir}/usr/share/applications"
    
      29  cp "syrinscape-online-player.desktop" "${srcdir}/usr/share/applications/syrinscape-online-player.desktop"
    
      30  sed -i "s/VERSIONNUM/${pkgver//_/-}/g" "${srcdir}/usr/share/applications/syrinscape-online-player.desktop"
    
      31}
    
      32
    
      33package() {
    
      34  mkdir -p "${pkgdir}/opt"
    
      35  mv "Syrinscape Online Player" "${pkgdir}/opt/Syrinscape Online Player"
    
      36
    
      37  mkdir -p "${pkgdir}/usr/share/applications"
    
      38  mv "usr/share/applications/syrinscape-online-player.desktop" "${pkgdir}/usr/share/applications/syrinscape-online-player.desktop"
    
      39}
    
      40
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3