typhoon_2001

maintainer McLenin · 6 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt binary ('typhoon') from Dropbox, a personal/unofficial file-hosting service. The binary is executed directly (chmod a+x, installed to /usr/bin and /usr/share). While MD5 checksums are present, MD5 is cryptographically weak and Dropbox links can be silently replaced by the link owner. The upstream project URL (kuto.de) does not match the Dropbox source host, meaning there is no way to verify these are authentic official releases. This is a genuine supply-chain concern: an untrusted prebuilt binary from a non-official host installed system-wide. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://www.dropbox.com/s/q57ev217t83bi4z/typhoon_2001_r3992.tar.gz" "https://www.dropbox.com/s/ac7ioyle250h8zr/typhoon_add.tar.gz?dl=0")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads and installs a prebuilt binary ('typhoon') from Dropbox, a personal/unofficial file-hosting service. The binary is executed directly (chmod a+x, installed to /usr/bin and /usr/share). While MD5 checksums are present, MD5 is cryptographically weak and Dropbox links can be silently replaced by the link owner. The upstream project URL (kuto.de) does not match the Dropbox source host, meaning there is no way to verify these are authentic official releases. This is a genuine supply-chain concern: an untrusted prebuilt binary from a non-official host installed system-wide. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Typhoon PKGBUILD
    
      2# Contributer: Klepto <geomoch@gmail.com>
    
      3# Redone, updated and  maintained by McLenin <mclenin at gooogles email>
    
      4
    
      5pkgname=typhoon_2001
    
      6pkgver=r3992
    
      7pkgrel=5
    
      8pkgdesc="A fast paced 3D shoot-em-up based on Tempest 2000"
    
      9arch=("i686" "x86_64")
    
      10url="http://www.kuto.de/projekte_typhoon.html"
    
      11license=("unknown freeware")
    
      12options=(!strip)
    
      13install=typhoon_2001.install
    
      14depends_i686+=("flac" "glu" "libpulse" "libvorbis" "libxcursor" "libxpm" "libxrender" "mesa")
    
      15depends_x86_64+=("lib32-flac" "lib32-glu" "lib32-libpulse" "lib32-libvorbis" "lib32-libxcursor" "lib32-libxpm" "lib32-libxrender" "lib32-mesa" )
    
      16source=("https://www.dropbox.com/s/q57ev217t83bi4z/typhoon_2001_r3992.tar.gz" "https://www.dropbox.com/s/ac7ioyle250h8zr/typhoon_add.tar.gz?dl=0")
    
      17md5sums=('d83d89570a18ef121776442baef00647'
    
      18         'b02d2ea8fcfed6f065cf1837723c03da')
    
      19
    
      20package() {
    
      21        install -dm777 "$pkgdir"/usr/share/$pkgname        
    
      22        install -d "$pkgdir"{/usr/share/$pkgname/game/,/usr/share/applications/,/usr/bin/}
    
      23        cp -r  $srcdir/game/*         $pkgdir/usr/share/$pkgname/game/
    
      24        install -m644 $srcdir/*.mod  $pkgdir/usr/share/$pkgname/
    
      25        install -m644 $srcdir/*.dat  $pkgdir/usr/share/$pkgname/
    
      26        install -m644 $srcdir/*.txt  $pkgdir/usr/share/$pkgname/
    
      27
    
      28        chmod a+x $srcdir/typhoon
    
      29        ls -all  $srcdir/typhoon
    
      30        cp  -a $srcdir/typhoon $pkgdir/usr/share/$pkgname/typhoon
    
      31
    
      32       # md5sum $pkgdir/usr/share/$pkgname/typhoon       
    
      33
    
      34	install -Dm644   $srcdir/$pkgname.png         $pkgdir/usr/share/$pkgname/
    
      35	install -Dm644   $srcdir/$pkgname.desktop      $pkgdir/usr/share/applications/
    
      36	install -Dm755   $srcdir/$pkgname              $pkgdir/usr/bin/
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2