uplink

maintainer heftig · 9 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host hosts only supplemental data (a PDF manual and a patch), while the main executable comes from a bundled file (uplink.zip) provided by the user, making the risk low despite the untrusted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host hosts only supplemental data (a PDF manual and a patch), while the main executable comes from a bundled file (uplink.zip) provided by the user, making the risk low despite the untrusted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 https://pkgbuild.com/~heftig/uplink/UplinkBoBCodeCard.pdf

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
    
      2
    
      3pkgname=uplink
    
      4pkgver=1.55
    
      5pkgrel=6
    
      6pkgdesc="Trust is a weakness (original CD release)"
    
      7url="https://www.introversion.co.uk/introversion/#games:~:text=Uplink"
    
      8arch=(x86_64)
    
      9license=(LicenseRef-Proprietary)
    
      10depends=(
    
      11  bash
    
      12  lib32-freetype2
    
      13  lib32-gcc-libs
    
      14  lib32-glibc
    
      15  lib32-glu
    
      16  lib32-libgl
    
      17  lib32-libjpeg6-turbo
    
      18  lib32-sdl12-compat
    
      19  lib32-sdl_mixer
    
      20  lib32-zlib
    
      21)
    
      22makedepends=(
    
      23  patchelf
    
      24)
    
      25source=(
    
      26  # Requires uplink.zip from original Uplink CD
    
      27  file://uplink.zip
    
      28  https://pkgbuild.com/~heftig/uplink/UplinkBoBCodeCard.pdf
    
      29  https://pkgbuild.com/~heftig/uplink/uplink-patch-1.55.tar.gz
    
      30)
    
      31sha256sums=('52d5b1efaecca11b400c2ab7755924a8034c09a4edd201737ba61da6bc479c02'
    
      32            'e5734f6c394b8eaa3a3449f4d4a6df0fefa4675fb8e8a515f83e4a3b710d528a'
    
      33            '147f41468b0d837a168c760d045b23eecd95a7936fca239d3bea78be0a1936a0')
    
      34noextract=(
    
      35  # contains an "uplink" executable which conflicts
    
      36  # with the "uplink" directory in the patch archive
    
      37  uplink.zip
    
      38)
    
      39
    
      40prepare() {
    
      41  bsdtar -xf uplink.zip '*.dat'
    
      42  patchelf --set-rpath '$ORIGIN' uplink/lib/{uplink.bin.x86,libftgl.so.0}
    
      43}
    
      44
    
      45package() {
    
      46  local gamedir="$pkgdir/usr/lib/uplink"
    
      47  install -Dm755 uplink/lib/{uplink.bin.x86,libftgl.so.0} -t "$gamedir"
    
      48  install -Dm644 *.dat -t "$gamedir"
    
      49  install -Dm644 uplink/lib/*.dat -t "$gamedir"
    
      50
    
      51  install -Dm755 /dev/stdin "$pkgdir/usr/bin/uplink" <<END
    
      52#!/bin/sh
    
      53exec /usr/lib/uplink/uplink.bin.x86 "\$@"
    
      54END
    
      55  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/uplink.desktop" <<END
    
      56[Desktop Entry]
    
      57Name=Uplink
    
      58GenericName=Futuristic computer crime game.
    
      59Comment=Trust is a weakness.
    
      60Encoding=UTF-8
    
      61Version=1.55
    
      62Type=Application
    
      63Terminal=false
    
      64Icon=uplink
    
      65Exec=/usr/lib/uplink/uplink.bin.x86
    
      66Categories=Application;Game;
    
      67END
    
      68  install -Dm644 uplink/uplink.png -t "$pkgdir/usr/share/pixmaps"
    
      69
    
      70  install -Dm644 UplinkBoBCodeCard.pdf uplink/[^l]*.{txt,patch} -t "$pkgdir/usr/share/doc/$pkgname"
    
      71  install -Dm644 uplink/license.txt -t "$pkgdir/usr/share/licenses/$pkgname"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2