vatsim-crc
MEDIUM
maintainer nicholascw
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt Windows executable (crc-setup-*.exe) from crc.virtualnas.net, a non-whitelisted host, which is then extracted and installed; this executable is unverifiable and could be silently swapped, representing a supply-chain risk, hence medium severity.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
__realpkgver=$(curl -s https://crc.virtualnas.net/LatestVersion.json | jq -r '.version')
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt Windows executable (crc-setup-*.exe) from crc.virtualnas.net, a non-whitelisted host, which is then extracted and installed; this executable is unverifiable and could be silently swapped, representing a supply-chain risk, hence medium severity.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nicholas Wang <me at nicho1as dot wang>
2
3
### READ BEFORE YOU FLAG THIS OUT-OF-DATE
4
### This PKGBUILD automatically fetches latest version of CRC.
5
### If it does not build properly use comment and do not flag it as out-of-date.
6
7
8
pkgname=vatsim-crc
9
pkgver=2.17.4.0
10
pkgrel=1
11
pkgdesc="Consolidated Radar Client (CRC), a controller application connects to the VATSIM network through vNAS."
12
arch=("x86_64")
13
url="https://vnas.vatsim.net/crc"
14
license=('custom')
15
makedepends=('p7zip' 'jq')
16
depends=('wine' 'wine-mono' 'winetricks')
17
optdepends=('rpc-bridge: Discord Rich Presence support' 'ttf-cascadia-code' 'noto-fonts-cjk' 'umu-launcher' 'proton-ge-custom-bin')
18
install=$pkgname.install
19
options=(!debug)
20
21
__realpkgver=$(curl -s https://crc.virtualnas.net/LatestVersion.json | jq -r '.version')
22
23
source=(crc-setup-${__realpkgver}.exe::"$(curl -s https://crc.virtualnas.net/LatestVersion.json | jq -r '.installerUrl')"
24
"vatsim-crc"
25
"vatsim-crc.desktop" "segmdl2.verb" "webview2.verb" "nicfonts.verb")
26
27
sha256sums=('SKIP'
28
'c8237a3c30f40218a4502a5053a06c6994cb93ecbc47c5699d62504255a3a6c5'
29
'1ebb426abfff168706256df00a93661e2a97f2ec095c87906934538ae25a9926'
30
'ea73951541c4f66e65c7ea6c7e2349f6e93ac4f6988516308b3a2522d4751c74'
31
'4d70f0de1ce7105b21808ecb890993c05333f51a24b2b11bfa000b5abf2f129e'
32
'd5b5f4d43c19e605dc0b256e4b75b816beaaeba3c6cf5f406860d3920e4db294')
33
34
pkgver() {
35
curl -s https://crc.virtualnas.net/LatestVersion.json | jq -r '.version'
36
}
37
38
build() {
39
mkdir -p $srcdir/build
40
cd $srcdir/build
41
7z x ../crc-setup-${pkgver}.exe
42
rm Uninstall.exe
43
rm -r '$PLUGINSDIR'
44
cd $srcdir
45
7z e $srcdir/build/Application/CRC.exe .rsrc/ICON/9
46
mv 9 $pkgname.png
47
}
48
49
package() {
50
install -Ddm755 "$pkgdir/usr/share"
51
install -Ddm755 "$pkgdir/opt"
52
cp -rp "$srcdir/build" "$pkgdir/opt/vatsim-crc"
53
install -Dm644 "$srcdir"/segmdl2.verb "$pkgdir/opt/vatsim-crc/segmdl2.verb"
54
install -Dm644 "$srcdir"/webview2.verb "$pkgdir/opt/vatsim-crc/webview2.verb"
55
install -Dm644 "$srcdir"/nicfonts.verb "$pkgdir/opt/vatsim-crc/nicfonts.verb"
56
install -Dm755 "$srcdir"/vatsim-crc "$pkgdir/usr/bin/vatsim-crc"
57
install -Dm644 "$srcdir"/vatsim-crc.desktop "$pkgdir/usr/share/applications/vatsim-crc.desktop"
58
printf "Version=$pkgver-$pkgrel\n" >> $pkgdir/usr/share/applications/vatsim-crc.desktop
59
install -Dm644 "$srcdir/$pkgname.png" "$pkgdir/usr/share/pixmaps/vatsim-crc.png"
60
find $pkgdir/opt/$pkgname -type d -exec chmod 755 "{}" \;
61
find $pkgdir/opt/$pkgname -type f -exec chmod 644 "{}" \;
62
}
63
64
# bak_build() {
65
# # extract using wine
66
# unset WINEPREFIX
67
# install -m755 -d "$srcdir"/tmp "$srcdir"/tmp/env "$srcdir"/tmp/local
68
# export WINEPREFIX="$srcdir"/tmp/env
69
# export XDG_DATA_HOME="$srcdir"/tmp/local
70
# wine wineboot -u
71
# wine $srcdir/crc-setup-${pkgver}.exe /S /D="C:\vatsim-crc"
72
# }
73
74
# bak_package() {
75
# # for wine extraction method
76
# install -Ddm755 "$pkgdir/usr/share"
77
# cp -r "$srcdir/tmp/env/drive_c/vatsim-crc" "$pkgdir/usr/share/"
78
# install -Dm644 "$srcdir"/segmdl2.verb "$pkgdir/usr/share/vatsim-crc/segmdl2.verb"
79
# install -Dm755 "$srcdir"/vatsim-crc "$pkgdir/usr/bin/vatsim-crc"
80
# install -Dm644 "$srcdir"/vatsim-crc.desktop "$pkgdir/usr/share/applications/vatsim-crc.desktop"
81
# printf "Version=$pkgver-$pkgrel" >> $pkgdir/usr/share/applications/vatsim-crc.desktop
82
# iconname=$(grep Icon $srcdir/tmp/local/applications/wine/Programs/CRC/CRC.desktop)
83
# iconname=${iconname#*=}
84
# for i in 16x16 256x256 32x32 48x48; do
85
# install -Dm644 "$srcdir"/tmp/local/icons/hicolor/$i/apps/$iconname.png "$pkgdir/usr/share/icons/hicolor/$i/apps/vatsim-crc.png"
86
# done
87
# find $pkgdir/usr/share/$pkgname -type d -exec chmod 755 "{}" \;
88
# find $pkgdir/usr/share/$pkgname -type f -exec chmod 644 "{}" \;
89
# }
90
91
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |