vegalinux64

LOW

maintainer emiliano.bovetti 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a source tarball from the project's official domain (vegachess.com), which is plausibly the project's own release infrastructure; despite the static analyzer flag for a non-standard host, the domain matches the upstream URL and the download is for building the project's own source, making it a normal AUR packaging practice with low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the project's official domain (vegachess.com), which is plausibly the project's own release infrastructure; despite the static analyzer flag for a non-standard host, the domain matches the upstream URL and the download is for building the project's own source, making it a normal AUR packaging practice with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_x86_64=("vegalinux64-${pkgver}.tar.gz::https://www.vegachess.com/dwn/vegalinux64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Oshgnacknak <osh@oshgnacknak.de>
    
      2pkgname=vegalinux64
    
      3pkgver=12.1.13
    
      4pkgrel=1
    
      5epoch=2
    
      6pkgdesc="Chess tournament administration sorfware"
    
      7arch=('x86_64')
    
      8url="https://www.vegachess.com"
    
      9license=('Custom')
    
      10depends=('java-runtime'
    
      11         'libmariadbclient')
    
      12makedepends=()
    
      13source=('vegachess.desktop'
    
      14        'vegateam.desktop'
    
      15        'logo.png')
    
      16sha256sums=('7ed253af097df983fc1ead3b77cd0ebb443696b32a0c50399d316f31e4b1c51b'
    
      17            'e6b762f998a4cf88e7b52a4a7884c58c55cf0939e7077f1d038868a2706115fc'
    
      18            'ac0385b28ad27877947913ae486d619f39c495d4e69369066e7e10755247bfc6')
    
      19sha256sums_x86_64=('f65e5807debb6870c7ab09b90130d5c9e2717a786f550bfc6c3ad41a80ab83a7')
    
      20source_x86_64=("vegalinux64-${pkgver}.tar.gz::https://www.vegachess.com/dwn/vegalinux64.tar.gz")
    
      21options=('!strip' '!debug')
    
      22
    
      23package() {
    
      24  install --directory \
    
      25    "${pkgdir}/usr/bin" \
    
      26    "${pkgdir}/usr/share/applications" \
    
      27    "${pkgdir}/usr/share/vegalinux64"
    
      28
    
      29  cp \
    
      30    "${srcdir}/vegachess.desktop" \
    
      31    "${srcdir}/vegateam.desktop" \
    
      32    "${pkgdir}/usr/share/applications"
    
      33
    
      34  cp "${srcdir}/logo.png" "${pkgdir}/usr/share/vegalinux64"
    
      35
    
      36  cp -r "${srcdir}/vegalinux64" "${pkgdir}/usr/share"
    
      37
    
      38  ln -s /usr/share/vegalinux64/Vega "${pkgdir}/usr/bin/Vega"
    
      39  ln -s /usr/share/vegalinux64/VegaTeam "${pkgdir}/usr/bin/VegaTeam"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-06-20 00:50
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,8 @@
 # Maintainer: Oshgnacknak <osh@oshgnacknak.de>
 pkgname=vegalinux64
-pkgver=20260204
-pkgrel=2
+pkgver=12.1.13
+pkgrel=1
+epoch=2
 pkgdesc="Chess tournament administration sorfware"
 arch=('x86_64')
 url="https://www.vegachess.com"
@@ -15,12 +16,9 @@
 sha256sums=('7ed253af097df983fc1ead3b77cd0ebb443696b32a0c50399d316f31e4b1c51b'
             'e6b762f998a4cf88e7b52a4a7884c58c55cf0939e7077f1d038868a2706115fc'
             'ac0385b28ad27877947913ae486d619f39c495d4e69369066e7e10755247bfc6')
-sha256sums_x86_64=('fbc818ee12930c95761b375fc71cb69489b02072b8a8ff2eed14a6f396a0bcf7')
-source_x86_64=("vegalinux64-${pkgver}.tar.gz::http://www.vegachess.com/download/vegalinux64.tar.gz")
-
-pkgver() {
-  date '+%Y%m%d'
-}
+sha256sums_x86_64=('f65e5807debb6870c7ab09b90130d5c9e2717a786f550bfc6c3ad41a80ab83a7')
+source_x86_64=("vegalinux64-${pkgver}.tar.gz::https://www.vegachess.com/dwn/vegalinux64.tar.gz")
+options=('!strip' '!debug')
 
 package() {
   install --directory \
@@ -28,14 +26,14 @@
     "${pkgdir}/usr/share/applications" \
     "${pkgdir}/usr/share/vegalinux64"
 
-  cp -v \
+  cp \
     "${srcdir}/vegachess.desktop" \
     "${srcdir}/vegateam.desktop" \
     "${pkgdir}/usr/share/applications"
 
-  cp -v "${srcdir}/logo.png" "${pkgdir}/usr/share/vegalinux64"
+  cp "${srcdir}/logo.png" "${pkgdir}/usr/share/vegalinux64"
 
-  cp -rv "${srcdir}/vegalinux64" "${pkgdir}/usr/share"
+  cp -r "${srcdir}/vegalinux64" "${pkgdir}/usr/share"
 
   ln -s /usr/share/vegalinux64/Vega "${pkgdir}/usr/bin/Vega"
   ln -s /usr/share/vegalinux64/VegaTeam "${pkgdir}/usr/bin/VegaTeam"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 12:14:12	Medium	1
2026-06-20 00:50:07	Clean	2
2026-06-20 00:18:46	Medium	2
2026-06-19 23:51:18	Medium	2
2026-06-19 19:07:35	Low	2
2026-06-19 18:54:17	Low	2
2026-06-18 16:11:54	Medium	1