veloren-nightly

LOW

maintainer LuckyTurtleDev 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The download from download.veloren.net is used only to determine the git commit hash to check out from the official project repository, which is then built from source; the host is not whitelisted but the action is part of a normal build process with no execution of prebuilt binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The download from download.veloren.net is used only to determine the git commit hash to check out from the official project repository, which is then built from source; the host is not whitelisted but the action is part of a normal build process with no execution of prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:30 git checkout $(wget -qO - https://download.veloren.net/version/linux/x86_64/weekly)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:    Lukas1818 aur at lukas1818 dot de
    
      2# Co-Maintainer: LunarEclipse <luna@lunareclipse.zone>
    
      3
    
      4pkgname=veloren-nightly
    
      5pkgver=0.18.0.r232.91b6ece408
    
      6pkgrel=1
    
      7pkgdesc="An open-world, open-source multiplayer voxel RPG. Version matches official server."
    
      8arch=('x86_64' 'i686')
    
      9url='https://veloren.net/'
    
      10license=('GPL3')
    
      11options=('!strip') # This makes debugging issues easier sometimes, comment out if small package size is needed
    
      12depends=('alsa-lib' 'glslang' 'libxkbcommon-x11' 'vulkan-icd-loader')
    
      13optdepends=(
    
      14    'pulseaudio-alsa: audio support on pulseaudio'
    
      15    'pipewire-alsa: audio support on pipewire'
    
      16)
    
      17makedepends=('git' 'git-lfs' 'rustup' 'cairo' 'pango' 'atk' 'gdk-pixbuf2' 'python' 'openssl' 'cmake' 'udev' 'mold')
    
      18provides=('veloren')
    
      19conflicts=('veloren')
    
      20_repo='https://gitlab.com/veloren/veloren.git'
    
      21source=()
    
      22noextract=()
    
      23sha512sums=()
    
      24
    
      25prepare() {
    
      26    cd "$srcdir"
    
      27    git clone "$_repo" "$pkgname" || true
    
      28    cd "$pkgname"
    
      29    git fetch
    
      30    git checkout $(wget -qO - https://download.veloren.net/version/linux/x86_64/weekly)
    
      31    git lfs install --local
    
      32    git lfs fetch
    
      33    git lfs checkout
    
      34}
    
      35
    
      36pkgver() {
    
      37    cd "$srcdir/$pkgname"
    
      38    git describe --long --match 'v*' | sed 's/\([^-]*-\)g/r\1/;s/-/./g;s/v//'
    
      39}
    
      40
    
      41build() {
    
      42    cd "$srcdir/$pkgname"
    
      43    export VELOREN_USERDATA_STRATEGY='system'
    
      44    cargo build --release --bin veloren-voxygen --no-default-features --features="default-publish"
    
      45    cargo build --release --bin veloren-server-cli
    
      46}
    
      47
    
      48package() {
    
      49    install -D "$srcdir/$pkgname/target/release/veloren-voxygen" -t "$pkgdir/usr/bin"
    
      50    install -D "$srcdir/$pkgname/target/release/veloren-server-cli" -t "$pkgdir/usr/bin"
    
      51    mkdir -p "$pkgdir/usr/share/veloren"
    
      52    cp -a "$srcdir/$pkgname/assets" "$pkgdir/usr/share/veloren/"
    
      53    install -Dm 644 "$srcdir/$pkgname/assets/voxygen/net.veloren.veloren.desktop" -t "$pkgdir/usr/share/applications"
    
      54    install -Dm 644 "$srcdir/$pkgname/assets/voxygen/net.veloren.veloren.png" -t "$pkgdir/usr/share/pixmaps/"
    
      55    install -Dm 644 "$srcdir/$pkgname/assets/voxygen/net.veloren.veloren.metainfo.xml" -t "$pkgdir/usr/share/metainfo"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2