viewfinder-launcher

LOW

maintainer dreieck 0 votes base viewfinder-gog-bin scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The non-standard host is for downloading the EULA, which is non-executable data; the actual game binaries are fetched via lgogdownloader from GOG's official infrastructure, a legitimate and expected method for GOG games on AUR.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is for downloading the EULA, which is non-executable data; the actual game binaries are fetched via lgogdownloader from GOG's official infrastructure, a legitimate and expected method for GOG games on AUR.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "thunderfulgames-EULA.html::https://thunderfulgames.com/privacy-policy/thunderfulgames-end-user-licence-agreement/"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  dreieck (https://aur.archlinux.org/account/dreieck)
    
      2
    
      3_gogname="viewfinder"
    
      4#_downloadname="viewfinder-remake"
    
      5pkgbase="viewfinder-gog-bin"
    
      6pkgname=(
    
      7  "viewfinder-data-gog-bin"
    
      8  "viewfinder-launcher"
    
      9)
    
      10pkgver=1.1.4+gog91670
    
      11pkgrel=1
    
      12epoch=0
    
      13arch=(
    
      14  'x86_64'
    
      15)
    
      16pkgdesc="A puzzle video game based on mapping photographs or other two-dimension works onto the three-dimensional space of the game's world, creating new geometries and layouts. You need a GOG account and have purchased the file through GOG; PKGBUILD might ask you for GOG login."
    
      17url="https://thunderfulgames.com/games/viewfinder/"
    
      18# url="https://en.wikipedia.org/wiki/Viewfinder_(video_game)"
    
      19groups=(
    
      20  'games'
    
      21)
    
      22makedepends=(
    
      23  'imagemagick' # to extract icon
    
      24  'innoextract'
    
      25  'lgogdownloader'
    
      26  'zopfli'      # For 'zopflipng'
    
      27)
    
      28checkdepends=()
    
      29source=(
    
      30  "viewfinder.sh"
    
      31  "viewfinder.desktop"
    
      32  "license-note-proprietary.txt"
    
      33  "thunderfulgames-EULA.html::https://thunderfulgames.com/privacy-policy/thunderfulgames-end-user-licence-agreement/"
    
      34)
    
      35sha256sums=(
    
      36  '603702ba7c13e982f2d36eacbe16930639ad49d893b9ef6e0f44dee2d3728fd9'  # viewfinder.sh
    
      37  'cdd4d852c651f228121455a97c3f293b63a79e629bd0c2706a2871f31296738c'  # viewfinder.desktop
    
      38  '911d46210699f7e6f453bb2ed7a6d8f1baeeabd6b724e04d8a83361e2e18da4c'  # license-note-proprietary.txt
    
      39  'SKIP'  # thunderfulgames-EULA.html
    
      40)
    
      41
    
      42_get_gameversion() {
    
      43  ## Argumens:
    
      44  #  $1: Gamename
    
      45
    
      46  if [ "$#" -lt 1 ]; then
    
      47    error "${FUNCNAME[0]}: Need to specify one argument: GOG Game name (e.g. '${_gogname}')."
    
      48    return 11
    
      49  fi
    
      50
    
      51  _gamename="${1#*://}" # Strip away possibly leading '://'.
    
      52
    
      53  /usr/bin/lgogdownloader --game "^${_gamename}$" --platform windows --list details | grep -E -m1 '^[[:space:]]*version:' | awk '{print $2}'
    
      54}
    
      55
    
      56_get_gogversion() {
    
      57  ## Argumens:
    
      58  #  $1: Gamename
    
      59
    
      60  if [ "$#" -lt 1 ]; then
    
      61    error "${FUNCNAME[0]}: Need to specify one argument: GOG Game name (e.g. '${_gogname}')."
    
      62    return 11
    
      63  fi
    
      64
    
      65  _gamename="${1#*://}" # Strip away possibly leading '://'.
    
      66
    
      67  /usr/bin/lgogdownloader --game "^${_gamename}$" --platform windows --list details | grep -E -m1 '^[[:space:]]*path:' | sed -E 's|^.*_\(([0-9]*)\)\..*|\1|'
    
      68}
    
      69
    
      70_get_version() {
    
      71  ## Argumens:
    
      72  #  $1: Gamename
    
      73
    
      74  if [ "$#" -lt 1 ]; then
    
      75    error "${FUNCNAME[0]}: Need to specify one argument: GOG Game name (e.g. '${_gogname}')."
    
      76    return 11
    
      77  fi
    
      78
    
      79  printf '%s' "$(_get_gameversion "$1")+gog$(_get_gogversion "$1")"
    
      80}
    
      81
    
      82_download_game() {
    
      83  ## Argumens:
    
      84  #  $1: Gamename
    
      85  #  $2: Output directory
    
      86
    
      87  if [ "$#" -lt 2 ]; then
    
      88    error "${FUNCNAME[0]}: Need to specify two arguments: 1.: GOG Game name (e.g. '${_gogname}'), 2.: Output directory (use '\${SRCDEST}')."
    
      89    return 11
    
      90  fi
    
      91
    
      92  local _gamename
    
      93  local _targetdir
    
      94
    
      95  _gamename="${1#*://}" # Strip away possibly leading '://'.
    
      96  _targetdir="$2"
    
      97
    
      98  /usr/bin/lgogdownloader --threads 2 --verbosity 2 --directory "${_targetdir}" --no-color --save-serials --save-logo --save-icon --save-game-details-json --save-product-json --include all --include-hidden-products --exclude patches --lowspeed-timeout 60 --lowspeed-rate 128 --progress-interval 2000 --platform windows --game "^${_gamename}$" --no-fast-status-check --download
    
      99}
    
      100
    
      101_get_archivename() {
    
      102  ## Argumens:
    
      103  #  $1: Gamename
    
      104
    
      105  if [ "$#" -lt 1 ]; then
    
      106    error "${FUNCNAME[0]}: Need to specify one argument: GOG Game name (e.g. '${_gogname}')."
    
      107    return 11
    
      108  fi
    
      109
    
      110  _gamename="${1#*://}" # Strip away possibly leading '://'.
    
      111
    
      112  basename "$(/usr/bin/lgogdownloader --game "^${_gamename}$" --platform windows --list details | grep -E -m1 '^[[:space:]]*path:' | awk '{print $2}')"
    
      113}
    
      114
    
      115prepare() {
    
      116  cd "${srcdir}"
    
      117  if [ -e "${_gogname}" ]; then
    
      118    rm "${_gogname}"
    
      119  fi
    
      120
    
      121  if [ -e "unpack" ]; then
    
      122    rm -Rf "unpack"
    
      123  fi
    
      124
    
      125  msg2 "Downloading GOG game '${_gogname}' ..."
    
      126  _download_game "${_gogname}" "${SRCDEST}"
    
      127  ln -s "${SRCDEST}/${_gogname}" "${srcdir}/${_gogname}"
    
      128
    
      129  local _archivename
    
      130  _archivename="$(_get_archivename "${_gogname}")"
    
      131
    
      132  mkdir -p unpack/game
    
      133
    
      134  msg2 "Extracting game data ..."
    
      135  innoextract --color off --progress --output-dir "${srcdir}/unpack/game" --extract "${srcdir}/${_gogname}/${_archivename}"
    
      136
    
      137  local _exe
    
      138  find "${srcdir}/unpack" -name '*.exe' -or -name '*.com' -or -name '*.bat' | while read _exe; do
    
      139    chmod a+x "${_exe}"
    
      140  done
    
      141}
    
      142
    
      143pkgver() {
    
      144  _get_version "${_gogname}"
    
      145}
    
      146
    
      147build() {
    
      148  ## 'icon.png' downloaded from GOG directly may be corrupt.
    
      149  if [ -e "${srcdir}/${_gogname}/icon_viewfinder.png" ]; then
    
      150    rm -f "${srcdir}/${_gogname}/icon_viewfinder.png"
    
      151  fi
    
      152  msg2 "Generating 'icon.png' ..."
    
      153  magick "${srcdir}/unpack/game/app"/goggame*.ico[6] "${srcdir}/${_gogname}/icon_viewfinder.png"
    
      154  zopflipng -m -y "${srcdir}/${_gogname}/icon_viewfinder.png" "${srcdir}/${_gogname}/icon_viewfinder.png"
    
      155}
    
      156
    
      157package_viewfinder-data-gog-bin() {
    
      158  pkgdesc="A puzzle video game based on mapping photographs or other two-dimension works onto the three-dimensional space of the game's world, creating new geometries and layouts."
    
      159  arch=('x86_64')
    
      160  license=(
    
      161    'LicenseRef-Proprietary'
    
      162    'LicenseRef-GOG_User_Agreement'
    
      163  )
    
      164  depends=()
    
      165  optdepends=(
    
      166    "viewfinder-launcher: To launch the game via wine by executing '/usr/bin/viewfinder'."
    
      167  )
    
      168  provides=(
    
      169    "viewfinder-data=${pkgver}"
    
      170  )
    
      171  conflicts=(
    
      172    "viewfinder-data"
    
      173  )
    
      174
    
      175  local _viewfinderdir
    
      176  _viewfinderdir='/usr/lib/viewfinder'
    
      177
    
      178  install -dvm755 "${pkgdir}/${_viewfinderdir}"
    
      179  #cp -rv "${srcdir}/unpack/game"/{Viewfinder_Data,Viewfinder.exe,UnityPlayer.dll,GameAssembly.dll,baselib.dll,UnityCrashHandler64.exe,GalaxyConfig.json} "${pkgdir}/${_viewfinderdir}"/
    
      180  cp -rv "${srcdir}/unpack/game"/* "${pkgdir}/${_viewfinderdir}"/
    
      181
    
      182  install -Dvm644 "${srcdir}/${_gogname}/icon_viewfinder.png" "${pkgdir}/usr/share/pixmaps/viewfinder.png"
    
      183
    
      184  install -Dvm644 -t "${pkgdir}/usr/share/doc/viewfinder" "${srcdir}/${_gogname}"/{logo_viewfinder.jpg,game-details.json,product_viewfinder.json} "${srcdir}/unpack/game"/{goggame*.info,goggame*.script}
    
      185
    
      186  install -Dvm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" "${srcdir}/license-note-proprietary.txt" "${srcdir}/thunderfulgames-EULA.html"
    
      187  install -Dvm644 "${srcdir}/unpack/game/tmp/EULA.txt" "${pkgdir}/usr/share/licenses/${pkgname}/GOG-EULA.txt"
    
      188}
    
      189
    
      190package_viewfinder-launcher() {
    
      191  pkgdesc="Launcher script for the game 'Viewfinder'."
    
      192  arch=('any')
    
      193  license=('GPL-3.0-or-later')
    
      194  depends=(
    
      195    "sh"
    
      196    "viewfinder-data"
    
      197    "wine"
    
      198  )
    
      199  optdepends=()
    
      200  provides=(
    
      201    "viewfinder=${pkgver}"
    
      202  )
    
      203  conflicts=()
    
      204
    
      205  install -Dvm755 "${srcdir}/viewfinder.sh" "${pkgdir}/usr/bin/viewfinder"
    
      206  install -Dvm644 "${srcdir}/viewfinder.desktop" "${pkgdir}/usr/share/applications/viewfinder.desktop"
    
      207
    
      208  install -dvm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      209  cd "${pkgdir}/usr/share/licenses/${pkgname}"
    
      210  ln -sv "/usr/share/licenses/spdx/GPL-3.0-or-later.txt" .
    
      211}
    
      212

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2