vintagestory

LOW

maintainer copygirl 71 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source is a prebuilt game client from the official project CDN, which is plausibly controlled by the developer; while the host is not on a standard whitelist, it is directly related to the project and the downloaded content is a legitimate part of the application, not an obfuscated or malicious payload.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt game client from the official project CDN, which is plausibly controlled by the developer; while the host is not on a standard whitelist, it is directly related to the project and the downloaded content is a legitimate part of the application, not an obfuscated or malicious payload.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://cdn.vintagestory.at/gamefiles/$_release/vs_client_linux-x64_$_pkgver.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: copygirl <copygirl@mcft.net>
    
      2pkgname=vintagestory
    
      3
    
      4# `$_release` is the version's release type, commonly "stable" for normal releases,
    
      5# "unstable" for release candidates and "pre" for testing releases before big updates.
    
      6_release=stable
    
      7# `$_pkgver` is separate to allow specifying pre-release versions such as "-rc.1".
    
      8_pkgver=1.22.6
    
      9
    
      10# `makepkg` doesn't support hyphens in `$pkgver`, so we'll strip them as per `vercmp`.
    
      11pkgver=${_pkgver//-/}
    
      12pkgrel=1
    
      13pkgdesc="Uncompromising wilderness survival sandbox game (requires paid account)"
    
      14arch=("x86_64")
    
      15url="https://www.vintagestory.at/"
    
      16license=("custom")
    
      17depends=("dotnet-runtime-10.0" "opengl-driver" "openal" "glibc>=2.34")
    
      18options=(!strip !debug) # .NET game probably doesn't need symbols stripped or a debug package
    
      19source=("https://cdn.vintagestory.at/gamefiles/$_release/vs_client_linux-x64_$_pkgver.tar.gz"
    
      20#       "https://account.vintagestory.at/files/$_release/vs_client_linux-x64_$_pkgver.tar.gz" (alternative source)
    
      21        "$pkgname.desktop"
    
      22        "vsmodinstall-handler.desktop")
    
      23md5sums=("c00c436cab612b436747b4bb5f39049b"
    
      24         "0cd6360c157fc7dc4d52952e83483e7d"
    
      25         "8ccc9b49290dda21199b14ac3cd4ac7e")
    
      26
    
      27prepare() {
    
      28	# Remove install script provided by developers
    
      29	rm "$pkgname"/install.sh
    
      30
    
      31	# Create symbolic links for any assets (excluding fonts) containing non-lowercase letters
    
      32	# Some asset files might include uppercase letters, but the game expects them to be lowercase
    
      33	find "$pkgname"/assets/ -not -path "*/fonts/*" -regex ".*/.*[A-Z].*" | while read -r file; do
    
      34		local filename="$(basename -- "$file")"
    
      35		ln -sf "$filename" "${file%/*}"/"${filename,,}"
    
      36	done
    
      37}
    
      38
    
      39package() {
    
      40	# Copy application icon and .desktop files
    
      41	install -Dm644 "$pkgname"/assets/gameicon.png "$pkgdir"/usr/share/pixmaps/"$pkgname".png
    
      42	install -Dm644 "$pkgname".desktop "$pkgdir"/usr/share/applications/"$pkgname".desktop
    
      43	install -Dm644 vsmodinstall-handler.desktop "$pkgdir"/usr/share/applications/vsmodinstall-handler.desktop
    
      44
    
      45	# Copy all other application files (`/opt` is the right place to dump this)
    
      46	install -dm 755 "$pkgdir"/opt # Create directory first (required)
    
      47	cp -r --preserve=mode -t "$pkgdir"/opt "$pkgname"
    
      48
    
      49	# Create a symlink to run the launch script from terminal
    
      50	install -dm 755 "$pkgdir"/usr/bin # Create directory first (required)
    
      51	ln -s /opt/"$pkgname"/run.sh "$pkgdir"/usr/bin/"$pkgname"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2