vintagestory

LOW

maintainer copygirl 71 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a prebuilt game client from the official project CDN, which is plausibly controlled by the developer; while the host is not on a standard whitelist, it is directly related to the project and the downloaded content is a legitimate part of the application, not an obfuscated or malicious payload.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt game client from the official project CDN, which is plausibly controlled by the developer; while the host is not on a standard whitelist, it is directly related to the project and the downloaded content is a legitimate part of the application, not an obfuscated or malicious payload.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://cdn.vintagestory.at/gamefiles/$_release/vs_client_linux-x64_$_pkgver.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: copygirl <copygirl@mcft.net>
    
      2pkgname=vintagestory
    
      3
    
      4# `$_release` is the version's release type, commonly "stable" for normal releases,
    
      5# "unstable" for release candidates and "pre" for testing releases before big updates.
    
      6_release=stable
    
      7# `$_pkgver` is separate to allow specifying pre-release versions such as "-rc.1".
    
      8_pkgver=1.22.6
    
      9
    
      10# `makepkg` doesn't support hyphens in `$pkgver`, so we'll strip them as per `vercmp`.
    
      11pkgver=${_pkgver//-/}
    
      12pkgrel=1
    
      13pkgdesc="Uncompromising wilderness survival sandbox game (requires paid account)"
    
      14arch=("x86_64")
    
      15url="https://www.vintagestory.at/"
    
      16license=("custom")
    
      17depends=("dotnet-runtime-10.0" "opengl-driver" "openal" "glibc>=2.34")
    
      18options=(!strip !debug) # .NET game probably doesn't need symbols stripped or a debug package
    
      19source=("https://cdn.vintagestory.at/gamefiles/$_release/vs_client_linux-x64_$_pkgver.tar.gz"
    
      20#       "https://account.vintagestory.at/files/$_release/vs_client_linux-x64_$_pkgver.tar.gz" (alternative source)
    
      21        "$pkgname.desktop"
    
      22        "vsmodinstall-handler.desktop")
    
      23md5sums=("c00c436cab612b436747b4bb5f39049b"
    
      24         "0cd6360c157fc7dc4d52952e83483e7d"
    
      25         "8ccc9b49290dda21199b14ac3cd4ac7e")
    
      26
    
      27prepare() {
    
      28	# Remove install script provided by developers
    
      29	rm "$pkgname"/install.sh
    
      30
    
      31	# Create symbolic links for any assets (excluding fonts) containing non-lowercase letters
    
      32	# Some asset files might include uppercase letters, but the game expects them to be lowercase
    
      33	find "$pkgname"/assets/ -not -path "*/fonts/*" -regex ".*/.*[A-Z].*" | while read -r file; do
    
      34		local filename="$(basename -- "$file")"
    
      35		ln -sf "$filename" "${file%/*}"/"${filename,,}"
    
      36	done
    
      37}
    
      38
    
      39package() {
    
      40	# Copy application icon and .desktop files
    
      41	install -Dm644 "$pkgname"/assets/gameicon.png "$pkgdir"/usr/share/pixmaps/"$pkgname".png
    
      42	install -Dm644 "$pkgname".desktop "$pkgdir"/usr/share/applications/"$pkgname".desktop
    
      43	install -Dm644 vsmodinstall-handler.desktop "$pkgdir"/usr/share/applications/vsmodinstall-handler.desktop
    
      44
    
      45	# Copy all other application files (`/opt` is the right place to dump this)
    
      46	install -dm 755 "$pkgdir"/opt # Create directory first (required)
    
      47	cp -r --preserve=mode -t "$pkgdir"/opt "$pkgname"
    
      48
    
      49	# Create a symlink to run the launch script from terminal
    
      50	install -dm 755 "$pkgdir"/usr/bin # Create directory first (required)
    
      51	ln -s /opt/"$pkgname"/run.sh "$pkgdir"/usr/bin/"$pkgname"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2