vintagestory

maintainer copygirl · 71 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt game client from the official project CDN, which is plausibly controlled by the developer; while the host is not on a standard whitelist, it is directly related to the project and the downloaded content is a legitimate part of the application, not an obfuscated or malicious payload.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt game client from the official project CDN, which is plausibly controlled by the developer; while the host is not on a standard whitelist, it is directly related to the project and the downloaded content is a legitimate part of the application, not an obfuscated or malicious payload.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://cdn.vintagestory.at/gamefiles/$_release/vs_client_linux-x64_$_pkgver.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: copygirl <copygirl@mcft.net>
    
      2pkgname=vintagestory
    
      3
    
      4# `$_release` is the version's release type, commonly "stable" for normal releases,
    
      5# "unstable" for release candidates and "pre" for testing releases before big updates.
    
      6_release=stable
    
      7# `$_pkgver` is separate to allow specifying pre-release versions such as "-rc.1".
    
      8_pkgver=1.22.6
    
      9
    
      10# `makepkg` doesn't support hyphens in `$pkgver`, so we'll strip them as per `vercmp`.
    
      11pkgver=${_pkgver//-/}
    
      12pkgrel=1
    
      13pkgdesc="Uncompromising wilderness survival sandbox game (requires paid account)"
    
      14arch=("x86_64")
    
      15url="https://www.vintagestory.at/"
    
      16license=("custom")
    
      17depends=("dotnet-runtime-10.0" "opengl-driver" "openal" "glibc>=2.34")
    
      18options=(!strip !debug) # .NET game probably doesn't need symbols stripped or a debug package
    
      19source=("https://cdn.vintagestory.at/gamefiles/$_release/vs_client_linux-x64_$_pkgver.tar.gz"
    
      20#       "https://account.vintagestory.at/files/$_release/vs_client_linux-x64_$_pkgver.tar.gz" (alternative source)
    
      21        "$pkgname.desktop"
    
      22        "vsmodinstall-handler.desktop")
    
      23md5sums=("c00c436cab612b436747b4bb5f39049b"
    
      24         "0cd6360c157fc7dc4d52952e83483e7d"
    
      25         "8ccc9b49290dda21199b14ac3cd4ac7e")
    
      26
    
      27prepare() {
    
      28	# Remove install script provided by developers
    
      29	rm "$pkgname"/install.sh
    
      30
    
      31	# Create symbolic links for any assets (excluding fonts) containing non-lowercase letters
    
      32	# Some asset files might include uppercase letters, but the game expects them to be lowercase
    
      33	find "$pkgname"/assets/ -not -path "*/fonts/*" -regex ".*/.*[A-Z].*" | while read -r file; do
    
      34		local filename="$(basename -- "$file")"
    
      35		ln -sf "$filename" "${file%/*}"/"${filename,,}"
    
      36	done
    
      37}
    
      38
    
      39package() {
    
      40	# Copy application icon and .desktop files
    
      41	install -Dm644 "$pkgname"/assets/gameicon.png "$pkgdir"/usr/share/pixmaps/"$pkgname".png
    
      42	install -Dm644 "$pkgname".desktop "$pkgdir"/usr/share/applications/"$pkgname".desktop
    
      43	install -Dm644 vsmodinstall-handler.desktop "$pkgdir"/usr/share/applications/vsmodinstall-handler.desktop
    
      44
    
      45	# Copy all other application files (`/opt` is the right place to dump this)
    
      46	install -dm 755 "$pkgdir"/opt # Create directory first (required)
    
      47	cp -r --preserve=mode -t "$pkgdir"/opt "$pkgname"
    
      48
    
      49	# Create a symlink to run the launch script from terminal
    
      50	install -dm 755 "$pkgdir"/usr/bin # Create directory first (required)
    
      51	ln -s /opt/"$pkgname"/run.sh "$pkgdir"/usr/bin/"$pkgname"
    
      52}
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,7 +5,7 @@
 # "unstable" for release candidates and "pre" for testing releases before big updates.
 _release=stable
 # `$_pkgver` is separate to allow specifying pre-release versions such as "-rc.1".
-_pkgver=1.22.5
+_pkgver=1.22.6
 
 # `makepkg` doesn't support hyphens in `$pkgver`, so we'll strip them as per `vercmp`.
 pkgver=${_pkgver//-/}
@@ -20,7 +20,7 @@
 #       "https://account.vintagestory.at/files/$_release/vs_client_linux-x64_$_pkgver.tar.gz" (alternative source)
         "$pkgname.desktop"
         "vsmodinstall-handler.desktop")
-md5sums=("ffeb9b11b78414b2e90c3a59a7eab4b2"
+md5sums=("c00c436cab612b436747b4bb5f39049b"
          "0cd6360c157fc7dc4d52952e83483e7d"
          "8ccc9b49290dda21199b14ac3cd4ac7e")
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 07:20:18	MEDIUM	1
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 09:20:02	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 13:17:02	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2