voidal

LOW

maintainer friedev 0 votes scanned 2026-10-19 01:23:43.518710

View on AUR

Why flagged

The package downloads a prebuilt game binary from the official project site; while the host is not on a standard whitelist, it is the project's own domain, and the binary is not executed at build time, posing minimal supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt game binary from the official project site; while the host is not on a standard whitelist, it is the project's own domain, and the binary is not executed at build time, posing minimal supply-chain risk.

PKGBUILD

      1# Maintainer: Aaron Friesen <aaron@frie.dev>
    
      2# shellcheck shell=bash disable=SC2034,SC2154,SC2164
    
      3
    
      4pkgname=voidal
    
      5pkgver=0.4.0
    
      6pkgrel=1
    
      7pkgdesc='4x strategy game inspired by Aurora 4x'
    
      8arch=('x86_64')
    
      9url='https://voidal.net'
    
      10license=('LicenseRef-voidal')
    
      11depends=('glu' 'libglvnd' 'sdl2-compat')
    
      12options=('!debug')
    
      13_commit=3a3d79ae244a973c6e1440a16d2402d86eb3a0a7
    
      14source=(
    
      15	"$pkgname-$pkgver.zip::$url/voidal_builds/v$pkgver/VoidalLinux.zip"
    
      16	"LICENSE_THIRD_PARTY.txt::https://raw.githubusercontent.com/jensaly/voidal/$_commit/LICENSE_THIRD_PARTY.txt"
    
      17)
    
      18sha256sums=(
    
      19	'cc91af5c3eb845d4ad62dce84dbcdb54efbbf1c522ba6e9756287039b2491002'
    
      20	'78bbc7558a5c88adc8f65454098c706e3c7602ebf45ff8fce27392149838ae43'
    
      21)
    
      22
    
      23package() {
    
      24	cd "$srcdir/release"
    
      25
    
      26	install -d "$pkgdir/usr/share/$pkgname"
    
      27	cp -r --no-preserve=ownership lists qrh "$pkgdir/usr/share/$pkgname/"
    
      28
    
      29	# Normalize permissions of the read-only data.
    
      30	find "$pkgdir/usr/share/$pkgname" -type f -exec chmod 644 {} +
    
      31	find "$pkgdir/usr/share/$pkgname" -type d -exec chmod 755 {} +
    
      32
    
      33	install -Dm755 Voidal "$pkgdir/usr/lib/$pkgname/$pkgname"
    
      34
    
      35	# Upstream publishes no license for the game itself, so ship a notice for
    
      36	# the LicenseRef ID.
    
      37	install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
      38	cat >"$pkgdir/usr/share/licenses/$pkgname/LicenseRef-$pkgname.txt" <<'EOF'
    
      39Voidal is proprietary freeware developed by Jens Lyngaas.
    
      40
    
      41Upstream publishes no license text for the game itself, so it remains all
    
      42rights reserved by its author. This package does not redistribute the game:
    
      43it downloads the unmodified archive from the official distribution channel at
    
      44build time. Components bundled in the binary are licensed separately; see
    
      45LICENSE_THIRD_PARTY.txt.
    
      46
    
      47Official site: https://voidal.net/
    
      48EOF
    
      49
    
      50	# Third-party licenses for the components statically linked into the
    
      51	# binary (SDL2, ImGui, ImPlot, ...).
    
      52	install -Dm644 "$srcdir/LICENSE_THIRD_PARTY.txt" \
    
      53		"$pkgdir/usr/share/licenses/$pkgname/LICENSE_THIRD_PARTY.txt"
    
      54
    
      55	install -dm755 "$pkgdir/usr/share/applications"
    
      56	cat >"$pkgdir/usr/share/applications/$pkgname.desktop" <<'EOF'
    
      57[Desktop Entry]
    
      58Type=Application
    
      59Name=Voidal
    
      60GenericName=4X Strategy Game
    
      61Comment=4x strategy game inspired by Aurora 4x
    
      62Exec=voidal
    
      63Terminal=false
    
      64Categories=Game;StrategyGame;
    
      65Keywords=voidal;4x;space;strategy;aurora;
    
      66EOF
    
      67
    
      68	# Voidal resolves its data (lists/, qrh/) and writes saves/ and log files
    
      69	# relative to the working directory. Run it from a writable per-user
    
      70	# directory that links to the read-only data installed system-wide.
    
      71	install -dm755 "$pkgdir/usr/bin"
    
      72	cat >"$pkgdir/usr/bin/$pkgname" <<'EOF'
    
      73#!/bin/sh
    
      74install_dir=/usr/share/voidal
    
      75data_dir="${XDG_DATA_HOME:-$HOME/.local/share}/voidal"
    
      76
    
      77mkdir -p "$data_dir" || exit 1
    
      78
    
      79for file in "$install_dir"/*; do
    
      80	name="${file##*/}"
    
      81	link="$data_dir/$name"
    
      82	# Recreate links whose target disappeared after a package upgrade.
    
      83	if [ -L "$link" ] && [ ! -e "$link" ]; then
    
      84		rm -f "$link"
    
      85	fi
    
      86	[ -e "$link" ] || ln -s "$file" "$link"
    
      87done
    
      88
    
      89# Save games are written here, so it must be a real, writable directory.
    
      90mkdir -p "$data_dir/saves" || exit 1
    
      91
    
      92cd "$data_dir" || exit 1
    
      93exec /usr/lib/voidal/voidal "$@"
    
      94EOF
    
      95	chmod 755 "$pkgdir/usr/bin/$pkgname"
    
      96}
    
      97

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 01:23:43	Low	2