wayvr-actions-bin

MEDIUM

maintainer he3als 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a CI link on nightly.link, which is an unverifiable executable artifact from a third-party hosting service that could be silently swapped; while the checksum is provided, the source is a binary not built locally, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:49 "${zipName}::https://nightly.link/${_pkgowner}/${_pkgname}/actions/runs/${pkgver}/${_appimageprefix}-${branch}-${CARCH}.AppImage.zip"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a CI link on nightly.link, which is an unverifiable executable artifact from a third-party hosting service that could be silently swapped; while the checksum is provided, the source is a binary not built locally, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Amy <me at he3als dot xyz>
    
      2
    
      3_pkgname=wayvr
    
      4_appimageprefix=WayVR
    
      5_pkgowner=wayvr-org
    
      6pkgname="${_pkgname}-actions-bin"
    
      7branch=main
    
      8pkgver=41102331159
    
      9pkgrel=1
    
      10pkgdesc="Your way to enjoy VR on Linux! Access your Wayland/X11 desktop from SteamVR/Monado (OpenVR+OpenXR, CI build)"
    
      11arch=('x86_64')
    
      12url="https://github.com/${_pkgowner}/${_pkgname}"
    
      13license=('GPL')
    
      14replaces=("wlx-overlay-s")
    
      15options=('!debug')
    
      16
    
      17provides=(
    
      18  "${_pkgname}"
    
      19  "${_pkgname}=git"
    
      20)
    
      21
    
      22conflicts=(
    
      23  "${_pkgname}"
    
      24  "${_pkgname}-bin"
    
      25  "${_pkgname}-git"
    
      26)
    
      27
    
      28depends=(
    
      29  'glibc'
    
      30  'gcc-libs'
    
      31  'libx11'
    
      32  'libxrandr'
    
      33  'libxinerama'
    
      34  'libxkbcommon'
    
      35  'wayland'
    
      36  'libdrm'
    
      37  'vulkan-icd-loader'
    
      38  'fontconfig'
    
      39  'freetype2'
    
      40  'dbus'
    
      41  'libpipewire'
    
      42  'alsa-lib'
    
      43  'openvr'
    
      44  'openxr'
    
      45)
    
      46
    
      47zipName="${pkgname}-${CARCH}-${pkgver}.zip"
    
      48source=(
    
      49    "${zipName}::https://nightly.link/${_pkgowner}/${_pkgname}/actions/runs/${pkgver}/${_appimageprefix}-${branch}-${CARCH}.AppImage.zip"
    
      50)
    
      51
    
      52sha256sums=('0ff320b630d206e2e033061b35cfd562a7bf7b8b5df8c8ee1dd4f845690aa1d1 260a763894b233e522dd6ccc97e518d68bd0f30262d41727ceaa43469735915f 8c8726478c23269ec699006d36c6dfaed32634af2d32d01283805facaef87ce6 22e13306d0f98c84c09eff555c6999f8b73d3a3a7625aecbefa00e5b6820359c')
    
      53
    
      54prepare() {
    
      55  cd "${srcdir}"
    
      56  appimage="${_appimageprefix}-${CARCH}.AppImage"
    
      57
    
      58  msg "Extracting AppImage contents..."
    
      59  chmod +x ${appimage}
    
      60  ./${appimage} --appimage-extract > /dev/null
    
      61}
    
      62
    
      63package() {
    
      64  cd "${srcdir}/squashfs-root"
    
      65
    
      66  # main binary
    
      67  install -Dm0755 usr/bin/${_pkgname} \
    
      68    "${pkgdir}/usr/bin/${_pkgname}"
    
      69
    
      70  # .desktop file
    
      71  install -Dm0644 usr/share/applications/${_pkgname}.desktop \
    
      72    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      73
    
      74  # icons
    
      75  install -dm755 "${pkgdir}/usr/share/"
    
      76  cp -a \
    
      77    "${srcdir}/squashfs-root/usr/share/icons" \
    
      78    "${pkgdir}/usr/share/"
    
      79}
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,7 +5,7 @@
 _pkgowner=wayvr-org
 pkgname="${_pkgname}-actions-bin"
 branch=main
-pkgver=40582983371
+pkgver=41102331159
 pkgrel=1
 pkgdesc="Your way to enjoy VR on Linux! Access your Wayland/X11 desktop from SteamVR/Monado (OpenVR+OpenXR, CI build)"
 arch=('x86_64')
@@ -49,7 +49,7 @@
     "${zipName}::https://nightly.link/${_pkgowner}/${_pkgname}/actions/runs/${pkgver}/${_appimageprefix}-${branch}-${CARCH}.AppImage.zip"
 )
 
-sha256sums=('c11a3e2a2328b8dbcfdd32e03e077f265c8a523a2d5a8d14bc74a5835b132510 cdf42296f9053327692e45c1123cc9064c7b79beb041aa41c27c3cd5ba60744d af77a3aa2bc574e616582e2175346af9c6917dc3df3263d307b91e467f7b753e baa540bfc16a70296db7ea58c6ecc5402ab457c918f97975e1bccd3b29229886')
+sha256sums=('0ff320b630d206e2e033061b35cfd562a7bf7b8b5df8c8ee1dd4f845690aa1d1 260a763894b233e522dd6ccc97e518d68bd0f30262d41727ceaa43469735915f 8c8726478c23269ec699006d36c6dfaed32634af2d32d01283805facaef87ce6 22e13306d0f98c84c09eff555c6999f8b73d3a3a7625aecbefa00e5b6820359c')
 
 prepare() {
   cd "${srcdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 23:57:35	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 01:51:16	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 21:48:49	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 23:41:29	Medium	2
2026-10-24 21:41:28	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 15:37:50	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 17:35:31	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 19:33:05	Medium	2
2026-10-21 17:32:44	Medium	2