wegame-dwproton

LOW

maintainer Particle_G 0 votes scanned 2026-09-01 07:49:06.451422

View on AUR

Why flagged

The .exe is downloaded from dldir1.qq.com (Tencent's official CDN for WeGame) with a pinned sha256 checksum, and it is installed as a data file (not executed at build/install time); the package extracts only an icon from it and wraps it with a DWProton launcher script, so the realistic risk is low despite the non-whitelisted host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The .exe is downloaded from dldir1.qq.com (Tencent's official CDN for WeGame) with a pinned sha256 checksum, and it is installed as a data file (not executed at build/install time); the package extracts only an icon from it and wraps it with a DWProton launcher script, so the realistic risk is low despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "$pkgname-${pkgver}.exe::https://dldir1.qq.com/tgc/wegame/miniloader/WeGameMiniLoader.std.${pkgver}.exe"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ParticleG <particle_g@outlook.com>
    
      2
    
      3pkgname=wegame-dwproton
    
      4pkgver=7.06.27.1446
    
      5pkgrel=1
    
      6pkgdesc='Unofficial DWProton integration for Tencent WeGame'
    
      7arch=('x86_64')
    
      8url='https://github.com/ParticleG/wegame-dwproton'
    
      9license=('LicenseRef-WeGame-EULA AND 0BSD')
    
      10depends=('dwproton' 'bash' 'coreutils' 'util-linux' 'hicolor-icon-theme')
    
      11makedepends=('7zip' 'imagemagick')
    
      12optdepends=('libnotify: desktop error notifications')
    
      13options=('!strip' '!debug')
    
      14install="$pkgname.install"
    
      15
    
      16source=(
    
      17  "$pkgname-${pkgver}.exe::https://dldir1.qq.com/tgc/wegame/miniloader/WeGameMiniLoader.std.${pkgver}.exe"
    
      18  'wegame-dwproton'
    
      19  'wegame-dwproton.desktop'
    
      20  'wegame-dwproton.install'
    
      21  'LICENSE'
    
      22  'WeGame-EULA.txt'
    
      23)
    
      24noextract=("$pkgname-${pkgver}.exe")
    
      25sha256sums=(
    
      26  '0948beca682116a643629c93ff787d2602b599b4ca1c586d8b2c02a7f4ef6d26'
    
      27  'afc98f8951eec279e08ccb29dbd34641576c041a824975d762a7fadebd36a345'
    
      28  '0efdfb60c908ef0a75356d827e087e3afd4b66881ed895951bcc3e98360eac3a'
    
      29  'dab43cd44f7ec00cf752fdf9c5aeaad091bffb8fc609d7709ae99d6fdf79b7f7'
    
      30  'a0e144decd47d1b87623ae6224e5d4c4b3957768179a7c7933a93ec4f5b316c4'
    
      31  '0d41216d7887ecc574ba0a92de6fde21cde94a49c66cde77e80deacd50f1a9d9'
    
      32)
    
      33
    
      34prepare() {
    
      35  rm -rf "$srcdir/$pkgname-icon"
    
      36  mkdir -p "$srcdir/$pkgname-icon"
    
      37  7z e -y -o"$srcdir/$pkgname-icon" \
    
      38    "$srcdir/$pkgname-${pkgver}.exe" icon.ico
    
      39  magick "$srcdir/$pkgname-icon/icon.ico[0]" \
    
      40    "$srcdir/$pkgname.png"
    
      41}
    
      42
    
      43package() {
    
      44  install -Dm755 "$srcdir/$pkgname" \
    
      45    "$pkgdir/usr/bin/$pkgname"
    
      46  install -Dm644 "$srcdir/$pkgname-${pkgver}.exe" \
    
      47    "$pkgdir/usr/share/$pkgname/WeGameMiniLoader.exe"
    
      48  install -Dm644 "$srcdir/$pkgname.desktop" \
    
      49    "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      50  install -Dm644 "$srcdir/$pkgname.png" \
    
      51    "$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
    
      52  install -Dm644 "$srcdir/LICENSE" \
    
      53    "$pkgdir/usr/share/licenses/$pkgname/0BSD.txt"
    
      54  install -Dm644 "$srcdir/WeGame-EULA.txt" \
    
      55    "$pkgdir/usr/share/licenses/$pkgname/WeGame-EULA.txt"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 07:49:06	Low	3
2026-09-01 07:47:32	Medium	3