wegame-dwproton

MEDIUM
maintainer Particle_G 0 votes scanned 2026-10-17 00:21:55.226236
View on AUR
Why flagged

The package downloads a prebuilt executable (.exe) and a binary Proton runtime from non-standard hosts with unverifiable checksums (SKIP), posing a supply-chain risk if the sources were compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:40 "$pkgname-${pkgver}.exe::https://dldir1v6.qq.com/tgc/wegame/miniloader/WeGameMiniLoader.std.${pkgver}.exe"
  • PKGBUILD:41 "${_dwproton_dir}.tar.xz::https://dawn.wine/dawn-winery/dwproton/releases/download/dwproton-${_dwproton_version}/${_dwproton_dir}.tar.xz"
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt executable (.exe) and a binary Proton runtime from non-standard hosts with unverifiable checksums (SKIP), posing a supply-chain risk if the sources were compromised.

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: ParticleG <particle_g@outlook.com>
2
3pkgname=wegame-dwproton
4pkgver=7.06.27.1446
5pkgrel=8
6pkgdesc='Unofficial bundled DWProton integration for Tencent WeGame'
7arch=('x86_64')
8url='https://github.com/ParticleG/wegame-dwproton'
9license=(
10 '0BSD'
11 'BSD-2-Clause'
12 'BSD-3-Clause'
13 'LGPL-2.1-only'
14 'Zlib'
15 'MIT'
16 'MPL-2.0'
17 'OFL-1.1'
18 'LicenseRef-WeGame-EULA'
19)
20depends=(
21 'bash'
22 'coreutils'
23 'hicolor-icon-theme'
24 'python'
25 'python-filelock'
26 'python-xlib'
27 'util-linux'
28 'xorg-server-xephyr'
29 'xorg-xwayland'
30 'xorg-twm'
31)
32makedepends=('7zip' 'imagemagick')
33optdepends=('libnotify: desktop error notifications')
34options=('!strip' '!debug' 'emptydirs')
35install="$pkgname.install"
36_dwproton_version='11.0-12'
37_dwproton_dir="dwproton-${_dwproton_version}-${CARCH}"
38
39source=(
40 "$pkgname-${pkgver}.exe::https://dldir1v6.qq.com/tgc/wegame/miniloader/WeGameMiniLoader.std.${pkgver}.exe"
41 "${_dwproton_dir}.tar.xz::https://dawn.wine/dawn-winery/dwproton/releases/download/dwproton-${_dwproton_version}/${_dwproton_dir}.tar.xz"
42 'wegame-dwproton'
43 'wegame-nested-x11-fix'
44 'wegame-twmrc'
45 'wegame-dwproton.desktop'
46 'wegame-dwproton.install'
47 'LICENSE'
48 'WeGame-EULA.txt'
49)
50noextract=("$pkgname-${pkgver}.exe")
51sha256sums=(
52 '0948beca682116a643629c93ff787d2602b599b4ca1c586d8b2c02a7f4ef6d26'
53 'SKIP'
54 '94f8d2fee5f9bf378e0fcee51e2ed54dc801fad49374353fcacad41facb9392d'
55 '137b871cdbec553738e81b50f512122ef184a25e52866b19fd23f42a5953e97d'
56 'e5226b324e862ac81ef975dc82b75e863eb3b1733e9683296ed13916d7e3012e'
57 '0efdfb60c908ef0a75356d827e087e3afd4b66881ed895951bcc3e98360eac3a'
58 'fe8ebb07be1633b8a83e80a0dda6a3f8e834febcd4069d78dc9724af998937fc'
59 'a0e144decd47d1b87623ae6224e5d4c4b3957768179a7c7933a93ec4f5b316c4'
60 '0d41216d7887ecc574ba0a92de6fde21cde94a49c66cde77e80deacd50f1a9d9'
61)
62sha512sums=(
63 'SKIP'
64 'acea3ca24f3c08cbae11066abbb7f4481c4e21bd1d11bd3ce072641707b593b40b3518472230a34a5b7426bd3a42ab060b943b05995194379df476b2772bc399'
65 'SKIP'
66 'SKIP'
67 'SKIP'
68 'SKIP'
69 'SKIP'
70 'SKIP'
71 'SKIP'
72)
73
74prepare() {
75 rm -rf "$srcdir/$pkgname-icon"
76 mkdir -p "$srcdir/$pkgname-icon"
77 7z e -y -o"$srcdir/$pkgname-icon" \
78 "$srcdir/$pkgname-${pkgver}.exe" icon.ico
79 magick "$srcdir/$pkgname-icon/icon.ico[0]" \
80 "$srcdir/$pkgname.png"
81}
82
83package() {
84 install -Dm755 "$srcdir/$pkgname" \
85 "$pkgdir/usr/bin/$pkgname"
86 install -Dm755 "$srcdir/wegame-nested-x11-fix" \
87 "$pkgdir/usr/share/$pkgname/wegame-nested-x11-fix"
88 install -Dm644 "$srcdir/wegame-twmrc" \
89 "$pkgdir/usr/share/$pkgname/wegame-twmrc"
90 install -Dm644 "$srcdir/$pkgname-${pkgver}.exe" \
91 "$pkgdir/usr/share/$pkgname/WeGameMiniLoader.exe"
92 install -d "$pkgdir/usr/share/$pkgname/dwproton"
93 cp -a "$srcdir/$_dwproton_dir/." \
94 "$pkgdir/usr/share/$pkgname/dwproton/"
95 install -Dm644 "$srcdir/$pkgname.desktop" \
96 "$pkgdir/usr/share/applications/$pkgname.desktop"
97 install -Dm644 "$srcdir/$pkgname.png" \
98 "$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
99 install -Dm644 "$srcdir/LICENSE" \
100 "$pkgdir/usr/share/licenses/$pkgname/0BSD.txt"
101 install -Dm644 "$srcdir/WeGame-EULA.txt" \
102 "$pkgdir/usr/share/licenses/$pkgname/WeGame-EULA.txt"
103 install -Dm644 "$srcdir/$_dwproton_dir/LICENSE" \
104 "$pkgdir/usr/share/licenses/$pkgname/dwproton/LICENSE"
105 install -Dm644 "$srcdir/$_dwproton_dir/LICENSE.OFL" \
106 "$pkgdir/usr/share/licenses/$pkgname/dwproton/LICENSE.OFL"
107 install -Dm644 "$srcdir/$_dwproton_dir/PATENTS.AV1" \
108 "$pkgdir/usr/share/licenses/$pkgname/dwproton/PATENTS.AV1"
109}
110

Changes since previous scan

--- PKGBUILD @ 2026-10-05 00:08
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,7 +2,7 @@
pkgname=wegame-dwproton
pkgver=7.06.27.1446
-pkgrel=7
+pkgrel=8
pkgdesc='Unofficial bundled DWProton integration for Tencent WeGame'
arch=('x86_64')
url='https://github.com/ParticleG/wegame-dwproton'
@@ -51,7 +51,7 @@
sha256sums=(
'0948beca682116a643629c93ff787d2602b599b4ca1c586d8b2c02a7f4ef6d26'
'SKIP'
- '025c6b280eed43dc03d790d98e1e4fedc71aaa7f39c5ae432694f78fb60c41b8'
+ '94f8d2fee5f9bf378e0fcee51e2ed54dc801fad49374353fcacad41facb9392d'
'137b871cdbec553738e81b50f512122ef184a25e52866b19fd23f42a5953e97d'
'e5226b324e862ac81ef975dc82b75e863eb3b1733e9683296ed13916d7e3012e'
'0efdfb60c908ef0a75356d827e087e3afd4b66881ed895951bcc3e98360eac3a'

Scan history

Scanned at (UTC)SeverityRules
2026-10-17 00:21:55 Medium 2
2026-10-16 00:12:47 Medium 2
2026-10-15 00:28:05 Medium 2
2026-10-14 00:06:47 Medium 2
2026-10-13 00:23:45 Medium 2
2026-10-12 00:18:51 Medium 2
2026-10-11 00:26:05 Medium 2
2026-10-10 00:11:52 Medium 2
2026-10-09 00:05:33 Medium 2
2026-10-08 00:28:03 Medium 2
2026-10-07 00:21:34 Medium 2
2026-10-06 00:13:36 Medium 2
2026-10-05 23:40:58 Medium 1
2026-10-05 00:08:03 Medium 2
2026-10-04 00:18:08 Medium 2
2026-10-03 00:23:04 Medium 2
2026-10-02 00:00:32 Medium 2
2026-10-01 00:02:06 Medium 2
2026-09-30 00:20:07 Medium 2
2026-09-29 00:07:46 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion