winarcadia-bin

maintainer Sterophonick · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt Windows binary (RAR archive) is downloaded from a personal/unofficial host (amigan.1emu.net) with all checksums set to SKIP, meaning any content served by that host is installed without integrity verification. The binary is then executed via Wine. While amigan.1emu.net appears to be the actual upstream release host for WinArcadia (the URL matches the project's official release page), the combination of SKIP checksums on an executed binary from a non-major-CDN host constitutes a genuine supply-chain risk: silent replacement or compromise of the host would result in arbitrary code execution under Wine. The pkgver() function also performs a live curl to scrape the version, adding a minor TOCTOU concern. This is a real medium-severity concern, not a false positive, though it is not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=(https://amigan.1emu.net/releases/WinArcadia-bin.rar

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt Windows binary (RAR archive) is downloaded from a personal/unofficial host (amigan.1emu.net) with all checksums set to SKIP, meaning any content served by that host is installed without integrity verification. The binary is then executed via Wine. While amigan.1emu.net appears to be the actual upstream release host for WinArcadia (the URL matches the project's official release page), the combination of SKIP checksums on an executed binary from a non-major-CDN host constitutes a genuine supply-chain risk: silent replacement or compromise of the host would result in arbitrary code execution under Wine. The pkgver() function also performs a live curl to scrape the version, adding a minor TOCTOU concern. This is a real medium-severity concern, not a false positive, though it is not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sterophonick
    
      2
    
      3pkgname=winarcadia-bin
    
      4_pkgname='winarcadia-bin'
    
      5pkgver=34.41
    
      6pkgrel=2
    
      7pkgdesc='Emulator/Debugger of various Signetics 2650 game consoles'
    
      8url='https://amigan.1emu.net/releases'
    
      9arch=(x86_64 i686)
    
      10depends=('wine')
    
      11makedepends=(p7zip)
    
      12source=(https://amigan.1emu.net/releases/WinArcadia-bin.rar
    
      13        winarcadia
    
      14        winarcadia.desktop
    
      15        winarcadia.png)
    
      16noextract=(WinArcadia-bin.rar) # makepkg sucks at rars
    
      17md5sums=('SKIP' # this program is updated REALLY often :sob:
    
      18         'SKIP'
    
      19         'SKIP'
    
      20         'SKIP')
    
      21
    
      22pkgver() {
    
      23  curl -sS https://amigan.1emu.net/releases/ | grep -Po "(?<=WinArcadia )(.*)(?= \(Windows)"
    
      24}
    
      25
    
      26prepare() {
    
      27  mkdir -p $srcdir/zip
    
      28  7z x WinArcadia-bin.rar -o$srcdir/zip
    
      29}
    
      30
    
      31package() {
    
      32  cd $srcdir
    
      33  install -Dm755 winarcadia $pkgdir/usr/bin/winarcadia
    
      34  install -Dm644 winarcadia.desktop $pkgdir/usr/share/applications/winarcadia.desktop
    
      35  install -Dm644 winarcadia.png $pkgdir/usr/share/pixmaps/winarcadia.png
    
      36
    
      37  mkdir -p $pkgdir/usr/share/winarcadia/
    
      38  cp -r zip/* $pkgdir/usr/share/winarcadia
    
      39  chmod -R 777 $pkgdir/usr/share/winarcadia
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2