xmage
MEDIUM
maintainer aidonius
6 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt zip archive from a non-standard, project-associated host (beta.xmage.today) with a fixed checksum, which is a normal AUR practice, but the unverifiable nature of the prebuilt Java-based executable and SKIP'd checksums for other sources slightly increases supply-chain risk, though no active malicious behavior is evident.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
"http://beta.xmage.today/files/mage-full_1.4.61-dev_2026-08-12_12-34.zip"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt zip archive from a non-standard, project-associated host (beta.xmage.today) with a fixed checksum, which is a normal AUR practice, but the unverifiable nature of the prebuilt Java-based executable and SKIP'd checksums for other sources slightly increases supply-chain risk, though no active malicious behavior is evident.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Aidan Coward <aidan -dot- coward -at- gmail -dot- com>
2
# Feedback is appreciated
3
4
pkgname=xmage
5
pkgver=1.4.61V1
6
pkgrel=0
7
8
pkgdesc="Java-based program for playing Magic:The Gathering, including client and server"
9
10
arch=('any')
11
url="http://xmage.today"
12
license=('MIT')
13
14
source=(
15
"http://beta.xmage.today/files/mage-full_1.4.61-dev_2026-08-12_12-34.zip"
16
'https://raw.githubusercontent.com/magefree/mage/master/LICENSE.txt'
17
'https://raw.githubusercontent.com/magefree/Launcher/master/src/main/resources/icon-mage.png'
18
'https://raw.githubusercontent.com/magefree/Launcher/refs/heads/master/src/deb/xmage.desktop')
19
20
sha256sums=("2aded65b0eb439e38edd529ba5230f0bd8b44e46f639f745b8ca73584a5ffd98"
21
"SKIP"
22
"SKIP"
23
"SKIP")
24
25
depends=('jre8-openjdk' 'java8-openjfx')
26
optdepends=('wmname: change window manager name for compatibility with certain WMs')
27
install="${pkgname}.install"
28
29
package() {
30
31
echo "cleaning files"
32
rm *.zip
33
rm *.cmd
34
35
echo "changing file format of included scripts..."
36
awk '{ sub("\r$", ""); print }' xmage/mage-client/startClient.sh > xmage/mage-client/startClient-unix.sh
37
awk '{ sub("\r$", ""); print }' xmage/mage-server/startServer.sh > xmage/mage-server/startServer-unix.sh
38
39
echo "changing default locations of scripts..."
40
sed -i 's|\.\/lib|\/usr\/share\/xmage\/xmage\/mage-client\/lib|' xmage/mage-client/startClient-unix.sh
41
sed -i 's|\.\/lib|\/usr\/share\/xmage\/xmage\/mage-server\/lib|' xmage/mage-server/startServer-unix.sh
42
43
echo "adding cd to relevant /usr/share/xmage/ directory..."
44
sed -i '2i cd /usr/share/xmage/xmage/mage-client' xmage/mage-client/startClient-unix.sh
45
sed -i '2i cd /usr/share/xmage/xmage/mage-server' xmage/mage-server/startServer-unix.sh
46
47
echo "increasing default memory limit of client and server"
48
sed -i 's|-Xmx2000m|-Xmx4096m|g' xmage/mage-client/startClient-unix.sh
49
sed -i 's|-Xmx2000m|-Xmx4096m|g' xmage/mage-server/startServer-unix.sh
50
51
echo "changing values in desktop file"
52
sed -i 's|Exec=xmage|Exec=/usr/bin/mage-client|' xmage.desktop
53
echo "Path=/usr/share/xmage/" >> xmage.desktop
54
55
echo "moving files..."
56
install -Dm755 xmage/mage-client/startClient-unix.sh "${pkgdir}"/usr/bin/mage-client
57
install -Dm755 xmage/mage-server/startServer-unix.sh "${pkgdir}"/usr/bin/mage-server
58
59
echo "creating /usr/share/xmage..."
60
install -dm755 "${pkgdir}"/usr/share/xmage
61
62
echo "copying files to /usr/share/xmage..."
63
cp -ra ./* "${pkgdir}"/usr/share/xmage/
64
65
echo "setting permissions of /usr/share/xmage..."
66
chmod -R a+rwx "${pkgdir}"/usr/share/xmage
67
68
echo "installing license: ${license}..."
69
install -Dm644 LICENSE.txt "${pkgdir}"/usr/share/licences/"${pkgname}"/LICENSE.txt
70
71
echo "installing mage-server systemd unit file to /usr/lib/systemd/system..."
72
mkdir -p "${pkgdir}"/usr/lib/systemd/system
73
install -m755 ../mage-server.service "${pkgdir}"/usr/lib/systemd/system
74
75
echo "installing icon and .desktop file..."
76
mkdir -p "${pkgdir}"/usr/share/icons
77
install -m755 icon-mage.png "${pkgdir}"/usr/share/icons/
78
mkdir -p "${pkgdir}"/usr/share/applications
79
install -m755 xmage.desktop "${pkgdir}"/usr/share/applications/xmage.desktop
80
}
81
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |