xmage
MEDIUM
maintainer aidonius
7 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt Java application from a non-standard, project-unrelated host (beta.xmage.today) with a SKIP'd checksum, creating a supply-chain risk if the host were compromised or maliciously redirected.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
"http://beta.xmage.today/files/mage-full_1.4.63-dev_2026-10-31_09-42.zip"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Java application from a non-standard, project-unrelated host (beta.xmage.today) with a SKIP'd checksum, creating a supply-chain risk if the host were compromised or maliciously redirected.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Aidan Coward <aidan -dot- coward -at- gmail -dot- com>
2
# Feedback is appreciated
3
4
pkgname=xmage
5
pkgver=1.4.63V1
6
pkgrel=0
7
8
pkgdesc="Java-based program for playing Magic:The Gathering, including client and server"
9
10
arch=('any')
11
url="http://xmage.today"
12
license=('MIT')
13
14
source=(
15
"http://beta.xmage.today/files/mage-full_1.4.63-dev_2026-10-31_09-42.zip"
16
'https://raw.githubusercontent.com/magefree/mage/master/LICENSE.txt'
17
'https://raw.githubusercontent.com/magefree/Launcher/master/src/main/resources/icon-mage.png'
18
'https://raw.githubusercontent.com/magefree/Launcher/refs/heads/master/src/deb/xmage.desktop')
19
20
sha256sums=("f48e69a2583720800ab6a447458ede73bded5cb21905b0d9658a6052ab43908a"
21
"SKIP"
22
"SKIP"
23
"SKIP")
24
25
depends=('jre8-openjdk' 'java8-openjfx')
26
optdepends=('wmname: change window manager name for compatibility with certain WMs')
27
install="${pkgname}.install"
28
29
package() {
30
31
echo "cleaning files"
32
rm *.zip
33
rm *.cmd
34
35
echo "changing file format of included scripts..."
36
awk '{ sub("\r$", ""); print }' xmage/mage-client/startClient.sh > xmage/mage-client/startClient-unix.sh
37
awk '{ sub("\r$", ""); print }' xmage/mage-server/startServer.sh > xmage/mage-server/startServer-unix.sh
38
39
echo "changing default locations of scripts..."
40
sed -i 's|\.\/lib|\/usr\/share\/xmage\/xmage\/mage-client\/lib|' xmage/mage-client/startClient-unix.sh
41
sed -i 's|\.\/lib|\/usr\/share\/xmage\/xmage\/mage-server\/lib|' xmage/mage-server/startServer-unix.sh
42
43
echo "adding cd to relevant /usr/share/xmage/ directory..."
44
sed -i '2i cd /usr/share/xmage/xmage/mage-client' xmage/mage-client/startClient-unix.sh
45
sed -i '2i cd /usr/share/xmage/xmage/mage-server' xmage/mage-server/startServer-unix.sh
46
47
echo "increasing default memory limit of client and server"
48
sed -i 's|-Xmx2000m|-Xmx4096m|g' xmage/mage-client/startClient-unix.sh
49
sed -i 's|-Xmx2000m|-Xmx4096m|g' xmage/mage-server/startServer-unix.sh
50
51
echo "changing values in desktop file"
52
sed -i 's|Exec=xmage|Exec=/usr/bin/mage-client|' xmage.desktop
53
echo "Path=/usr/share/xmage/" >> xmage.desktop
54
55
echo "moving files..."
56
install -Dm755 xmage/mage-client/startClient-unix.sh "${pkgdir}"/usr/bin/mage-client
57
install -Dm755 xmage/mage-server/startServer-unix.sh "${pkgdir}"/usr/bin/mage-server
58
59
echo "creating /usr/share/xmage..."
60
install -dm755 "${pkgdir}"/usr/share/xmage
61
62
echo "copying files to /usr/share/xmage..."
63
cp -ra ./* "${pkgdir}"/usr/share/xmage/
64
65
echo "setting permissions of /usr/share/xmage..."
66
chmod -R a+rwx "${pkgdir}"/usr/share/xmage
67
68
echo "installing license: ${license}..."
69
install -Dm644 LICENSE.txt "${pkgdir}"/usr/share/licences/"${pkgname}"/LICENSE.txt
70
71
echo "installing mage-server systemd unit file to /usr/lib/systemd/system..."
72
mkdir -p "${pkgdir}"/usr/lib/systemd/system
73
install -m755 ../mage-server.service "${pkgdir}"/usr/lib/systemd/system
74
75
echo "installing icon and .desktop file..."
76
mkdir -p "${pkgdir}"/usr/share/icons
77
install -m755 icon-mage.png "${pkgdir}"/usr/share/icons/
78
mkdir -p "${pkgdir}"/usr/share/applications
79
install -m755 xmage.desktop "${pkgdir}"/usr/share/applications/xmage.desktop
80
}
81
Changes since previous scan
--- PKGBUILD @ 2026-10-31 00:07+++ PKGBUILD @ 2026-11-01 00:21@@ -2,7 +2,7 @@ # Feedback is appreciated pkgname=xmage-pkgver=1.4.62V1+pkgver=1.4.63V1 pkgrel=0 pkgdesc="Java-based program for playing Magic:The Gathering, including client and server"@@ -12,12 +12,12 @@ license=('MIT') source=(- "http://beta.xmage.today/files/mage-full_1.4.62-dev_2026-10-03_20-47.zip"+ "http://beta.xmage.today/files/mage-full_1.4.63-dev_2026-10-31_09-42.zip" 'https://raw.githubusercontent.com/magefree/mage/master/LICENSE.txt' 'https://raw.githubusercontent.com/magefree/Launcher/master/src/main/resources/icon-mage.png' 'https://raw.githubusercontent.com/magefree/Launcher/refs/heads/master/src/deb/xmage.desktop') -sha256sums=("d256251ae41155638233c2cb20a7fec82f3f2dea7a468976691664c55e357b16" +sha256sums=("f48e69a2583720800ab6a447458ede73bded5cb21905b0d9658a6052ab43908a" "SKIP" "SKIP" "SKIP")Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 23:59:16 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |