xmage
maintainer aidonius
· 6 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt Java application archive from a non-standard, non-official host (beta.xmage.today) which is not the project's primary repository or release platform, posing a supply-chain risk if the host is compromised or malicious.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
"http://beta.xmage.today/files/mage-full_1.4.60-dev_2026-07-11_16-06.zip"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Java application archive from a non-standard, non-official host (beta.xmage.today) which is not the project's primary repository or release platform, posing a supply-chain risk if the host is compromised or malicious.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Aidan Coward <aidan -dot- coward -at- gmail -dot- com>
2
# Feedback is appreciated
3
4
pkgname=xmage
5
pkgver=1.4.60V3
6
pkgrel=0
7
8
pkgdesc="Java-based program for playing Magic:The Gathering, including client and server"
9
10
arch=('any')
11
url="http://xmage.today"
12
license=('MIT')
13
14
source=(
15
"http://beta.xmage.today/files/mage-full_1.4.60-dev_2026-07-11_16-06.zip"
16
'https://raw.githubusercontent.com/magefree/mage/master/LICENSE.txt'
17
'https://raw.githubusercontent.com/magefree/Launcher/master/src/main/resources/icon-mage.png'
18
'https://raw.githubusercontent.com/magefree/Launcher/refs/heads/master/src/deb/xmage.desktop')
19
20
sha256sums=("6a433bf5ec9bb4c61198695392221ca6cee15ebfbb2c55ee73093ea4b548865f"
21
"SKIP"
22
"SKIP"
23
"SKIP")
24
25
depends=('jre8-openjdk' 'java8-openjfx')
26
optdepends=('wmname: change window manager name for compatibility with certain WMs')
27
install="${pkgname}.install"
28
29
package() {
30
31
echo "cleaning files"
32
rm *.zip
33
rm *.cmd
34
35
echo "changing file format of included scripts..."
36
awk '{ sub("\r$", ""); print }' xmage/mage-client/startClient.sh > xmage/mage-client/startClient-unix.sh
37
awk '{ sub("\r$", ""); print }' xmage/mage-server/startServer.sh > xmage/mage-server/startServer-unix.sh
38
39
echo "changing default locations of scripts..."
40
sed -i 's|\.\/lib|\/usr\/share\/xmage\/xmage\/mage-client\/lib|' xmage/mage-client/startClient-unix.sh
41
sed -i 's|\.\/lib|\/usr\/share\/xmage\/xmage\/mage-server\/lib|' xmage/mage-server/startServer-unix.sh
42
43
echo "adding cd to relevant /usr/share/xmage/ directory..."
44
sed -i '2i cd /usr/share/xmage/xmage/mage-client' xmage/mage-client/startClient-unix.sh
45
sed -i '2i cd /usr/share/xmage/xmage/mage-server' xmage/mage-server/startServer-unix.sh
46
47
echo "increasing default memory limit of client and server"
48
sed -i 's|-Xmx2000m|-Xmx4096m|g' xmage/mage-client/startClient-unix.sh
49
sed -i 's|-Xmx2000m|-Xmx4096m|g' xmage/mage-server/startServer-unix.sh
50
51
echo "changing values in desktop file"
52
sed -i 's|Exec=xmage|Exec=/usr/bin/mage-client|' xmage.desktop
53
echo "Path=/usr/share/xmage/" >> xmage.desktop
54
55
echo "moving files..."
56
install -Dm755 xmage/mage-client/startClient-unix.sh "${pkgdir}"/usr/bin/mage-client
57
install -Dm755 xmage/mage-server/startServer-unix.sh "${pkgdir}"/usr/bin/mage-server
58
59
echo "creating /usr/share/xmage..."
60
install -dm755 "${pkgdir}"/usr/share/xmage
61
62
echo "copying files to /usr/share/xmage..."
63
cp -ra ./* "${pkgdir}"/usr/share/xmage/
64
65
echo "setting permissions of /usr/share/xmage..."
66
chmod -R a+rwx "${pkgdir}"/usr/share/xmage
67
68
echo "installing license: ${license}..."
69
install -Dm644 LICENSE.txt "${pkgdir}"/usr/share/licences/"${pkgname}"/LICENSE.txt
70
71
echo "installing mage-server systemd unit file to /usr/lib/systemd/system..."
72
mkdir -p "${pkgdir}"/usr/lib/systemd/system
73
install -m755 ../mage-server.service "${pkgdir}"/usr/lib/systemd/system
74
75
echo "installing icon and .desktop file..."
76
mkdir -p "${pkgdir}"/usr/share/icons
77
install -m755 icon-mage.png "${pkgdir}"/usr/share/icons/
78
mkdir -p "${pkgdir}"/usr/share/applications
79
install -m755 xmage.desktop "${pkgdir}"/usr/share/applications/xmage.desktop
80
}
81
Changes since previous scan
--- PKGBUILD @ 2026-07-23 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -2,7 +2,7 @@ # Feedback is appreciated pkgname=xmage-pkgver=1.4.60V2+pkgver=1.4.60V3 pkgrel=0 pkgdesc="Java-based program for playing Magic:The Gathering, including client and server"@@ -12,12 +12,12 @@ license=('MIT') source=(- "http://beta.xmage.today/files/mage-full_1.4.60-dev_2026-06-28_13-19.zip"+ "http://beta.xmage.today/files/mage-full_1.4.60-dev_2026-07-11_16-06.zip" 'https://raw.githubusercontent.com/magefree/mage/master/LICENSE.txt' 'https://raw.githubusercontent.com/magefree/Launcher/master/src/main/resources/icon-mage.png' 'https://raw.githubusercontent.com/magefree/Launcher/refs/heads/master/src/deb/xmage.desktop') -sha256sums=("9fa837f2b135f594b28a9a0ea777272d3b098ab2d15de2c5d5fb7b82fc776d5b" +sha256sums=("6a433bf5ec9bb4c61198695392221ca6cee15ebfbb2c55ee73093ea4b548865f" "SKIP" "SKIP" "SKIP")Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 17:25:21 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |