xrcsimulator

maintainer Octopus118 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source downloads a prebuilt executable zip from a non-standard URL on the project's own domain, which is not on the standard whitelist; while plausible for the project, the unverifiable nature of the binary payload and non-standard download mechanism raises supply-chain concerns.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("${pkgname}-${pkgver}.zip::https://xrcsimulator.org/?sdm_process_download=1&download_id=2789")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 85%): The source downloads a prebuilt executable zip from a non-standard URL on the project's own domain, which is not on the standard whitelist; while plausible for the project, the unverifiable nature of the binary payload and non-standard download mechanism raises supply-chain concerns.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ian Lansdowne <idlansdowneatgmailcom>
    
      2# Contributor: Jack Rubacha <rubacha.jack03@gmail.com>
    
      3# Contributor: Edward Wawrzynek <edward@wawrzynek.com>
    
      4
    
      5pkgname=xrcsimulator
    
      6pkgver=20.2a
    
      7pkgdesc="FIRST Tech Challenge, FIRST Robotics Competition, and VEX Simulator"
    
      8pkgrel=1
    
      9arch=('x86_64')
    
      10url="https://xrcsimulator.org"
    
      11license=('unknown')
    
      12depends=(zlib bash)
    
      13optdepends=('openvr: For VR support')
    
      14makedepends=('gendesk')
    
      15replaces=('ftcfrcsimulator')
    
      16
    
      17# Base name of files in the zip
    
      18_files_name="xRC Simulator"
    
      19
    
      20source=("${pkgname}-${pkgver}.zip::https://xrcsimulator.org/?sdm_process_download=1&download_id=2789")
    
      21sha1sums=('1bfaadeec1f9bfad37f30f2c92b7a43f160ce0f1')
    
      22
    
      23prepare() {
    
      24	gendesk -n -f --pkgname "$pkgname" --pkgdesc "$pkgdesc" --name="XRC Simulator" --categories="Education;Game"
    
      25}
    
      26
    
      27package() {
    
      28	mkdir -p "$pkgdir/usr/share/xrcsimulator" "$pkgdir/usr/bin"
    
      29
    
      30	# Copy data to /usr/share, set directory permissions to 755, file permissions to 644
    
      31	cp -r . "$pkgdir/usr/share/xrcsimulator/"
    
      32	chmod -R u+rwX,go+rX,go-w "$pkgdir/usr/share/xrcsimulator"
    
      33	chmod 755 "$pkgdir/usr/share/xrcsimulator/$_files_name.x86_64"
    
      34	chmod 755 "$pkgdir/usr/share/xrcsimulator/UnityPlayer.so"
    
      35
    
      36	# Create soft link to binary
    
      37	ln -s "/usr/share/xrcsimulator/$_files_name.x86_64" "$pkgdir/usr/bin/xrcsimulator"
    
      38
    
      39	# Desktop Entry
    
      40	install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      41
    
      42	# Logo
    
      43	install -Dm644 "${_files_name}_Data/Resources/UnityPlayer.png" "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2