yarg-nightly-bin

maintainer MaddieMewmews · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD downloads a prebuilt binary ZIP from the official GitHub releases of YARC-Official/YARG-BleedingEdge, which is the legitimate upstream project. The source host is github.com/YARC-Official, not a personal or unofficial host. The use of 'SKIP' for the checksum is sloppy and means integrity of the downloaded ZIP is not verified at build time, but this is a common (if poor) practice for nightly/rolling packages where the version is determined dynamically. The pkgver is fetched dynamically via curl+python at parse time (line 6), which is unusual but not malicious — it queries the GitHub API to get the latest tag. The other sources (the wrapper script, desktop file, and LICENSE) have explicit sha256sums. The binary being installed is from the official upstream GitHub releases page. There is no code from unofficial/personal hosts, no obfuscation, and no exfiltration. The main concern is the missing checksum on the ZIP, which is a quality/integrity issue rather than an active supply-chain attack. Overall this is low severity: sloppy (SKIP checksum, dynamic pkgver at parse time) but not a genuine supply-chain threat given the source is the official upstream GitHub releases.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD downloads a prebuilt binary ZIP from the official GitHub releases of YARC-Official/YARG-BleedingEdge, which is the legitimate upstream project. The source host is github.com/YARC-Official, not a personal or unofficial host. The use of 'SKIP' for the checksum is sloppy and means integrity of the downloaded ZIP is not verified at build time, but this is a common (if poor) practice for nightly/rolling packages where the version is determined dynamically. The pkgver is fetched dynamically via curl+python at parse time (line 6), which is unusual but not malicious — it queries the GitHub API to get the latest tag. The other sources (the wrapper script, desktop file, and LICENSE) have explicit sha256sums. The binary being installed is from the official upstream GitHub releases page. There is no code from unofficial/personal hosts, no obfuscation, and no exfiltration. The main concern is the missing checksum on the ZIP, which is a quality/integrity issue rather than an active supply-chain attack. Overall this is low severity: sloppy (SKIP checksum, dynamic pkgver at parse time) but not a genuine supply-chain threat given the source is the official upstream GitHub releases.

1 higher static finding superseded - not the current verdict (shown for transparency)

HIGH Remote download executed by a shell curl_pipe_shell

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

PKGBUILD:6 pkgver="$(curl --silent -m 10 --connect-timeout 5 "https://api.github.com/repos/YARC-Official/YARG-BleedingEdge/releases/latest" | python3 -c "import sys, json; print(json.load(sys.stdin)['tag_name'])")"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: MaddieMewmews <maddie at mewmews dot gay>
    
      2# Contributor: TheTrueColonel <benjaminesims@gmail.com>
    
      3# Contributor: NicKoehler <grillinicolavocal at gmail dot com>
    
      4_pkgname=yarg-nightly
    
      5pkgname=$_pkgname-bin
    
      6pkgver="$(curl --silent -m 10 --connect-timeout 5 "https://api.github.com/repos/YARC-Official/YARG-BleedingEdge/releases/latest" | python3 -c "import sys, json; print(json.load(sys.stdin)['tag_name'])")"
    
      7pkgrel=1
    
      8pkgdesc="YARG - Yet Another Rhythm Game inspired off of Rockband, Guitar Hero, Clone Hero, or similar. Nightly build"
    
      9arch=("x86_64")
    
      10url="https://github.com/YARC-Official/YARG-BleedingEdge"
    
      11install=$_pkgname.install
    
      12license=('LGPL-3.0-only')
    
      13depends=("hidapi" "systemd-libs" "alsa-lib" "gtk3" "glib2" "libdecor")
    
      14makedepends=("python" "curl")
    
      15provides=("yarg-nightly")
    
      16conflicts=("yarg-nightly" "yarg-nightly-git")
    
      17source=(
    
      18    "$_pkgname"
    
      19    "$_pkgname.desktop"
    
      20    "YARG_${pkgver}.zip::https://github.com/YARC-Official/YARG-BleedingEdge/releases/download/${pkgver}/YARG_${pkgver}-Linux-x64.zip"
    
      21    "https://raw.githubusercontent.com/YARC-Official/YARG/master/LICENSE"
    
      22)
    
      23sha256sums=('c050a92722e051753fe5db0d6eaabb19656723f552f54dd450dd5273d4d12b3b'
    
      24            '38199fb3ff44d606b436a3a717c837df26b96f935e0da8b289e9bfa3bafa4ceb'
    
      25            'SKIP'
    
      26            'a5681bf9b05db14d86776930017c647ad9e6e56ff6bbcfdf21e5848288dfaf1b')
    
      27
    
      28package() {
    
      29
    
      30    # create dirs
    
      31    install -dm755 "$pkgdir/usr/bin"
    
      32    install -dm755 "$pkgdir/etc/udev/rules.d"
    
      33    install -dm777 "$pkgdir/opt/$_pkgname"
    
      34
    
      35    # install binaries
    
      36    install -Dm777 "$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      37    install -Dm777 "$srcdir/UnityPlayer.so" "$pkgdir/opt/$_pkgname/"
    
      38    install -Dm777 "$srcdir/YARG" "$pkgdir/opt/$_pkgname/YARG"
    
      39    cp -r "$srcdir/YARG_Data" "$pkgdir/opt/$_pkgname/YARG_Data"
    
      40
    
      41    # install icon and .desktop
    
      42    install -Dm644 "$pkgdir/opt/$_pkgname/YARG_Data/Resources/UnityPlayer.png" "$pkgdir/usr/share/pixmaps/$_pkgname.png"
    
      43    install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      44
    
      45    # install license
    
      46    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      47
    
      48    # create 69-hid.rules
    
      49    echo 'KERNEL=="hidraw*", TAG+="uaccess"' > "$pkgdir/etc/udev/rules.d/69-$_pkgname-hid.rules"
    
      50
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2