ysflight

maintainer theYinYeti · 6 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary archive (containing Linux x86_64 executables: ysflight64_gl1, ysflight64_gl2, ysflight64_nownd) from ysflight.org, which is the official YSFlight project site (the canonical upstream for this freeware flight simulator). The binaries are installed and made executable. The concern is that these are closed-source prebuilt binaries from a third-party host with only an md5sum for integrity verification (md5 is cryptographically weak and provides minimal protection against targeted substitution). However, ysflight.org is the legitimate upstream vendor site for this software, not a random personal host, which significantly reduces supply-chain risk compared to a truly unofficial mirror. The pattern is consistent with many AUR packages that package freeware binaries from their official vendor. The medium rating is marginally justified due to the prebuilt binary nature and weak checksum, but this is a borderline clean/medium case — the main residual risk is the absence of a strong cryptographic checksum (sha256/sha512) and the closed-source binary nature, not an indication of malicious intent.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=('YsflightForLinux.zip::https://ysflight.org/files/20181124YsflightForMacAndLinux.zip'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary archive (containing Linux x86_64 executables: ysflight64_gl1, ysflight64_gl2, ysflight64_nownd) from ysflight.org, which is the official YSFlight project site (the canonical upstream for this freeware flight simulator). The binaries are installed and made executable. The concern is that these are closed-source prebuilt binaries from a third-party host with only an md5sum for integrity verification (md5 is cryptographically weak and provides minimal protection against targeted substitution). However, ysflight.org is the legitimate upstream vendor site for this software, not a random personal host, which significantly reduces supply-chain risk compared to a truly unofficial mirror. The pattern is consistent with many AUR packages that package freeware binaries from their official vendor. The medium rating is marginally justified due to the prebuilt binary nature and weak checksum, but this is a borderline clean/medium case — the main residual risk is the absence of a strong cryptographic checksum (sha256/sha512) and the closed-source binary nature, not an indication of malicious intent.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yves G. <theYinYeti@yalis.fr>
    
      2
    
      3pkgname=ysflight
    
      4pkgver=20181124
    
      5pkgrel=2
    
      6pkgdesc="A portable flight simulator"
    
      7arch=('x86_64')
    
      8url="http://wwwe.ysflight.com/"
    
      9license=('freeware')
    
      10depends=('glu')
    
      11makedepends=(python)
    
      12ysflight_dir="/opt/ysflight-$pkgver"
    
      13
    
      14source=('YsflightForLinux.zip::https://ysflight.org/files/20181124YsflightForMacAndLinux.zip'
    
      15        'ysflight.sh')
    
      16md5sums=('26a8f7bcc79eb710895547f052a09fef'
    
      17         '540ca8dec29fec23c67f830c6cce5d5c')
    
      18
    
      19prepare() {
    
      20  cd "${srcdir}"
    
      21  sed -i "s#YSFLIGHT_DIR#${ysflight_dir}#g" ysflight.sh
    
      22  cd "${srcdir}/Ysflight"
    
      23  sed -ri "
    
      24    s#^([[:blank:]]*)input\\(.*#\\1pass#
    
      25
    
      26    s#join\\(\"~\",\"Desktop\"#join(\"${pkgdir}/usr/share/applications\"#
    
      27    s#Exec=\"\\+exe#Exec=/usr/bin/\"+os.path.basename(exe)#
    
      28    s#isfile\\(iconfile\\)#isfile(\"${pkgdir}\"+iconfile)#
    
      29    /Path=/d
    
      30
    
      31    s#YSFLIGHTPATH=.*#YSFLIGHTPATH=\"${ysflight_dir}\"#
    
      32    s#to ~/YSFLIGHT.COM/ysflight#to ${ysflight_dir}#
    
      33    s#(isdir|rmtree)\\(YSFLIGHTPATH\\)#\\1(\"${pkgdir}\"+YSFLIGHTPATH)#
    
      34    s#(copytree\\(FindYsflight.*,)YSFLIGHTPATH#\1\"${pkgdir}\"+YSFLIGHTPATH#
    
      35    s#(FileCheck\\()YSFLIGHT#\1\"${pkgdir}\"+YSFLIGHT#
    
      36  " InstallInLinux.py
    
      37}
    
      38
    
      39package() {
    
      40  echo '
    
      41[WARNING!]
    
      42[WARNING!] This installer does its best to enforce
    
      43[WARNING!] Linux’ standard file locations. Unfortunately,
    
      44[WARNING!]   “ $HOME/Documents/YSFLIGHT.COM ”
    
      45[WARNING!] is hard-coded into the binary programs…
    
      46[WARNING!]
    
      47'
    
      48
    
      49  cd "${pkgdir}"
    
      50  mkdir -p usr/bin usr/share/applications opt
    
      51
    
      52  cd "${srcdir}/Ysflight"
    
      53  python InstallInLinux.py
    
      54
    
      55  cd "${pkgdir}"
    
      56  find "${ysflight_dir#/}" -type d -exec chmod 755 {} \;
    
      57  find "${ysflight_dir#/}" ! -type d -exec chmod 444 {} \;
    
      58  chmod 555 "${ysflight_dir#/}"/ysflight64_*
    
      59  install -Dm555 "${srcdir}/ysflight.sh" usr/bin/ysflight
    
      60  touch usr/bin/ysflight
    
      61  ln -s ysflight usr/bin/ysflight64_gl1
    
      62  ln -s ysflight usr/bin/ysflight64_gl2
    
      63  ln -s ysflight usr/bin/ysflight64_nownd
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2