zatikon

maintainer lukky513 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary archive (JAR files) from a personal Dropbox URL (dl.dropboxusercontent.com), which is an unofficial, non-vendor host. The JARs are executed at runtime via java-runtime. While checksums (md5 and sha256) are present, Dropbox links can be silently replaced by the link owner, and there is no way to verify these JARs correspond to the official Zatikon release. This is a genuine supply-chain concern: executed code from an unofficial personal hosting service rather than the upstream vendor (zatikon.com). The sha256 also appears truncated (63 hex chars instead of 64), which is a minor integrity concern. Overall this fits the medium category: prebuilt executed binaries from a non-official host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=('https://dl.dropboxusercontent.com/s/ww6ibq603fmvck1/zatikon-jars.tar.xz')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary archive (JAR files) from a personal Dropbox URL (dl.dropboxusercontent.com), which is an unofficial, non-vendor host. The JARs are executed at runtime via java-runtime. While checksums (md5 and sha256) are present, Dropbox links can be silently replaced by the link owner, and there is no way to verify these JARs correspond to the official Zatikon release. This is a genuine supply-chain concern: executed code from an unofficial personal hosting service rather than the upstream vendor (zatikon.com). The sha256 also appears truncated (63 hex chars instead of 64), which is a minor integrity concern. Overall this fits the medium category: prebuilt executed binaries from a non-official host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lukky513 <lukky513 (a t) gmail (d o t) com>
    
      2pkgname=zatikon
    
      3pkgver=1.003
    
      4pkgrel=3
    
      5pkgdesc='Turn-based board strategy game inspired by chess, made by Chronic Logic'
    
      6arch=('any')
    
      7url="http://www.zatikon.com"
    
      8license=('custom:ZatikonEULA')
    
      9depends=('java-runtime-jre<=7'
    
      10         'hicolor-icon-theme'
    
      11         'sh')
    
      12install=('zatikon.install')
    
      13source=('https://dl.dropboxusercontent.com/s/ww6ibq603fmvck1/zatikon-jars.tar.xz')
    
      14
    
      15package() {
    
      16    _gamedir=${pkgdir}/opt/${pkgname}
    
      17
    
      18    install -Dm644 LICENSE ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      19
    
      20	for jarname in zatikon sound art; do
    
      21		install -Dm644 ${jarname}.jar ${_gamedir}/${jarname}.jar
    
      22	done
    
      23
    
      24	install -Dm755 ${pkgname} ${pkgdir}/usr/bin/${pkgname}
    
      25
    
      26    for size in 16x16 32x32 48x48 64x64 128x128; do
    
      27        install -Dm644 icons/${pkgname}_${size}.png ${pkgdir}/usr/share/icons/hicolor/${size}/apps/${pkgname}.png
    
      28    done
    
      29    install -Dm644 icons/${pkgname}_128x128.png ${pkgdir}/usr/share/pixmaps/${pkgname}.png
    
      30
    
      31	install -Dm644 ${pkgname}.desktop ${pkgdir}/usr/share/applications/${pkgname}.desktop
    
      32}
    
      33
    
      34md5sums=('f67c04f9c086f198dfc85c5a4a99b284')
    
      35sha256sums=('4d8839d5638033769a152b12584f455c9985288852808579e1084eac58966aa0')
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2