1oom

maintainer ajacocks · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from a plausible project-owned host (sourcecraft.dev) which is not on the standard whitelist but hosts the project's own tarball; this is a normal build of the project's source, not a prebuilt binary or executed remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from a plausible project-owned host (sourcecraft.dev) which is not on the standard whitelist but hosts the project's own tarball; this is a normal build of the project's source, not a prebuilt binary or executed remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=( "${pkgname}-${pkgver}.tar.gz::https://sourcecraft.dev/api/archive/fork1oom/${pkgname}?rev=tag%3Av${pkgver}&format=tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexander Jacocks <alexander@redhat.com>
    
      2
    
      3pkgname=1oom
    
      4pkgver=1.11.9
    
      5pkgrel=1.1
    
      6pkgdesc="1oom is a Master of Orion (1993) game engine recreation."
    
      7arch=(x86_64)
    
      8url=https://sourcecraft.dev/fork1oom/1oom
    
      9license=('GPL2')
    
      10depends=(sdl2 sdl2_mixer libsamplerate soundfont-fluid)
    
      11source=(  "${pkgname}-${pkgver}.tar.gz::https://sourcecraft.dev/api/archive/fork1oom/${pkgname}?rev=tag%3Av${pkgver}&format=tar.gz"
    
      12          'Master_of_Orion_cover.png'
    
      13          '1oom.desktop'
    
      14          '1oom_classic_sdl2.sh' )
    
      15noextract=("${pkgname}-${pkgver}.tar.gz")
    
      16md5sums=('1cf57e00565dec541168d498d86f4b56'
    
      17         '49248e72b7ddc5209cca2c1c61099d85'
    
      18         'ccac2feb67cecfc30b8156edf106b7ca'
    
      19         '41b52627b2d52b477adcbc2a9a627b37')
    
      20
    
      21prepare() {
    
      22  tar -xvf ${pkgname}-${pkgver}.tar.gz --transform "s|^[^/]*|${pkgname}-${pkgver}|"
    
      23}
    
      24
    
      25build() {
    
      26  cd "${srcdir}/${pkgname}-${pkgver}"
    
      27  autoreconf -fi
    
      28  test -d build-native || mkdir build-native
    
      29  cd build-native
    
      30  ../configure --prefix=/usr
    
      31  { test "$(nproc)" -gt 1 && make -j"$(nproc)" ;} || make
    
      32}
    
      33
    
      34package() {
    
      35  cd "${srcdir}/${pkgname}-${pkgver}/build-native"
    
      36  make PREFIX="/usr" DESTDIR="${pkgdir}" install
    
      37
    
      38  # install docs
    
      39  cd "${srcdir}/${pkgname}-${pkgver}/doc"
    
      40  mkdir -p "$pkgdir/usr/share/doc/${pkgname}"
    
      41  cp *.txt "$pkgdir/usr/share/doc/${pkgname}/"
    
      42  cd ..
    
      43  cp AUTHORS CHANGES COMPILING COPYING HACKING NEWS PHILOSOPHY README.md "$pkgdir/usr/share/doc/${pkgname}/"
    
      44
    
      45  # create storage directory for MOO data
    
      46  mkdir -p "$pkgdir/usr/share/1oom"
    
      47
    
      48  # install launch script
    
      49  mv "$pkgdir/usr/bin/1oom_classic_sdl2" "$pkgdir/usr/bin/1oom_classic_sdl2-bin"
    
      50  install -m 0755 "${srcdir}/1oom_classic_sdl2.sh" "$pkgdir/usr/bin/1oom_classic_sdl2"
    
      51
    
      52  # install icon
    
      53  install -Dm 0644 ${srcdir}/Master_of_Orion_cover.png $pkgdir/usr/share/icons/hicolor/256x256/apps/${pkgname}.png
    
      54
    
      55  # install desktop file
    
      56  install -Dm644 ${srcdir}/${pkgname}.desktop $pkgdir/usr/share/applications/${pkgname}.desktop
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2