1oom

LOW

maintainer ajacocks 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is downloaded from a plausible project-owned host (sourcecraft.dev) which is not on the standard whitelist but hosts the project's own tarball; this is a normal build of the project's source, not a prebuilt binary or executed remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from a plausible project-owned host (sourcecraft.dev) which is not on the standard whitelist but hosts the project's own tarball; this is a normal build of the project's source, not a prebuilt binary or executed remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=( "${pkgname}-${pkgver}.tar.gz::https://sourcecraft.dev/api/archive/fork1oom/${pkgname}?rev=tag%3Av${pkgver}&format=tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexander Jacocks <alexander@redhat.com>
    
      2
    
      3pkgname=1oom
    
      4pkgver=1.11.9
    
      5pkgrel=1.1
    
      6pkgdesc="1oom is a Master of Orion (1993) game engine recreation."
    
      7arch=(x86_64)
    
      8url=https://sourcecraft.dev/fork1oom/1oom
    
      9license=('GPL2')
    
      10depends=(sdl2 sdl2_mixer libsamplerate soundfont-fluid)
    
      11source=(  "${pkgname}-${pkgver}.tar.gz::https://sourcecraft.dev/api/archive/fork1oom/${pkgname}?rev=tag%3Av${pkgver}&format=tar.gz"
    
      12          'Master_of_Orion_cover.png'
    
      13          '1oom.desktop'
    
      14          '1oom_classic_sdl2.sh' )
    
      15noextract=("${pkgname}-${pkgver}.tar.gz")
    
      16md5sums=('1cf57e00565dec541168d498d86f4b56'
    
      17         '49248e72b7ddc5209cca2c1c61099d85'
    
      18         'ccac2feb67cecfc30b8156edf106b7ca'
    
      19         '41b52627b2d52b477adcbc2a9a627b37')
    
      20
    
      21prepare() {
    
      22  tar -xvf ${pkgname}-${pkgver}.tar.gz --transform "s|^[^/]*|${pkgname}-${pkgver}|"
    
      23}
    
      24
    
      25build() {
    
      26  cd "${srcdir}/${pkgname}-${pkgver}"
    
      27  autoreconf -fi
    
      28  test -d build-native || mkdir build-native
    
      29  cd build-native
    
      30  ../configure --prefix=/usr
    
      31  { test "$(nproc)" -gt 1 && make -j"$(nproc)" ;} || make
    
      32}
    
      33
    
      34package() {
    
      35  cd "${srcdir}/${pkgname}-${pkgver}/build-native"
    
      36  make PREFIX="/usr" DESTDIR="${pkgdir}" install
    
      37
    
      38  # install docs
    
      39  cd "${srcdir}/${pkgname}-${pkgver}/doc"
    
      40  mkdir -p "$pkgdir/usr/share/doc/${pkgname}"
    
      41  cp *.txt "$pkgdir/usr/share/doc/${pkgname}/"
    
      42  cd ..
    
      43  cp AUTHORS CHANGES COMPILING COPYING HACKING NEWS PHILOSOPHY README.md "$pkgdir/usr/share/doc/${pkgname}/"
    
      44
    
      45  # create storage directory for MOO data
    
      46  mkdir -p "$pkgdir/usr/share/1oom"
    
      47
    
      48  # install launch script
    
      49  mv "$pkgdir/usr/bin/1oom_classic_sdl2" "$pkgdir/usr/bin/1oom_classic_sdl2-bin"
    
      50  install -m 0755 "${srcdir}/1oom_classic_sdl2.sh" "$pkgdir/usr/bin/1oom_classic_sdl2"
    
      51
    
      52  # install icon
    
      53  install -Dm 0644 ${srcdir}/Master_of_Orion_cover.png $pkgdir/usr/share/icons/hicolor/256x256/apps/${pkgname}.png
    
      54
    
      55  # install desktop file
    
      56  install -Dm644 ${srcdir}/${pkgname}.desktop $pkgdir/usr/share/applications/${pkgname}.desktop
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2