asciiportal

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host is used only to fetch a PNG image and two GitHub patch files, all of which are public and non-executable; the image is resized for the icon and patches are applied to the source, but the primary source is from the project's official GitHub repository, and the worst case of a swapped image or patch is limited to cosmetic or build modification, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is used only to fetch a PNG image and two GitHub patch files, all of which are public and non-executable; the image is resized for the icon and patches are applied to the source, but the primary source is from the project's official GitHub repository, and the worst case of a swapped image or patch is limited to cosmetic or build modification, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "$pkgname.png::https://fc01.deviantart.net/fs71/f/2010/318/3/5/portal_ascii_icon___button_by_lightmystic-d32udqx.png"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kleintux <reg-archlinux AT klein DOT tuxli DOT ch> 
    
      2# Contributor: Alexander F. Rødseth <xyproto@archlinux.org>
    
      3# Contributor: Baptiste Jonglez <baptiste@jonglez.org>
    
      4# Contributor: Serge Ziryukin <ftrvxmtrx@gmail.com>
    
      5# Contributor: loqs
    
      6
    
      7pkgname=asciiportal
    
      8pkgver=1.3.8
    
      9pkgrel=7
    
      10pkgdesc='Text based puzzle game inspired by the popular video game'
    
      11arch=(x86_64)
    
      12url='https://github.com/cymonsgames/ASCIIpOrtal'
    
      13license=(custom GPL3)
    
      14depends=(pdcurses sdl_mixer yaml-cpp)
    
      15makedepends=(gendesk git imagemagick setconf)
    
      16source=("git+https://github.com/cymonsgames/ASCIIpOrtal.git#tag=v${pkgver%.8}-beta${pkgver#*.*.}"
    
      17        "$pkgname.png::https://fc01.deviantart.net/fs71/f/2010/318/3/5/portal_ascii_icon___button_by_lightmystic-d32udqx.png"
    
      18	"patch1.patch::https://github.com/cymonsgames/ASCIIpOrtal/commit/f0157d8c01252ebcdd238ea2c42b3cce4531bac3.diff"
    
      19	"patch2.patch::https://github.com/cymonsgames/ASCIIpOrtal/commit/7817f5c10b715ad44161fff998367aa449591d16.diff")
    
      20
    
      21sha256sums=('SKIP'
    
      22            '390f21881377b331f1a65a3e54ccf91fba72a88146058cc146f914a1185de9d1'
    
      23            'dd8278ea45ff848a51bf66a577657ffaa7c3875316e7a0770a08b691c308606f'
    
      24            '8c3e334b3022f74ba46e3f5d85d0d375f5c7e5e5c2c17cae16fa36d98bcbd79e')
    
      25
    
      26prepare() {
    
      27  gendesk -n -f \
    
      28    --name ASCIIpOrtal \
    
      29    --pkgname $pkgname \
    
      30    --pkgdesc "$pkgdesc" \
    
      31    --exec $pkgname
    
      32  convert \
    
      33    +set date:create +set date:modify \
    
      34    $pkgname.png \
    
      35    -resize 48x48\! \
    
      36    ${pkgname}48x48.png
    
      37  setconf \
    
      38    ASCIIpOrtal/Makefile.linux \
    
      39    CXXFLAGS="$CXXFLAGS -I/usr/include/xcurses $(pkg-config sdl --cflags) $(pkg-config SDL_mixer --cflags) -U__NOSDL__ -U__NOSOUND__ -U__DINGOO__ -U__GP2X__ -O0 -w"
    
      40  setconf \
    
      41    ASCIIpOrtal/Makefile.linux \
    
      42    LINKFLAGS="\$(LINKFLAGS) \$(LDFLAGS) -L/usr/lib $(pkg-config sdl --libs) $(pkg-config SDL_mixer --libs) -lpdcurses"
    
      43  echo 'The ASCIIportal icon is drawn by Matt White and licensed under a CC license' > icon.txt
    
      44
    
      45  cd ASCIIpOrtal
    
      46  git apply  ../../patch1.patch
    
      47  git apply ../../patch2.patch
    
      48}
    
      49
    
      50build() {
    
      51  make -C ASCIIpOrtal linux
    
      52}
    
      53
    
      54package() {
    
      55  make -C ASCIIpOrtal DESTDIR="$pkgdir" install
    
      56  install -Dm644 $pkgname.desktop "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      57  install -Dm644 ${pkgname}48x48.png "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      58  install -Dm644 icon.txt "$pkgdir/usr/share/licenses/$pkgname/icon.txt"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2