bakkesmod-steam

maintainer kentslaney · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from official and well-known sources (GitHub, Microsoft, 7-zip.org), with only one unverifiable asset (loopback zip with SKIP'd checksum) from a maintainer's personal repo; no remote code execution, obfuscation, or malicious payloads are present, and the eval usage is limited to safe variable expansion in a controlled context.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official and well-known sources (GitHub, Microsoft, 7-zip.org), with only one unverifiable asset (loopback zip with SKIP'd checksum) from a maintainer's personal repo; no remote code execution, obfuscation, or malicious payloads are present, and the eval usage is limited to safe variable expansion in a controlled context.

PKGBUILD:162 eval "$proton_paths"
PKGBUILD:236 if ! ( eval "$proton_paths" ); then return 0; fi
PKGBUILD:237 eval "$proton_paths"

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 "https://www.7-zip.org/a/7z2501-x64.exe"

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Kent Slaney <kent@slaney.org>
    
      2pkgname=bakkesmod-steam
    
      3rlver=( 2 0 71 )
    
      4pkgver="${rlver[0]}.${rlver[2]}"
    
      5pkgrel=1
    
      6pkgdesc="A mod aimed at making you better at Rocket League!"
    
      7arch=('x86_64')
    
      8url="https://bakkesmod.com/"
    
      9license=('GPL')
    
      10groups=()
    
      11depends=()
    
      12makedepends=('python')
    
      13optdepends=()
    
      14
    
      15# versionless URLs and official repo backups
    
      16# "https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/latest/download/BakkesModSetup.exe"
    
      17# "https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/latest/download/BakkesModInjectorWin7.zip"
    
      18# "https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/latest/download/BakkesMod.zip"
    
      19# "https://api.github.com/repos/bakkesmodorg/BakkesModInjectorCpp/zipball/master"
    
      20
    
      21rlstr=$(IFS=. ; echo "${rlver[*]}")
    
      22rlesc=$(IFS=- ; echo "${rlver[*]}")
    
      23pkgesc=`echo "$pkgver" | sed 's%\.%-%g'`
    
      24
    
      25source=(
    
      26    "dll-$rlesc.zip::https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/download/$rlstr/bakkesmod.zip"
    
      27    "src-$rlesc.zip::https://github.com/bakkesmodorg/BakkesModInjectorCpp/archive/refs/tags/$rlstr.zip"
    
      28    "loopback-$pkgesc-$pkgrel.zip::https://github.com/kentslaney/bakkesmod-arch/archive/refs/tags/$pkgver-$pkgrel-steam.zip"
    
      29    "https://github.com/kentslaney/bakkesmod-arch/releases/download/c369f24-1/inject.exe"
    
      30
    
      31    "https://github.com/kentslaney/bakkesmod-arch/releases/download/05ea332-1/powershell32.exe"
    
      32    "https://github.com/kentslaney/bakkesmod-arch/releases/download/05ea332-1/powershell64.exe"
    
      33    "https://github.com/PowerShell/PowerShell/releases/download/v7.4.1/PowerShell-7.4.1-win-x64.msi"
    
      34    "https://github.com/Maximus5/ConEmu/releases/download/v23.07.24/ConEmuPack.230724.7z"
    
      35    "https://www.7-zip.org/a/7z2501-x64.exe"
    
      36    "https://raw.githubusercontent.com/PietJankbal/powershell-wrapper-for-wine/master/profile.ps1"
    
      37)
    
      38
    
      39sha256sums=(
    
      40    'db8b62a026faafb08b5838c712898bc2ab81817e8b1bfa416091440b2ff958d0'
    
      41    'e49929c27a91610262e4d9ea3bb39e481effe983d4671ed06d349f523c1a6180'
    
      42    'SKIP'
    
      43    '0e038a4f0a2799f6aaa34f6560f5d1d41fba0cf26f8814571cebc94f5bb67a6e'
    
      44
    
      45    '196886b557e632547d32354f20834e88ba3726df29a486c85d6409900064f364'
    
      46    'e8dae4079a66d5a1564c577bd27caf8c890a1044d9c56948581591e196e4ac8c'
    
      47    '66c7c35ed9a46bd27e3d915dcf9a05e38b3f5ebb039883b92aa62ffea20fb187'
    
      48    '2a9b98ebecaede62665ef427b05b3a5ccdac7bd3202414fc0f4c10825b4f4ea2'
    
      49    '78afa2a1c773caf3cf7edf62f857d2a8a5da55fb0fff5da416074c0d28b2b55f'
    
      50    'b0fd5df54a2b281348ab03c2942b1e83278bee62c71e06d3d671724b49946593'
    
      51)
    
      52
    
      53build() {
    
      54    # folder with official injector release (commit hash in name)
    
      55    ref=`find "$srcdir" -maxdepth 1 -name "*Cpp-$rlstr" -type d`
    
      56    # move loopback src to srcdir
    
      57    tmp=$(mktemp -d)
    
      58    unzip -qd "$tmp" "$srcdir/loopback-$pkgesc-$pkgrel.zip"
    
      59    mv "$tmp"/*/* "$srcdir"
    
      60    rm -fr "$tmp"/* "$tmp"
    
      61    rm -rf "$srcdir/7zr.exe" && cp "$srcdir"/7z*-x64.exe "$srcdir/7zr.exe"
    
      62}
    
      63
    
      64compile() {
    
      65    # MinGW and VS header disagreement
    
      66    patches="$srcdir/include"
    
      67    mkdir -p "$patches"
    
      68    ln -sf /usr/x86_64-w64-mingw32/include/windows.h "$patches/Windows.h"
    
      69    ln -sf /usr/x86_64-w64-mingw32/include/sdkddkver.h "$patches/SDKDDKVer.h"
    
      70    ln -sf /usr/x86_64-w64-mingw32/include/shlobj.h "$patches/shlobj_core.h"
    
      71    ln -sf "$ref/BakkesModWPF/Resource.h" "$patches/resource.h"
    
      72
    
      73    # has to be below C++20 which removes ofstream functionality
    
      74    CXX_FLAGS=( "-std=c++17" "-static-libgcc" "-static-libstdc++" "-static" "-municode" "-mconsole" "-lpsapi" "-w" )
    
      75    CXX_LD=( "-I$patches" "-I/usr/x86_64-w64-mingw32/include" "-I$ref/BakkesModInjectorC++" )
    
      76
    
      77    # std::search is defined in std::algorithm
    
      78    includes="#include <algorithm>"
    
      79    sed "s%pragma once%pragma once\n$includes%" \
    
      80        "$ref/BakkesModInjectorC++/WindowsUtils.h" > "$patches/WindowsUtils.h"
    
      81    ln -sf "$patches/WindowsUtils.h" "$patches/windowsutils.h"
    
      82
    
      83    # unused, faster and easier to short circuit
    
      84    getter="WindowsUtils::GetMyDocumentsFolder()"
    
      85    docs='C:\\\\users\\\\steamuser\\\\Documents'
    
      86    sed -z "s%$getter[^{]*{%$getter { return \"$docs\";%" \
    
      87        "$ref/BakkesModInjectorC++/WindowsUtils.cpp" > "$patches/WindowsUtils.cpp"
    
      88
    
      89    wpath="s%std::filesystem::path path%const wchar_t* path%g"
    
      90    sed "s%path.wstring().c_str()%path%" \
    
      91        "$ref/BakkesModInjectorC++/DllInjector.cpp" > "$patches/DllInjector.cpp"
    
      92    sed -i "$wpath" "$patches/DllInjector.cpp"
    
      93    sed "$wpath" "$ref/BakkesModInjectorC++/DllInjector.h" > "$patches/DllInjector.h"
    
      94    x86_64-w64-mingw32-g++ "${CXX_FLAGS[@]}" "${CXX_LD[@]}" \
    
      95        "$patches/WindowsUtils.cpp" \
    
      96        "$ref/BakkesModWPF/BakkesModWPF.cpp" \
    
      97        "$patches/DllInjector.cpp" \
    
      98        "$srcdir/main.cpp" -o "$srcdir/inject.exe"
    
      99}
    
      100
    
      101# 3rd line of config_info contains the selected proton launcher's path
    
      102# https://github.com/ValveSoftware/Proton/blob/3a269ab9966409b968c8bc8f3e68bd0d2f42aadf/proton#L996-L1009
    
      103proton_paths=$(cat <<'EOF'
    
      104    steamapps="$HOME/.steam/steam/steamapps"
    
      105    compat="$steamapps/compatdata/252950"
    
      106    if [ ! -f "$steamapps/compatdata/252950/config_info" ]; then
    
      107        echo "could not find steam's proton config for Rocket League" >&2
    
      108        echo "if on SteamOS, re-run from the deck account" >&2
    
      109        exit 1
    
      110    fi
    
      111    proton=`sed -n 3p "$compat/config_info" | xargs -d '\n' dirname`
    
      112    # Wine 10+ unified wine64 into wine; fall back when no legacy symlink exists
    
      113    wine_bin="$proton/bin/wine64"
    
      114    if [ ! -x "$wine_bin" ]; then wine_bin="$proton/bin/wine"; fi
    
      115    if [ ! -x "$wine_bin" ]; then
    
      116        echo "could not find proton wine executable" >&2
    
      117        exit 1
    
      118    fi
    
      119    bm_pfx="$compat/pfx/drive_c/users/steamuser/AppData/Roaming/bakkesmod"
    
      120EOF
    
      121)
    
      122
    
      123remove_between() {
    
      124    echo -e "$(head -n "$(( $1 - 1 ))" "$3")\n$(tail -n +"$(( $2 + 1 ))" "$3")"
    
      125}
    
      126
    
      127insert_lines_before() { # 1 indexed line numbers like grep
    
      128    echo -e "$(head -n "$(( $1 - 1 ))" "$3")\n$( cat "$2" )\n$(tail -n +"$(( $1 ))" "$3")"
    
      129}
    
      130
    
      131build_version() {
    
      132    RL_version=`grep buildid "$1/appmanifest_252950.acf" | sed 's%[^0-9]%%g'`
    
      133    echo "$RL_version.$( cat "$srcdir/version.txt" ).$pkgver.$pkgrel"
    
      134}
    
      135
    
      136powershell_installer() {
    
      137    # under fakeroot, wineserver sees the spoofed UID via LD_PRELOAD but wine-preloader bypasses it; clear LD_PRELOAD so both see the real UID
    
      138    env -u LD_PRELOAD "$1" 'C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe' -noni -c 'echo "powershell64_installed"'
    
      139    env -u LD_PRELOAD "$1" 'C:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe' -noni -c 'echo "powershell32_installed"'
    
      140}
    
      141
    
      142powershell() {
    
      143    rm -f fsync
    
      144    python sandbox.py > fsync &
    
      145    sandbox_pid=$!
    
      146    trap "if kill -0 '$sandbox_pid' &> /dev/null; then kill '$sandbox_pid'; fi" EXIT
    
      147    echo -n "waiting for sandbox port "
    
      148    tail -f fsync | grep -m 1 "."
    
      149
    
      150    pth32="$WINEPREFIX/drive_c/windows/system32/WindowsPowerShell/v1.0/powershell.exe"
    
      151    pth64="$WINEPREFIX/drive_c/windows/syswow64/WindowsPowerShell/v1.0/powershell.exe"
    
      152
    
      153    cp -f powershell32_.exe "$pth32"; cp -f powershell64_.exe "$pth64";
    
      154    ( powershell_installer "$1" 2>pwsh.log ) || ( cat pwsh.log && false )
    
      155    cp -f powershell32.exe "$pth32"; cp -f powershell64.exe "$pth64";
    
      156    if kill -0 "$sandbox_pid" &> /dev/null; then kill "$sandbox_pid"; fi
    
      157    rm -f fsync
    
      158}
    
      159
    
      160package() {
    
      161    # used in this function and for running resulting exe files
    
      162    eval "$proton_paths"
    
      163    echo "build version string: $(build_version "$steamapps")"
    
      164
    
      165    echo "$proton_paths" > "$srcdir/runner.sh"
    
      166    # supposedly this might need to be ESYNC in some cases but this works by default
    
      167    cat <<"    EOF" >> "$srcdir/runner.sh"
    
      168        dll=`[ "$PROMPTLESS" = 1 ] && echo "bakkesmod_promptless.dll" || echo "bakkesmod_official.dll"`
    
      169        ln -sf "$bm_pfx/bakkesmod/dll/$dll" "$bm_pfx/bakkesmod/dll/bakkesmod.dll"
    
      170        env -u LD_PRELOAD WINEFSYNC=1 WINEPREFIX="$compat/pfx/" "$wine_bin" "$@"
    
      171    EOF
    
      172    chmod a+x "$srcdir/runner.sh"
    
      173    mkdir -p "$bm_pfx"
    
      174
    
      175    dll_path="$bm_pfx/bakkesmod/dll"
    
      176    rm -f "$dll_path/bakkesmod.dll"
    
      177    unzip -quo "dll-$rlesc.zip" -d "$bm_pfx/bakkesmod"
    
      178    # by default, starts with bakkesmod.dll and outputs bakkesmod_promptless.dll
    
      179    echo -n "shunted winuser calls for DLL patch: "
    
      180    python "$srcdir/dll_patch.py" "$dll_path"
    
      181    mv "$dll_path/bakkesmod.dll" "$dll_path/bakkesmod_official.dll"
    
      182    ln -sf "$dll_path/bakkesmod_official.dll" "$dll_path/bakkesmod.dll"
    
      183
    
      184    cp -f "$srcdir/inject.exe" "$bm_pfx"
    
      185    cp -f "$srcdir/runner.sh" "$srcdir/dll_patch.py" "$bm_pfx"
    
      186
    
      187    echo "direct injection command:" "'$bm_pfx/runner.sh' '$bm_pfx/inject.exe'"
    
      188
    
      189    cp -f "$srcdir/settings_252950_bakkes.py" "$proton/.."
    
      190    loader="$srcdir/bakkesmod-steam-user-settings.py"
    
      191    conf="$proton/../user_settings.py"
    
      192    sig=`sha256sum "$loader" | sed "s% *[^ ]*$%%"`
    
      193    touch "$conf"
    
      194    settings_version() {
    
      195        grep "^### \+$1 \+[0-9a-fA-F]\{64\}\( \|$\)" "$loader" | \
    
      196            sed 's%^\([^ ]\+ \+\)\{2\}\([^ ]\+\).*%\2%' | \
    
      197            xargs -I % grep -n '^### \+%' "$conf" || true
    
      198    }
    
      199    if [ ! -z "$( settings_version overlaps )" ]; then
    
      200        echo "found overlapping user_settings.py setup, aborting" >&2
    
      201        exit 1
    
      202    fi
    
      203    delimited="$srcdir/user_settings.py"
    
      204    echo "### $sig $( basename "$loader" )" > "$delimited"
    
      205    cat "$srcdir/bakkesmod-steam-user-settings.py" >> "$delimited"
    
      206    echo "### $sig EOF" >> "$delimited"
    
      207    updates=`settings_version replaces`
    
      208    if [ ! -z "${updates}" ]; then
    
      209        for (( pair=`echo "$updates" | wc -l`; pair>0; pair-=2 )); do
    
      210            start=`head -n "$(( pair - 1 ))" - <<< "$updates" | tail -1`
    
      211            end=`head -n "$(( pair ))" - <<< "$updates" | tail -1`
    
      212            if ! grep "EOF$" - <<< "$end" > /dev/null || grep "EOF$" - <<< "$start" > /dev/null; then
    
      213                echo "mismatched checksum delimitors" >&2
    
      214                exit 1
    
      215            fi
    
      216            start=`echo "$start" | cut -f1 -d:`
    
      217            end=`echo "$end" | cut -f1 -d:`
    
      218            remove_between "$start" "$end" "$conf" > "$conf"
    
      219        done
    
      220        ins=`echo "$updates" | head -1 | cut -f1 -d:`
    
      221        insert_lines_before "$ins" "$delimited" "$conf" > "$conf"
    
      222    elif ! grep "### \+$sig" "$conf" > /dev/null; then
    
      223        cp "$delimited" "$conf"
    
      224    fi
    
      225    if [ -f "$compat/pfx/drive_c/Program Files/PowerShell/7/pwsh.exe" ]; then
    
      226        echo "skipping powershell installation in favor of existing pwsh.exe"
    
      227    else
    
      228        ( cd "$srcdir" && WINEPREFIX="$compat/pfx/" powershell "$wine_bin" )
    
      229    fi
    
      230    echo "to finish installing, update your launch options by prepending \"BAKKES=1\" or by setting them to \"BAKKES=1 %command%\" if none have been set yet"
    
      231    echo "to inject the bakkesmod DLL without the message box about version verification, also prepend \"PROMPTLESS=1\""
    
      232    echo "the launch option is tied to the proton installation, so you will need to reinstall if you switch versions"
    
      233}
    
      234
    
      235pre_remove() {
    
      236    if ! ( eval "$proton_paths" ); then return 0; fi
    
      237    eval "$proton_paths"
    
      238    rm -f "$proton/../settings_252950_bakkes.py"
    
      239    if ! ls "$proton/.." | grep "^settings_[0-9]\+\(_\|.py$\)" > /dev/null; then
    
      240        loader="$srcdir/bakkesmod-steam-user-settings.py"
    
      241        conf="$proton/../user_settings.py"
    
      242        sig=`sha256sum "$loader" | sed "s% *[^ ]*$%%"`
    
      243        echo "$loader $conf $sig"
    
      244        if start=`grep -n "^### $sig $( basename "$loader" )$" "$conf"`; then
    
      245            start=`echo "$start" | cut -d: -f1`
    
      246            end=`grep -n "^### $sig EOF$" "$conf" | cut -d: -f1`
    
      247            # only remove one
    
      248            start=`echo "$start" | head -1`
    
      249            end=`echo "$end" | awk "\$0 > $start" | head -1`
    
      250            remove_between "$start" "$end" "$conf" > "$conf"
    
      251        fi
    
      252        if [[ -z `cat "$conf" | tr -d "\n"` ]]; then rm "$conf"; fi
    
      253    fi
    
      254    rm -fr "$bm_pfx"
    
      255}
    
      256
    
      257# unrelated: I recommend the -NoKeyboardUI option for desktop big picture mode
    
      258

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2