bakkesmod-steam

LOW
maintainer kentslaney 3 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package builds from official and well-known sources (GitHub, Microsoft, 7-zip.org), with only one unverifiable asset (loopback zip with SKIP'd checksum) from a maintainer's personal repo; no remote code execution, obfuscation, or malicious payloads are present, and the eval usage is limited to safe variable expansion in a controlled context.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official and well-known sources (GitHub, Microsoft, 7-zip.org), with only one unverifiable asset (loopback zip with SKIP'd checksum) from a maintainer's personal repo; no remote code execution, obfuscation, or malicious payloads are present, and the eval usage is limited to safe variable expansion in a controlled context.

  • PKGBUILD:162 eval "$proton_paths"
  • PKGBUILD:236 if ! ( eval "$proton_paths" ); then return 0; fi
  • PKGBUILD:237 eval "$proton_paths"
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:35 "https://www.7-zip.org/a/7z2501-x64.exe"

PKGBUILD

4 offending line(s) highlighted
1# Maintainer: Kent Slaney <kent@slaney.org>
2pkgname=bakkesmod-steam
3rlver=( 2 0 71 )
4pkgver="${rlver[0]}.${rlver[2]}"
5pkgrel=1
6pkgdesc="A mod aimed at making you better at Rocket League!"
7arch=('x86_64')
8url="https://bakkesmod.com/"
9license=('GPL')
10groups=()
11depends=()
12makedepends=('python')
13optdepends=()
14
15# versionless URLs and official repo backups
16# "https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/latest/download/BakkesModSetup.exe"
17# "https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/latest/download/BakkesModInjectorWin7.zip"
18# "https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/latest/download/BakkesMod.zip"
19# "https://api.github.com/repos/bakkesmodorg/BakkesModInjectorCpp/zipball/master"
20
21rlstr=$(IFS=. ; echo "${rlver[*]}")
22rlesc=$(IFS=- ; echo "${rlver[*]}")
23pkgesc=`echo "$pkgver" | sed 's%\.%-%g'`
24
25source=(
26 "dll-$rlesc.zip::https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/download/$rlstr/bakkesmod.zip"
27 "src-$rlesc.zip::https://github.com/bakkesmodorg/BakkesModInjectorCpp/archive/refs/tags/$rlstr.zip"
28 "loopback-$pkgesc-$pkgrel.zip::https://github.com/kentslaney/bakkesmod-arch/archive/refs/tags/$pkgver-$pkgrel-steam.zip"
29 "https://github.com/kentslaney/bakkesmod-arch/releases/download/c369f24-1/inject.exe"
30
31 "https://github.com/kentslaney/bakkesmod-arch/releases/download/05ea332-1/powershell32.exe"
32 "https://github.com/kentslaney/bakkesmod-arch/releases/download/05ea332-1/powershell64.exe"
33 "https://github.com/PowerShell/PowerShell/releases/download/v7.4.1/PowerShell-7.4.1-win-x64.msi"
34 "https://github.com/Maximus5/ConEmu/releases/download/v23.07.24/ConEmuPack.230724.7z"
35 "https://www.7-zip.org/a/7z2501-x64.exe"
36 "https://raw.githubusercontent.com/PietJankbal/powershell-wrapper-for-wine/master/profile.ps1"
37)
38
39sha256sums=(
40 'db8b62a026faafb08b5838c712898bc2ab81817e8b1bfa416091440b2ff958d0'
41 'e49929c27a91610262e4d9ea3bb39e481effe983d4671ed06d349f523c1a6180'
42 'SKIP'
43 '0e038a4f0a2799f6aaa34f6560f5d1d41fba0cf26f8814571cebc94f5bb67a6e'
44
45 '196886b557e632547d32354f20834e88ba3726df29a486c85d6409900064f364'
46 'e8dae4079a66d5a1564c577bd27caf8c890a1044d9c56948581591e196e4ac8c'
47 '66c7c35ed9a46bd27e3d915dcf9a05e38b3f5ebb039883b92aa62ffea20fb187'
48 '2a9b98ebecaede62665ef427b05b3a5ccdac7bd3202414fc0f4c10825b4f4ea2'
49 '78afa2a1c773caf3cf7edf62f857d2a8a5da55fb0fff5da416074c0d28b2b55f'
50 'b0fd5df54a2b281348ab03c2942b1e83278bee62c71e06d3d671724b49946593'
51)
52
53build() {
54 # folder with official injector release (commit hash in name)
55 ref=`find "$srcdir" -maxdepth 1 -name "*Cpp-$rlstr" -type d`
56 # move loopback src to srcdir
57 tmp=$(mktemp -d)
58 unzip -qd "$tmp" "$srcdir/loopback-$pkgesc-$pkgrel.zip"
59 mv "$tmp"/*/* "$srcdir"
60 rm -fr "$tmp"/* "$tmp"
61 rm -rf "$srcdir/7zr.exe" && cp "$srcdir"/7z*-x64.exe "$srcdir/7zr.exe"
62}
63
64compile() {
65 # MinGW and VS header disagreement
66 patches="$srcdir/include"
67 mkdir -p "$patches"
68 ln -sf /usr/x86_64-w64-mingw32/include/windows.h "$patches/Windows.h"
69 ln -sf /usr/x86_64-w64-mingw32/include/sdkddkver.h "$patches/SDKDDKVer.h"
70 ln -sf /usr/x86_64-w64-mingw32/include/shlobj.h "$patches/shlobj_core.h"
71 ln -sf "$ref/BakkesModWPF/Resource.h" "$patches/resource.h"
72
73 # has to be below C++20 which removes ofstream functionality
74 CXX_FLAGS=( "-std=c++17" "-static-libgcc" "-static-libstdc++" "-static" "-municode" "-mconsole" "-lpsapi" "-w" )
75 CXX_LD=( "-I$patches" "-I/usr/x86_64-w64-mingw32/include" "-I$ref/BakkesModInjectorC++" )
76
77 # std::search is defined in std::algorithm
78 includes="#include <algorithm>"
79 sed "s%pragma once%pragma once\n$includes%" \
80 "$ref/BakkesModInjectorC++/WindowsUtils.h" > "$patches/WindowsUtils.h"
81 ln -sf "$patches/WindowsUtils.h" "$patches/windowsutils.h"
82
83 # unused, faster and easier to short circuit
84 getter="WindowsUtils::GetMyDocumentsFolder()"
85 docs='C:\\\\users\\\\steamuser\\\\Documents'
86 sed -z "s%$getter[^{]*{%$getter { return \"$docs\";%" \
87 "$ref/BakkesModInjectorC++/WindowsUtils.cpp" > "$patches/WindowsUtils.cpp"
88
89 wpath="s%std::filesystem::path path%const wchar_t* path%g"
90 sed "s%path.wstring().c_str()%path%" \
91 "$ref/BakkesModInjectorC++/DllInjector.cpp" > "$patches/DllInjector.cpp"
92 sed -i "$wpath" "$patches/DllInjector.cpp"
93 sed "$wpath" "$ref/BakkesModInjectorC++/DllInjector.h" > "$patches/DllInjector.h"
94 x86_64-w64-mingw32-g++ "${CXX_FLAGS[@]}" "${CXX_LD[@]}" \
95 "$patches/WindowsUtils.cpp" \
96 "$ref/BakkesModWPF/BakkesModWPF.cpp" \
97 "$patches/DllInjector.cpp" \
98 "$srcdir/main.cpp" -o "$srcdir/inject.exe"
99}
100
101# 3rd line of config_info contains the selected proton launcher's path
102# https://github.com/ValveSoftware/Proton/blob/3a269ab9966409b968c8bc8f3e68bd0d2f42aadf/proton#L996-L1009
103proton_paths=$(cat <<'EOF'
104 steamapps="$HOME/.steam/steam/steamapps"
105 compat="$steamapps/compatdata/252950"
106 if [ ! -f "$steamapps/compatdata/252950/config_info" ]; then
107 echo "could not find steam's proton config for Rocket League" >&2
108 echo "if on SteamOS, re-run from the deck account" >&2
109 exit 1
110 fi
111 proton=`sed -n 3p "$compat/config_info" | xargs -d '\n' dirname`
112 # Wine 10+ unified wine64 into wine; fall back when no legacy symlink exists
113 wine_bin="$proton/bin/wine64"
114 if [ ! -x "$wine_bin" ]; then wine_bin="$proton/bin/wine"; fi
115 if [ ! -x "$wine_bin" ]; then
116 echo "could not find proton wine executable" >&2
117 exit 1
118 fi
119 bm_pfx="$compat/pfx/drive_c/users/steamuser/AppData/Roaming/bakkesmod"
120EOF
121)
122
123remove_between() {
124 echo -e "$(head -n "$(( $1 - 1 ))" "$3")\n$(tail -n +"$(( $2 + 1 ))" "$3")"
125}
126
127insert_lines_before() { # 1 indexed line numbers like grep
128 echo -e "$(head -n "$(( $1 - 1 ))" "$3")\n$( cat "$2" )\n$(tail -n +"$(( $1 ))" "$3")"
129}
130
131build_version() {
132 RL_version=`grep buildid "$1/appmanifest_252950.acf" | sed 's%[^0-9]%%g'`
133 echo "$RL_version.$( cat "$srcdir/version.txt" ).$pkgver.$pkgrel"
134}
135
136powershell_installer() {
137 # under fakeroot, wineserver sees the spoofed UID via LD_PRELOAD but wine-preloader bypasses it; clear LD_PRELOAD so both see the real UID
138 env -u LD_PRELOAD "$1" 'C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe' -noni -c 'echo "powershell64_installed"'
139 env -u LD_PRELOAD "$1" 'C:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe' -noni -c 'echo "powershell32_installed"'
140}
141
142powershell() {
143 rm -f fsync
144 python sandbox.py > fsync &
145 sandbox_pid=$!
146 trap "if kill -0 '$sandbox_pid' &> /dev/null; then kill '$sandbox_pid'; fi" EXIT
147 echo -n "waiting for sandbox port "
148 tail -f fsync | grep -m 1 "."
149
150 pth32="$WINEPREFIX/drive_c/windows/system32/WindowsPowerShell/v1.0/powershell.exe"
151 pth64="$WINEPREFIX/drive_c/windows/syswow64/WindowsPowerShell/v1.0/powershell.exe"
152
153 cp -f powershell32_.exe "$pth32"; cp -f powershell64_.exe "$pth64";
154 ( powershell_installer "$1" 2>pwsh.log ) || ( cat pwsh.log && false )
155 cp -f powershell32.exe "$pth32"; cp -f powershell64.exe "$pth64";
156 if kill -0 "$sandbox_pid" &> /dev/null; then kill "$sandbox_pid"; fi
157 rm -f fsync
158}
159
160package() {
161 # used in this function and for running resulting exe files
162 eval "$proton_paths"
163 echo "build version string: $(build_version "$steamapps")"
164
165 echo "$proton_paths" > "$srcdir/runner.sh"
166 # supposedly this might need to be ESYNC in some cases but this works by default
167 cat <<" EOF" >> "$srcdir/runner.sh"
168 dll=`[ "$PROMPTLESS" = 1 ] && echo "bakkesmod_promptless.dll" || echo "bakkesmod_official.dll"`
169 ln -sf "$bm_pfx/bakkesmod/dll/$dll" "$bm_pfx/bakkesmod/dll/bakkesmod.dll"
170 env -u LD_PRELOAD WINEFSYNC=1 WINEPREFIX="$compat/pfx/" "$wine_bin" "$@"
171 EOF
172 chmod a+x "$srcdir/runner.sh"
173 mkdir -p "$bm_pfx"
174
175 dll_path="$bm_pfx/bakkesmod/dll"
176 rm -f "$dll_path/bakkesmod.dll"
177 unzip -quo "dll-$rlesc.zip" -d "$bm_pfx/bakkesmod"
178 # by default, starts with bakkesmod.dll and outputs bakkesmod_promptless.dll
179 echo -n "shunted winuser calls for DLL patch: "
180 python "$srcdir/dll_patch.py" "$dll_path"
181 mv "$dll_path/bakkesmod.dll" "$dll_path/bakkesmod_official.dll"
182 ln -sf "$dll_path/bakkesmod_official.dll" "$dll_path/bakkesmod.dll"
183
184 cp -f "$srcdir/inject.exe" "$bm_pfx"
185 cp -f "$srcdir/runner.sh" "$srcdir/dll_patch.py" "$bm_pfx"
186
187 echo "direct injection command:" "'$bm_pfx/runner.sh' '$bm_pfx/inject.exe'"
188
189 cp -f "$srcdir/settings_252950_bakkes.py" "$proton/.."
190 loader="$srcdir/bakkesmod-steam-user-settings.py"
191 conf="$proton/../user_settings.py"
192 sig=`sha256sum "$loader" | sed "s% *[^ ]*$%%"`
193 touch "$conf"
194 settings_version() {
195 grep "^### \+$1 \+[0-9a-fA-F]\{64\}\( \|$\)" "$loader" | \
196 sed 's%^\([^ ]\+ \+\)\{2\}\([^ ]\+\).*%\2%' | \
197 xargs -I % grep -n '^### \+%' "$conf" || true
198 }
199 if [ ! -z "$( settings_version overlaps )" ]; then
200 echo "found overlapping user_settings.py setup, aborting" >&2
201 exit 1
202 fi
203 delimited="$srcdir/user_settings.py"
204 echo "### $sig $( basename "$loader" )" > "$delimited"
205 cat "$srcdir/bakkesmod-steam-user-settings.py" >> "$delimited"
206 echo "### $sig EOF" >> "$delimited"
207 updates=`settings_version replaces`
208 if [ ! -z "${updates}" ]; then
209 for (( pair=`echo "$updates" | wc -l`; pair>0; pair-=2 )); do
210 start=`head -n "$(( pair - 1 ))" - <<< "$updates" | tail -1`
211 end=`head -n "$(( pair ))" - <<< "$updates" | tail -1`
212 if ! grep "EOF$" - <<< "$end" > /dev/null || grep "EOF$" - <<< "$start" > /dev/null; then
213 echo "mismatched checksum delimitors" >&2
214 exit 1
215 fi
216 start=`echo "$start" | cut -f1 -d:`
217 end=`echo "$end" | cut -f1 -d:`
218 remove_between "$start" "$end" "$conf" > "$conf"
219 done
220 ins=`echo "$updates" | head -1 | cut -f1 -d:`
221 insert_lines_before "$ins" "$delimited" "$conf" > "$conf"
222 elif ! grep "### \+$sig" "$conf" > /dev/null; then
223 cp "$delimited" "$conf"
224 fi
225 if [ -f "$compat/pfx/drive_c/Program Files/PowerShell/7/pwsh.exe" ]; then
226 echo "skipping powershell installation in favor of existing pwsh.exe"
227 else
228 ( cd "$srcdir" && WINEPREFIX="$compat/pfx/" powershell "$wine_bin" )
229 fi
230 echo "to finish installing, update your launch options by prepending \"BAKKES=1\" or by setting them to \"BAKKES=1 %command%\" if none have been set yet"
231 echo "to inject the bakkesmod DLL without the message box about version verification, also prepend \"PROMPTLESS=1\""
232 echo "the launch option is tied to the proton installation, so you will need to reinstall if you switch versions"
233}
234
235pre_remove() {
236 if ! ( eval "$proton_paths" ); then return 0; fi
237 eval "$proton_paths"
238 rm -f "$proton/../settings_252950_bakkes.py"
239 if ! ls "$proton/.." | grep "^settings_[0-9]\+\(_\|.py$\)" > /dev/null; then
240 loader="$srcdir/bakkesmod-steam-user-settings.py"
241 conf="$proton/../user_settings.py"
242 sig=`sha256sum "$loader" | sed "s% *[^ ]*$%%"`
243 echo "$loader $conf $sig"
244 if start=`grep -n "^### $sig $( basename "$loader" )$" "$conf"`; then
245 start=`echo "$start" | cut -d: -f1`
246 end=`grep -n "^### $sig EOF$" "$conf" | cut -d: -f1`
247 # only remove one
248 start=`echo "$start" | head -1`
249 end=`echo "$end" | awk "\$0 > $start" | head -1`
250 remove_between "$start" "$end" "$conf" > "$conf"
251 fi
252 if [[ -z `cat "$conf" | tr -d "\n"` ]]; then rm "$conf"; fi
253 fi
254 rm -fr "$bm_pfx"
255}
256
257# unrelated: I recommend the -NoKeyboardUI option for desktop big picture mode
258

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion