bsf-docs-git
LOW
maintainer orphaned
0 votes
base
bsf-git
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt data archives from a non-whitelisted host (data.banshee3d.com), but these are non-executable assets (images, docs, dependencies) used by the project; the main source is from GitHub, and the data files are verified via checksums, limiting supply-chain risk to data tampering only.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt data archives from a non-whitelisted host (data.banshee3d.com), but these are non-executable assets (images, docs, dependencies) used by the project; the main source is from GitHub, and the data files are verified via checksums, limiting supply-chain risk to data tampering only.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
'https://data.banshee3d.com/bsfCompiledData_Master_35.zip'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Guillaume Meunier <guillaume.meunier@centraliens.net>
2
pkgname=(bsf-git bsf-docs-git)
3
pkgbase=bsf-git
4
_pkgname=bsf
5
pkgver=r5221.41e122d24
6
pkgrel=1
7
epoch=
8
pkgdesc="A C++ library that aims to provide a unified foundation for the development of real-time graphical applications, whether games, engines or tools"
9
arch=(x86_64)
10
url="https://www.bsframework.io/"
11
license=('MIT')
12
groups=()
13
makedepends=(git cmake doxygen ninja)
14
checkdepends=()
15
optdepends=()
16
conflicts=()
17
backup=()
18
options=()
19
install=
20
changelog=
21
22
source=('git+https://github.com/GameFoundry/bsf.git'
23
'install-dir.patch'
24
'https://data.banshee3d.com/bsfCompiledData_Master_35.zip'
25
'https://data.banshee3d.com/bsfData_Master_7.zip'
26
'https://data.banshee3d.com/bsfDocImagesData_Master_2.zip'
27
'https://data.banshee3d.com/bsfDependencies_Linux_Master_11.zip'
28
'https://data.banshee3d.com/bsfDep_XShaderCompiler_Linux_Master_6.zip'
29
'https://data.banshee3d.com/SemanticUI.zip')
30
noextract=()
31
validpgpkeys=()
32
33
prepare() {
34
cp -r Data bsf/
35
cp -r Dependencies bsf/
36
cp -r Documentation bsf/
37
cp -r Raw bsf/Data
38
cp -r Documentation bsf/
39
cp -r XShaderCompiler/ bsf/Dependencies/
40
41
rm -rf "$_pkgname"/Dependencies/OpenAL
42
rm -rf "$_pkgname"/Dependencies/libFLAC
43
rm -rf "$_pkgname"/Dependencies/libICU
44
rm -rf "$_pkgname"/Dependencies/libogg
45
rm -rf "$_pkgname"/Dependencies/libvorbis
46
rm -rf "$_pkgname"/Dependencies/freetype
47
rm -rf "$_pkgname"/Dependencies/freeimg
48
49
patch -d bsf -p1 < install-dir.patch
50
}
51
52
pkgver() {
53
cd "$_pkgname"
54
55
(
56
set -o pipefail
57
git describe --long 2>/dev/null | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' ||
58
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
59
)
60
}
61
62
build() {
63
mkdir -p "$_pkgname"/build
64
cd "$_pkgname"/build
65
66
cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr -DUSE_BUNDLED_LIBRARIES=OFF -G Ninja
67
ninja
68
69
cd ../Documentation/Doxygen
70
doxygen native.doxyconfig
71
doxygen csharp.doxyconfig
72
}
73
74
package_bsf-git() {
75
provides=(bsf)
76
conflicts=(bsf)
77
depends=(libutil-linux libx11 icu libxcursor libxrandr libxi libgl openal flac libvorbis snappy freeimage freetype2)
78
arch=(x86_64)
79
80
pushd "$_pkgname"/build
81
DESTDIR="$pkgdir"/ ninja install
82
popd > /dev/null
83
84
find "$pkgdir"/usr/lib -name "*.dbg" -delete
85
86
mkdir -p "$pkgdir"/usr/share/licenses/$pkgbase
87
install "$_pkgname"/LICENSE.md $pkgdir/usr/share/licenses/$pkgbase/
88
}
89
90
package_bsf-docs-git() {
91
arch=(any)
92
93
mkdir -p "$pkgdir"/usr/share/doc/$pkgbase
94
cp -r "$_pkgname"/Documentation/Generated/native "$pkgdir"/usr/share/doc/$pkgbase/
95
cp -r "$_pkgname"/Documentation/Generated/csharp "$pkgdir"/usr/share/doc/$pkgbase/
96
97
cp -r SemanticUI "$pkgdir"/usr/share/doc/$pkgbase/native/
98
cp -r SemanticUI "$pkgdir"/usr/share/doc/$pkgbase/csharp/
99
}
100
101
sha256sums=('SKIP'
102
'9291ac8fe6c125841179ae6d3af66d20c31105a0869e8a5d30982454240a62dc'
103
'848973eef189b16b00947655d2895d0195f4078159884d585653390ca781d125'
104
'212ec9fd67be4f58278de6d35ea8dc6f350009cbc741202b957a8b0337da84b3'
105
'e9d3793f87c4ff0a36f3574ecd070e4b6b25c567a063e3042d2dc5883636f011'
106
'2c8726abb0f6ec35d00bf7d30a75a3b74de1820672db177799898d8cbb359426'
107
'41ff32953fceeb1166ac1ec8ae3ab49d3a55acfa6de993d27862d80a9fbf701b'
108
'd827f244a0dc9a41e012ebe165c3af2bce1da583e107635acd51012cec303121')
109
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |