bsg-diaspora-sa

maintainer winicius · 9 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source files from a project-specific domain (diaspora.fs2downloads.com) which is plausibly the official release host for this mod; the files are large game assets and patches, not executable code, and the build process compiles only the project's own fs2_open engine code; the risk from the non-whitelisted host is low as the worst case of a swapped source would be tampered game data, not remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from a project-specific domain (diaspora.fs2downloads.com) which is plausibly the official release host for this mod; the files are large game assets and patches, not executable code, and the build process compiles only the project's own fs2_open engine code; the risk from the non-whitelisted host is low as the worst case of a swapped source would be tampered game data, not remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source=('http://diaspora.fs2downloads.com/Diaspora_R1_Linux.tar.lzma'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Winicius Cota <winicius.cota@gmail.com>
    
      2# Contributor: Tom Parys <tom.parys@gmail.com>
    
      3# Contributor: ZekeSulastin <zekesulastin@gmail.com>
    
      4# Contributor: David H. Bronke <whitelynx@gmail.com>
    
      5# Contributor: Mr_Robotic_Evil <mr.robotic.evil@googlemail.com>
    
      6# Contributor: Lone_Wolf <lonewolf@xs4all.nl>
    
      7# Contributor: Marius Nestor <marius@softpedia.com>
    
      8
    
      9# Warning: This package is BIG; you'll need at least 9 GiB free in
    
      10#   order to build version 1.1.1 (2 GiB for the downloads alone, about 3 GiB for the
    
      11#   unpacked game data and source, and 3.3 GiB for the finished package if
    
      12#   uncompressed)  'mv' is used over 'cp' in the package phase to save a bit
    
      13#   of space, but make sure there is enough room for everything.
    
      14
    
      15# This PKGBUILD is based on fs2_open and fs2_open-data from AUR; the
    
      16# maintainers and contributors of those packages have been listed as
    
      17# contributors above.
    
      18
    
      19pkgname=bsg-diaspora-sa
    
      20pkgver=1.1.1
    
      21pkgrel=1
    
      22pkgdesc="Diaspora: Shattered Armistice is a single and multiplayer space fighter combat game set in the reimagined Battlestar Galactica universe."
    
      23url="http://diaspora.hard-light.net/"
    
      24arch=('i686' 'x86_64')
    
      25license=('CCPL' 'custom:fs2_open')
    
      26depends=('libjpeg' 'libpng' 'libtheora' 'libvorbis' 'lua51' 'mesa' 'openal' 'sdl' 'jansson' 'wxlauncher')
    
      27# optdepends=('wxlauncher: a launcher for fs2_open-based games')
    
      28install=bsg-diaspora-sa.install
    
      29source=('http://diaspora.fs2downloads.com/Diaspora_R1_Linux.tar.lzma'
    
      30        'http://diaspora.fs2downloads.com/Diaspora_R1_Patch_1.1.tar.lzma'
    
      31        'http://diaspora.fs2downloads.com/Diaspora_R1_Patch_1.1.1.tar.lzma'
    
      32        'bsg-diaspora-sa'
    
      33        'bsg-diaspora-sa.conf'
    
      34        'bsg-diaspora-sa.desktop'
    
      35        'bsg-diaspora-sa.png')
    
      36
    
      37md5sums=('22b55ae9bc9366ccbeb1642cd50dc3f8'
    
      38      	 '423182f96a97e657da0e27b708b48abf'
    
      39      	 'd73890efd3e86b336d96b339e0a59a46'
    
      40         '2c8befd5c503d7e494fb8fc87a7c1464'
    
      41         'ef9920040cf4c37419c89ca007df3022'
    
      42         '50ae3eafa6f50add7f592e32b0c600e8'
    
      43         '3ff26bc4a7d14af7b3b8fcb32ff0f367')
    
      44# This package is about 3 GiB uncompressed and takes a while to recompress for
    
      45# not too much space savings; the following PKGEXT disables compression of the
    
      46# package.  Add .xz or similar to the end of PKGEXT to compress the package.
    
      47PKGEXT=".pkg.tar"
    
      48
    
      49prepare() {
    
      50    local SOURCE="$srcdir/Diaspora_R1_Linux/Diaspora/"
    
      51
    
      52    msg "Removing unneeded files..."
    
      53    rm -r $SOURCE/resources $SOURCE/wxlauncher
    
      54
    
      55    # 1.1 patch
    
      56    msg "Applying patch 1.1"
    
      57    #tar -xf $srcdir/Diaspora_R1_Patch_$pkgver/Patch_Files.$pkgver.tar -C $SOURCE
    
      58    tar -xf $srcdir/Patch_Files.1.1.tar -C $SOURCE
    
      59
    
      60    # 1.1.1 patch
    
      61    msg "Applying patch 1.1.1"
    
      62    tar -xf $srcdir/Patch_Files.1.1.1.tar -C $SOURCE
    
      63}
    
      64
    
      65build() {
    
      66
    
      67  local SOURCE="$srcdir/Diaspora_R1_Linux/Diaspora/"
    
      68
    
      69  # (1) Build the game engine (fs2_open)
    
      70  msg "Building..."
    
      71  cd $SOURCE/fs2_open
    
      72	# LDFLAGS="-l:liblua.so.5.1 $LDFLAGS" CXXFLAGS="-I/usr/include/lua5.1 $CXXFLAGS" ./autogen.sh --enable-speech
    
      73
    
      74  env LUA_CFLAGS="$(pkg-config --cflags lua51)" \
    
      75      LUA_LIBS="$(pkg-config --libs lua51)"     \
    
      76      ./autogen.sh
    
      77
    
      78  make
    
      79
    
      80  # (2) Set up the Diaspora launcher profile (for wxlauncher)
    
      81  cd $SOURCE
    
      82  sed "s@^folder=.*\$@folder=/opt/$pkgname@;s@pro00099.template.ini@@" pro00099.template.ini > pro00099.ini
    
      83
    
      84
    
      85  # Grab command-line options from pro00099.ini for our runner script.
    
      86  cd $srcdir
    
      87  FS2_OPTS="$(sed -n 's@^flags=\(.*\)$@\1@p' $SOURCE/pro00099.ini | tr -d '\r\n')"
    
      88  sed -i "s@\\(FS2OPTS=\\).*@\\1\"$FS2_OPTS\"@" $srcdir/bsg-diaspora-sa.conf
    
      89}
    
      90
    
      91package() {
    
      92  local SOURCE="$srcdir/Diaspora_R1_Linux/Diaspora/"
    
      93
    
      94  cd $SOURCE
    
      95
    
      96  #install -D -m644 -t "$pkgdir/opt/$pkgname/" *.vp *.ini *.png *.bmp data
    
      97  install -m644 -d "$pkgdir/opt/$pkgname/"
    
      98  mv *.vp *.png *.bmp mod.ini pro00099.ini data "$pkgdir/opt/$pkgname/"
    
      99
    
      100  #install -D -m644 -t "$pkgdir/usr/share/doc/$pkgname/" *.pdf *.txt *.rtf
    
      101  install -m644 -d "$pkgdir/usr/share/doc/$pkgname/"
    
      102  mv *.pdf *.txt *.rtf "$pkgdir/usr/share/doc/$pkgname/"
    
      103
    
      104  # Fix permissions (since 'mv' won't set them)
    
      105  chmod -R 644 "$pkgdir/opt/$pkgname/" "$pkgdir/usr/share/doc/$pkgname/"
    
      106  find "$pkgdir/opt/$pkgname/" "$pkgdir/usr/share/doc/$pkgname/" -type d -exec chmod 755 '{}' \;
    
      107
    
      108    install -D -m755 $srcdir/bsg-diaspora-sa "$pkgdir/usr/bin/bsg-diaspora-sa"
    
      109    install -D -m644 $srcdir/bsg-diaspora-sa.conf "$pkgdir/usr/share/$pkgname/bsg-diaspora-sa.conf"
    
      110    install -D -m644 $srcdir/bsg-diaspora-sa.png "${pkgdir}/usr/share/pixmaps/bsg-diaspora-sa.png"
    
      111    install -D -m644 $srcdir/bsg-diaspora-sa.desktop "$pkgdir/usr/share/applications/bsg-diaspora-sa.desktop"
    
      112    install -D -m644 fs2_open/COPYING "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      113    install -D -m755 fs2_open/code/fs2_open_3.7.1 "$pkgdir/opt/$pkgname/fs2_open_diaspora"
    
      114}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2