bsg-diaspora-sa-vr

LOW

maintainer winicius 0 votes scanned 2026-11-03 10:06:15.103269

View on AUR

Why flagged

The package builds from the maintainer's own GitHub fork of fs2open and downloads official Diaspora R1 game data from diaspora.fs2downloads.com (the project's own distribution host); the non-standard host flagged is simply the maintainer's GitHub releases page for mod assets, not an anonymous file-sharing service, and all sources have explicit SHA256 checksums (only the git source is SKIP'd, which is normal). No obfuscated payloads, no exfiltration, no piped-to-shell downloads; the main concern is that the fork and mod assets are unverifiable against an independent upstream, but this is a legitimate game packaging pattern.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package builds from the maintainer's own GitHub fork of fs2open and downloads official Diaspora R1 game data from diaspora.fs2downloads.com (the project's own distribution host); the non-standard host flagged is simply the maintainer's GitHub releases page for mod assets, not an anonymous file-sharing service, and all sources have explicit SHA256 checksums (only the git source is SKIP'd, which is normal). No obfuscated payloads, no exfiltration, no piped-to-shell downloads; the main concern is that the fork and mod assets are unverifiable against an independent upstream, but this is a legitimate game packaging pattern.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 'http://diaspora.fs2downloads.com/Diaspora_R1_Linux.tar.lzma'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Winicius Cota <winicius.cota@gmail.com>
    
      2pkgname=bsg-diaspora-sa-vr
    
      3pkgver=1.0
    
      4pkgrel=1
    
      5_engine=e7e0727768bc98d47091ef2d0153dc3a57bed9b6
    
      6pkgdesc="Battlestar Galactica: Diaspora on a modern FreeSpace Open engine with VR (OpenXR/Vulkan), 14 extra missions, HD textures"
    
      7arch=('x86_64')
    
      8url="https://github.com/winiciuscota/diaspora-vr-port"
    
      9license=('CCPL' 'custom:fs2_open')
    
      10depends=('sdl2' 'openal' 'ffmpeg' 'libpng' 'jansson' 'freetype2' 'lz4' 'vulkan-icd-loader' 'shaderc' 'curl' 'hicolor-icon-theme')
    
      11makedepends=('git' 'cmake' 'ninja' 'python' 'glslang' 'vulkan-headers' 'libx11' 'libxrandr' 'libxinerama' 'libxcursor'
    
      12             'libxi' 'wayland' 'mesa' 'speech-dispatcher')
    
      13optdepends=('wivrn-server: stream VR to a Quest headset'
    
      14            'monado: OpenXR runtime for PC VR headsets'
    
      15            'steam: SteamVR OpenXR runtime')
    
      16_rel="https://github.com/winiciuscota/diaspora-vr-port/releases/download/v$pkgver"
    
      17source=("fs2open::git+https://github.com/winiciuscota/fs2open-diaspora-vr.git#commit=$_engine"
    
      18        "$_rel/diaspora-vr-mod-$pkgver.tar.gz"
    
      19        "$_rel/diaspora-vr-hd-textures-2x.zip"
    
      20        "$_rel/diaspora-vr-hd-cockpits-4x.zip"
    
      21        "$_rel/diaspora-vr-voices.zip"
    
      22        'http://diaspora.fs2downloads.com/Diaspora_R1_Linux.tar.lzma'
    
      23        'http://diaspora.fs2downloads.com/Diaspora_R1_Patch_1.1.tar.lzma'
    
      24        'http://diaspora.fs2downloads.com/Diaspora_R1_Patch_1.1.1.tar.lzma'
    
      25        'bsg-diaspora-sa-vr'
    
      26        'bsg-diaspora-sa-vr.desktop'
    
      27        'bsg-diaspora-sa-vr-vr.desktop')
    
      28sha256sums=('SKIP' 'd3d75cfe3a709075e351bb1e25eb1e04f80fe60e271d3c1565ab147d599a443a' 'c527c6b77046e663292e7ca2a008c8582bba5bb1279e5a65f8d493948fdce88c' 'd2f627c64efc64e8c12707812c8899fcaa21175d709c72ef30af46fb4f3f5105' '35d4690fba66019a2a8ccf0d0ff5cc35516f1837e66cc736e5c312e05341ea98' '598910f2382ab2c8b10aa02cc6fb00c55ed4cd5a1a64d580deb1a0d4e521cf17' '759491c5614a4b814ff9199aaa59bd43d034c0ddf25070e94b2019571e127ba4' '1569d6990b110cbee240b76727b1a015188cd34c53ecdfea7e84d9de151ce7b4' 'e90dedf4f22c9df4de4f506ee9f550a1d7ed19074e2c1cda3833dffe1ff417a6' '2c62c57e43cb72431453ea59627885f600e502833db345d36226d00704ffe0a9' 'e66c78af5ef95960fd8454efbb08837859f65652b86484cf3a9924d69689be07')
    
      29# ~5 GiB of game data: compressing it again takes long and saves little
    
      30PKGEXT='.pkg.tar'
    
      31
    
      32prepare() {
    
      33  cd fs2open
    
      34  git submodule update --init --recursive --depth 1
    
      35
    
      36  # Diaspora R1 + the 1.1 and 1.1.1 patches
    
      37  local game="$srcdir/Diaspora_R1_Linux/Diaspora"
    
      38  tar -xf "$srcdir/Patch_Files.1.1.tar" -C "$game"
    
      39  tar -xf "$srcdir/Patch_Files.1.1.1.tar" -C "$game"
    
      40}
    
      41
    
      42build() {
    
      43  cmake -S fs2open -B build -G Ninja \
    
      44    -DCMAKE_BUILD_TYPE=Release \
    
      45    -DCMAKE_INSTALL_PREFIX=/opt/$pkgname/engine \
    
      46    -DFSO_BUILD_TESTS=OFF -DFSO_BUILD_FRED2=OFF -DFSO_BUILD_QTFRED=OFF -DFSO_BUILD_INCLUDE_TOOLS=OFF \
    
      47    -DFSO_RELEASE_LOGGING=ON -DFSO_BUILD_WITH_OPENXR=ON -DFSO_BUILD_WITH_VULKAN=ON -DFSO_BUILD_WITH_DISCORD=OFF \
    
      48    -Wno-dev
    
      49  # each compiler job needs ~1.5 GiB: limit the parallel jobs by RAM so smaller machines don't run out of memory
    
      50  local mem_gb jobs
    
      51  mem_gb=$(awk '/MemTotal/ {print int($2 / 1048576)}' /proc/meminfo)
    
      52  jobs=$(( mem_gb * 2 / 3 )); [ "$jobs" -lt 1 ] && jobs=1; [ "$jobs" -gt "$(nproc)" ] && jobs=$(nproc)
    
      53  cmake --build build -j "$jobs"
    
      54}
    
      55
    
      56package() {
    
      57  local root="$pkgdir/opt/$pkgname"
    
      58  DESTDIR="$pkgdir" cmake --install build
    
      59  local bin; bin=$(find "$root/engine" -maxdepth 2 -type f -name 'fs2_open_*' | head -1)
    
      60  [ -n "$bin" ] || { echo "no fs2_open binary installed"; return 1; }
    
      61  mv "$bin" "$root/engine/fs2_open"
    
      62
    
      63  # game data (Diaspora R1 + patches), then the mod with the extra missions, HD textures and voices
    
      64  local game="$srcdir/Diaspora_R1_Linux/Diaspora"
    
      65  install -d "$root/game"
    
      66  cp -a "$game"/*.vp "$root/game/"
    
      67  [ -d "$game/data" ] && cp -a "$game/data" "$root/game/"
    
      68  # the mod tarball and the texture / voice zips all unpack into $srcdir/diaspora_fixes
    
      69  cp -a "$srcdir/diaspora_fixes" "$root/game/"
    
      70  rm -f "$root/game/diaspora_fixes/icon-256.png"
    
      71  # Diaspora's old command line file lists flags the modern engine no longer knows; the launcher passes what is needed
    
      72  rm -f "$root/game/data/cmdline_fso.cfg"
    
      73  find "$root/game" -type d -exec chmod 755 {} + ; find "$root/game" -type f -exec chmod 644 {} +
    
      74
    
      75  install -Dm755 "$srcdir/bsg-diaspora-sa-vr" "$pkgdir/usr/bin/bsg-diaspora-sa-vr"
    
      76  install -Dm644 "$srcdir/bsg-diaspora-sa-vr.desktop" "$pkgdir/usr/share/applications/bsg-diaspora-sa-vr.desktop"
    
      77  install -Dm644 "$srcdir/bsg-diaspora-sa-vr-vr.desktop" "$pkgdir/usr/share/applications/bsg-diaspora-sa-vr-vr.desktop"
    
      78  install -Dm644 "$srcdir/diaspora_fixes/icon-256.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/bsg-diaspora-sa-vr.png"
    
      79  install -Dm644 fs2open/Copying.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 10:06:15	Low	3
2026-11-03 10:04:25	Medium	2