carnagecontest

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binaries (a Linux executable 'CarnageContest' and a Windows zip) from unrealsoftware.de, which is the official upstream host for Carnage Contest (the game's own distribution server), not a random personal host. The sha512sums are present and pin the downloaded files, which mitigates runtime tampering. However, the URL construction is dynamic: grabcid() makes a live curl request at build time to fetch a session/challenge ID, then embeds it in the source URLs. This means the actual download URL is not fully deterministic and the integrity check depends on the fetched CID matching what was used when the sha512sums were computed. If the CID mechanism causes a different file to be served, the checksum would catch it. The real concern is that prebuilt closed-source binaries are being installed and executed (the Linux binary is symlinked into /usr/bin and made executable), sourced from a third-party host with a non-standard dynamic URL scheme. This is a genuine medium-severity supply-chain concern: executed binary from a non-official-distro host, even if it is the upstream vendor's own site, with a dynamic URL that slightly complicates reproducibility. The sha512sums provide meaningful protection against substitution attacks, keeping this from being high severity.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:25 echo "$(curl -Ss "http://www.unrealsoftware.de/get.php?get=${file}&p=1" |

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 source=(cc_b${_ver}_linux.zip::"http://www.unrealsoftware.de/get.php?get=cc_b${_ver}_linux.zip&p=1&cid=${_cid}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt binaries (a Linux executable 'CarnageContest' and a Windows zip) from unrealsoftware.de, which is the official upstream host for Carnage Contest (the game's own distribution server), not a random personal host. The sha512sums are present and pin the downloaded files, which mitigates runtime tampering. However, the URL construction is dynamic: grabcid() makes a live curl request at build time to fetch a session/challenge ID, then embeds it in the source URLs. This means the actual download URL is not fully deterministic and the integrity check depends on the fetched CID matching what was used when the sha512sums were computed. If the CID mechanism causes a different file to be served, the checksum would catch it. The real concern is that prebuilt closed-source binaries are being installed and executed (the Linux binary is symlinked into /usr/bin and made executable), sourced from a third-party host with a non-standard dynamic URL scheme. This is a genuine medium-severity supply-chain concern: executed binary from a non-official-distro host, even if it is the upstream vendor's own site, with a dynamic URL that slightly complicates reproducibility. The sha512sums provide meaningful protection against substitution attacks, keeping this from being high severity.

PKGBUILD

2 offending line(s) highlighted

      1#! /bin/bash
    
      2# Contributor: josephgbr <rafael.f.f1@gmail.com>
    
      3# Contributor: darkraid1 <darkraid1@gmail.com>
    
      4# Contributor: jorge_barroso <jorge.barroso.11 at gmail dot com>
    
      5#
    
      6pkgname=carnagecontest
    
      7pkgver=0.1.0.1
    
      8_ver=0101
    
      9pkgrel=2
    
      10pkgdesc="A free 2D turn based multiplayer shooter with fully destructible terrain"
    
      11arch=('i686' 'x86_64')
    
      12url="http://carnagecontest.com/"
    
      13license=('custom')
    
      14
    
      15if [ "$CARCH" == "i686" ]; then
    
      16    depends=('freetype2' 'libtxc_dxtn' 'libxcursor' 'mesa' 'openal' 'lua')
    
      17elif [ "$CARCH" == "x86_64" ]; then
    
      18    depends=('lib32-freetype2' 'lib32-libtxc_dxtn' 'lib32-libxcursor' 'lib32-mesa' 'lib32-openal' 'lua')
    
      19fi
    
      20makedepends=('unzip' 'curl')
    
      21
    
      22#https://bbs.archlinux.org/viewtopic.php?id=141195
    
      23grabcid() {
    
      24  local file=cc_b${_ver}_linux.zip
    
      25  echo "$(curl -Ss "http://www.unrealsoftware.de/get.php?get=${file}&p=1" | 
    
      26            grep -o '"get.php[^"]\+"' | cut -d'"' -f2 | sed 's/&amp;/\&/g')"
    
      27}
    
      28_cid=$(grabcid) # this will hide the cmd line above from AUR interface
    
      29
    
      30source=(cc_b${_ver}_linux.zip::"http://www.unrealsoftware.de/get.php?get=cc_b${_ver}_linux.zip&p=1&cid=${_cid}"
    
      31        cc_b${_ver}_win.zip::"http://www.unrealsoftware.de/get.php?get=cc_b${_ver}_win.zip&p=1&cid=${_cid}"
    
      32        $pkgname.desktop)
    
      33install="$pkgname.install"
    
      34noextract=(cc_b${_ver}_linux.zip
    
      35           cc_b${_ver}_win.zip)
    
      36
    
      37sha512sums=('a6ce91c774f5fa6c8d509508b4aef097b78cea6644815fda9947233dd12ab42ec63acb62c19dc733123a2da90c4d7d043db9a61a739b11f63259ee9a4053a152'
    
      38            'dc7c184f77df074f10b3d27ad9087eaddb231d78cac6db3ab57f0a7257a6897763039868b78f285b98603670a1bdf3112fdbd1e06917b9321d1dd284ba9aeae2'
    
      39          'cb69c66b037c4cea9572dfbaff3f29b532875848f24d931b3b5aff6bd1b2dad01698c36ac4c940c65b853a03858e49062b53043185ccb0895f6309faa5fed1f4')
    
      40
    
      41package() {
    
      42    install -d -m 755 "$pkgdir"/usr/share/$pkgname
    
      43    unzip cc_b${_ver}_win.zip -d "$pkgdir"/usr/share/$pkgname
    
      44    unzip -o cc_b${_ver}_linux.zip -d "$pkgdir"/usr/share/$pkgname
    
      45    
    
      46    find "$pkgdir"/usr/share/$pkgname/sys -type f -exec chmod -R 666 {} \;
    
      47    find "$pkgdir"/usr/share/$pkgname/teams -type f -exec chmod -R 666 {} \;
    
      48    chmod 777 "$pkgdir"/usr/share/$pkgname/{teams,sys,sys/gamesettings}
    
      49    install -d -m 666 "$pkgdir"/usr/share/$pkgname/debug
    
      50
    
      51    install -d -m 755 "$pkgdir"/usr/bin
    
      52    ln -s /usr/share/$pkgname/CarnageContest "$pkgdir"/usr/bin/$pkgname
    
      53    chmod +x "$pkgdir"/usr/share/$pkgname/CarnageContest
    
      54    
    
      55	#install -Dm644 $pkgname.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      56	install -Dm644 $pkgname.desktop "$pkgdir"/usr/share/applications/$pkgname.desktop
    
      57}
    
      58
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3