cavestory

maintainer gameslayer · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a ZIP archive from cavestory.org at build/install time using wget inside the package() function, outside the source=() array, meaning it has no checksum verification and bypasses makepkg's integrity checks entirely. The downloaded content (cavestoryen.zip) is game data files (not a binary executable), but the lack of any integrity verification means a compromised or MITM'd cavestory.org could substitute arbitrary content. Additionally, the package() function checks the live system state (/usr/share/games/CaveStory/config.dat) to decide whether to download, which is non-hermetic and unusual. The depends array includes 'wget' and 'yad' as runtime dependencies, suggesting the wrapper script also performs network operations at runtime. The game data itself is not executed as code, but the unverified download pattern is a genuine supply-chain concern. This is a real medium-severity issue: unverified external download of content that gets installed into the package, not a false positive.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:29 wget "https://www.cavestory.org/downloads/cavestoryen.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a ZIP archive from cavestory.org at build/install time using wget inside the package() function, outside the source=() array, meaning it has no checksum verification and bypasses makepkg's integrity checks entirely. The downloaded content (cavestoryen.zip) is game data files (not a binary executable), but the lack of any integrity verification means a compromised or MITM'd cavestory.org could substitute arbitrary content. Additionally, the package() function checks the live system state (/usr/share/games/CaveStory/config.dat) to decide whether to download, which is non-hermetic and unusual. The depends array includes 'wget' and 'yad' as runtime dependencies, suggesting the wrapper script also performs network operations at runtime. The game data itself is not executed as code, but the unverified download pattern is a genuine supply-chain concern. This is a real medium-severity issue: unverified external download of content that gets installed into the package, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=cavestory
    
      2_pkgname=CaveStory
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="Cave Story powered by the nxengine-evo."
    
      6url="https://gitlab.com/linuxbombay/cavestory"
    
      7arch=('x86_64' 'i386' 'i686' 'aarch64')
    
      8license=('GPL')
    
      9depends=('nxengine-evo-bin' 'wget' 'unzip' 'yad')
    
      10makedepends=('unzip')
    
      11source=("$url/-/archive/$pkgver/cavestory-$pkgver.tar.bz2")
    
      12sha256sums=('07162645e3a0916b9bd7cbf1bab89f4120f03865db7e7cabc3cb11879cd2f275')
    
      13
    
      14package() {
    
      15    install -dm755 "$pkgdir/usr/bin"
    
      16    install -dm775 "$pkgdir/usr/share/games/$_pkgname"
    
      17    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      18
    
      19    # Packaging files
    
      20    # Check if otr files exists so it doesn't redownload the files when it doesn't need to.
    
      21        FILE="/usr/share/games/$_pkgname/config.dat"
    
      22     if test -f "$FILE"
    
      23    then
    
      24        echo "$FILE exists skipping download."
    
      25        cp -rf "/usr/share/games/$_pkgname/." "$srcdir/$pkgname-$pkgver"
    
      26    else
    
      27        echo "$file does not exist, starting download.."
    
      28        cd $srcdir
    
      29        wget "https://www.cavestory.org/downloads/cavestoryen.zip"
    
      30        unzip -o cavestoryen.zip -d $srcdir
    
      31    fi
    
      32    cp "$srcdir/$pkgname-$pkgver/$pkgname" "$pkgdir/usr/bin"
    
      33    cp -rf "$srcdir/$pkgname-$pkgver/"* "$pkgdir/usr/share/games/$_pkgname"
    
      34    cp -rf "$srcdir/CaveStory/"* "$pkgdir/usr/share/games/$_pkgname"
    
      35    cp "$srcdir/$pkgname-$pkgver/$pkgname.png" "$pkgdir/usr/share/pixmaps"
    
      36
    
      37    # Desktop Entry
    
      38    install -Dm644 "$srcdir/$pkgname-$pkgver/$pkgname.desktop" \
    
      39    "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      40    sed -i s%/usr/share%/opt% "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2