dfhack-twbt

maintainer dangersalad · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads image assets from a non-whitelisted host (dwarffortresswiki.org), but these are non-executable data files used for game graphics; the actual code is built from public, version-controlled repositories, and there is no remote code execution or supply-chain risk beyond cosmetic asset tampering.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads image assets from a non-whitelisted host (dwarffortresswiki.org), but these are non-executable data files used for game graphics; the actual code is built from public, version-controlled repositories, and there is no remote code execution or supply-chain risk beyond cosmetic asset tampering.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "graphics.png::https://dwarffortresswiki.org/images/1/11/Bisasam_20x20_mod_T.png"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Paul Davis ("dangersalad") <paul is located at dangersalad and it's a dot com>
    
      2# shellcheck disable=2034
    
      3# shellcheck disable=2148
    
      4
    
      5pkgname=dfhack-twbt
    
      6pkgver=0.47.05
    
      7_pkgver=$pkgver-r3
    
      8_twbtver=v6.61
    
      9pkgrel=12
    
      10pkgdesc="memory hacking library for Dwarf Fortress and a set of tools that use it"
    
      11arch=('x86_64' 'i686')
    
      12url="https://dfhack.readthedocs.io/en/stable/"
    
      13license=('custom')
    
      14depends=("dwarffortress=$pkgver" lua protobuf libpng12 libxrandr libjpeg6 freetype2 libglvnd libxcursor libxinerama)
    
      15provides=('dfhack')
    
      16makedepends=('cmake' 'git' 'python-sphinx' 'perl-xml-libxml' 'perl-xml-libxslt')
    
      17conflicts=('dfhack-bin' 'dfhack-git' 'dfhack-twbt-bin' 'dfhack')
    
      18
    
      19source=("dfhack::git+https://github.com/DFHack/dfhack#tag=$_pkgver"
    
      20        "twbt::git+https://github.com/thurin/df-twbt#branch=04705"
    
      21        dfhack.sh
    
      22        dfhack-run.sh
    
      23        colors.txt
    
      24        colors_spring.txt
    
      25        colors_summer.txt
    
      26        colors_autumn.txt
    
      27        colors_winter.txt
    
      28        init.txt
    
      29        d_init.txt
    
      30        dfhack.init
    
      31        "graphics.png::https://dwarffortresswiki.org/images/1/11/Bisasam_20x20_mod_T.png"
    
      32        "text.png::https://dwarffortresswiki.org/images/a/a6/Cooz_curses_square_16x16.png")
    
      33
    
      34md5sums=('SKIP'
    
      35         'SKIP'
    
      36         'e74365253ca67a65c49999e5897faa84'
    
      37         '0dcc9284c4e52e02e249df23a79c9349'
    
      38         'ea2a6ea0f4bfc479fc19d4cc5e27647b'
    
      39         '4f1e369137477f7c401c7734023e2b4e'
    
      40         'eeef50db09aa05a81fcbebb4d7a10b4b'
    
      41         '1c1e4d984c27ab7bef45d6ac8915b5da'
    
      42         '9c67fdc314d2344055da0786d984c521'
    
      43         'e8bfabc5fe1810fd3a1c91504dce7ee6'
    
      44         '84becf98cc341da5806fe0e9406a083a'
    
      45         'b72dd69e286287daebb02d748d9c171d'
    
      46         'f205514b69112b8e69cef8984b3eb886'
    
      47         'f87b8aab62ecb7edf4fd6f2b1c008a3d')
    
      48
    
      49prepare() {
    
      50    # shellcheck disable=2154
    
      51    cd "$srcdir"/dfhack || exit 1
    
      52
    
      53    git remote set-url origin https://github.com/DFHack/dfhack
    
      54    git submodule sync
    
      55    git submodule update --init
    
      56}
    
      57
    
      58build() {
    
      59    cd "$srcdir"/dfhack/build || exit 1
    
      60
    
      61    export CC=gcc
    
      62    export CXX=g++
    
      63
    
      64    cmake \
    
      65        -DCMAKE_INSTALL_PREFIX=/opt/dwarffortress \
    
      66        -DCMAKE_BUILD_TYPE=Release \
    
      67        -DBUILD_DOCS=ON \
    
      68        -DBUILD_STONESENSE=OFF \
    
      69        -DDFHACK_BUILD_ARCH=64 \
    
      70        ..
    
      71
    
      72    make -j14
    
      73
    
      74    cd "$srcdir"/twbt || exit 1
    
      75
    
      76    make -j14 DFHACKVER="$_pkgver" DF=/opt/dwarffortress DH="$srcdir"/dfhack
    
      77    
    
      78}
    
      79
    
      80package() {
    
      81    cd "$srcdir"/dfhack/build || exit 1
    
      82
    
      83    # shellcheck disable=2154
    
      84    make DESTDIR="$pkgdir" install
    
      85
    
      86    install -Dm755 "$srcdir"/dfhack.sh     "$pkgdir"/usr/bin/dfhack
    
      87    install -Dm755 "$srcdir"/dfhack-run.sh "$pkgdir"/usr/bin/dfhack-run
    
      88
    
      89    install -Dm644 ../LICENSE.rst "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      90    
    
      91    cd "$srcdir"/twbt || exit 1
    
      92
    
      93    mkdir -p "$pkgdir/opt/dwarffortress/hack/plugins"
    
      94    
    
      95    make DFHACKVER="$_pkgver" DF="$pkgdir/opt/dwarffortress" DH="$srcdir"/dfhack inst
    
      96
    
      97    install -Dm755 "$srcdir/dfhack.init" "$pkgdir/opt/dwarffortress/dfhack.init"
    
      98    install -Dm755 dist/shadows.png "$pkgdir/opt/dwarffortress/data/art/shadows.png"
    
      99    install -Dm755 dist/white1px.png "$pkgdir/opt/dwarffortress/data/art/white1px.png"
    
      100    install -Dm755 dist/transparent1px.png "$pkgdir/opt/dwarffortress/data/art/transparent1px.png"
    
      101    install -Dm755 dist/overrides.txt "$pkgdir/opt/dwarffortress/data/init/overrides.txt"
    
      102    
    
      103    mkdir -p "$pkgdir/opt/dwarffortress/data/init"
    
      104    
    
      105    install -Dm755 "$srcdir/init.txt" "$pkgdir/opt/dwarffortress/data/init/init.custom.txt"
    
      106    install -Dm755 "$srcdir/d_init.txt" "$pkgdir/opt/dwarffortress/data/init/d_init.custom.txt"
    
      107    
    
      108    mkdir -p "$pkgdir/opt/dwarffortress/data/art"
    
      109    
    
      110    install -Dm755 "$srcdir/graphics.png" "$pkgdir/opt/dwarffortress/data/art/graphics.png"
    
      111    install -Dm755 "$srcdir/text.png" "$pkgdir/opt/dwarffortress/data/art/text.png"
    
      112    
    
      113    mkdir -p "$pkgdir/opt/dwarffortress/raw"
    
      114    
    
      115    install -Dm755 "$srcdir/colors.txt" "$pkgdir/opt/dwarffortress/raw/colors.txt"
    
      116    install -Dm755 "$srcdir/colors_spring.txt" "$pkgdir/opt/dwarffortress/raw/colors_spring.txt"
    
      117    install -Dm755 "$srcdir/colors_summer.txt" "$pkgdir/opt/dwarffortress/raw/colors_summer.txt"
    
      118    install -Dm755 "$srcdir/colors_autumn.txt" "$pkgdir/opt/dwarffortress/raw/colors_autumn.txt"
    
      119    install -Dm755 "$srcdir/colors_winter.txt" "$pkgdir/opt/dwarffortress/raw/colors_winter.txt"
    
      120}
    
      121

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2