diamond-dragon

maintainer lapsus · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD downloads PK3 mod files (ZIP-based game data archives, not native executables) from Google Drive using hardcoded file IDs. These files are installed as data assets under /usr/share/doom/ and are only ever loaded by GZDoom at runtime as game content — they are not executed directly by the OS or the package build process. The prepare() step only extracts CREDIT.txt from the archive; no code is compiled or executed from the downloaded content. The real concern is the absence of checksums (files are not in source=() and have no sha256sums), meaning a tampered Google Drive file would not be detected. However, since the files are pure game data (PK3/ZIP containing ZScript, sprites, sounds, maps) rather than native binaries or shared libraries, the impact of a tampered file is limited to GZDoom's scripting sandbox rather than arbitrary OS-level code execution. Google Drive with stable file IDs is a common distribution method for Doom mods. The lack of integrity verification is sloppy and a genuine (if modest) supply-chain concern, but the threat model is significantly lower than an unverified native binary, warranting low rather than medium severity.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): The PKGBUILD downloads PK3 mod files (ZIP-based game data archives, not native executables) from Google Drive using hardcoded file IDs. These files are installed as data assets under /usr/share/doom/ and are only ever loaded by GZDoom at runtime as game content — they are not executed directly by the OS or the package build process. The prepare() step only extracts CREDIT.txt from the archive; no code is compiled or executed from the downloaded content. The real concern is the absence of checksums (files are not in source=() and have no sha256sums), meaning a tampered Google Drive file would not be detected. However, since the files are pure game data (PK3/ZIP containing ZScript, sprites, sounds, maps) rather than native binaries or shared libraries, the impact of a tampered file is limited to GZDoom's scripting sandbox rather than arbitrary OS-level code execution. Google Drive with stable file IDs is a common distribution method for Doom mods. The lack of integrity verification is sloppy and a genuine (if modest) supply-chain concern, but the threat model is significantly lower than an unverified native binary, warranting low rather than medium severity.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:35 local page=$(curl -fsSL "https://drive.google.com/uc?export=download&id=${id}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2pkgname=diamond-dragon
    
      3pkgver=20250707
    
      4pkgrel=3
    
      5pkgdesc="Catgirl cyberpunk action GZDoom gameplay mod"
    
      6arch=('any')
    
      7url="https://www.doomworld.com/forum/topic/153613-diamond-dragon-catgirl-cyberpunk-action-updated-7725/"
    
      8license=('custom')
    
      9depends=()
    
      10optdepends=('gzdoom: GZDoom source port'
    
      11            'uzdoom-bin: UZDoom fork of GZDoom')
    
      12makedepends=('curl')
    
      13
    
      14# Google Drive file IDs
    
      15_gdrive_main="1WgEfXcawz38fKKag1ADZdf-OCocWFmDb"        # DiamondDragon.pk3
    
      16_gdrive_augzen="1zGOJmaAjPBOVCDwFXxHe3sQJzJWBtE16"      # AugZen Addon.pk3
    
      17_gdrive_hacx="1FLWE-HtaNX1cZv7JT_nhwArJMBeOMvar"        # Hacx2.0 Addon.pk3
    
      18_gdrive_neonover="1bGV0IZgL57eW8bgaAotXArKKn_ETf6LU"    # NeonOver Addon.pk3
    
      19
    
      20latestver() {
    
      21    local _page
    
      22    _page=$(curl -fsSL \
    
      23        -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" \
    
      24        "$url")
    
      25    python3 -c 'import re, sys
    
      26m = re.search(r"Updated ([0-9]{1,2})/([0-9]{1,2})/([0-9]{2})", sys.stdin.read())
    
      27if not m:
    
      28    raise SystemExit(1)
    
      29month, day, year = map(int, m.groups())
    
      30print(f"20{year:02d}{month:02d}{day:02d}")' <<< "$_page"
    
      31}
    
      32
    
      33_gdrive_fetch() {
    
      34    local id=$1 output=$2
    
      35    local page=$(curl -fsSL "https://drive.google.com/uc?export=download&id=${id}")
    
      36    if echo "$page" | grep -q 'download-form'; then
    
      37        local uuid=$(echo "$page" | grep -oP 'name="uuid" value="\K[^"]+')
    
      38        [[ -z "$uuid" ]] && { echo "Failed to extract uuid for $output"; return 1; }
    
      39        curl -fL --progress-bar -o "$output" \
    
      40            "https://drive.usercontent.google.com/download?id=${id}&export=download&confirm=t&uuid=${uuid}"
    
      41    else
    
      42        echo "$page" > "$output"
    
      43    fi
    
      44}
    
      45
    
      46prepare() {
    
      47    _gdrive_fetch "$_gdrive_main" "DiamondDragon.pk3"
    
      48    _gdrive_fetch "$_gdrive_augzen" "AugZen-Addon.pk3"
    
      49    _gdrive_fetch "$_gdrive_hacx" "Hacx2.0-Addon.pk3"
    
      50    _gdrive_fetch "$_gdrive_neonover" "NeonOver-Addon.pk3"
    
      51
    
      52    # Extract credits as license
    
      53    bsdtar -xf "DiamondDragon.pk3" CREDIT.txt
    
      54}
    
      55
    
      56package() {
    
      57    install -Dm644 DiamondDragon.pk3 "$pkgdir/usr/share/doom/diamond-dragon/DiamondDragon.pk3"
    
      58    install -Dm644 AugZen-Addon.pk3 "$pkgdir/usr/share/doom/diamond-dragon/addons/AugZen-Addon.pk3"
    
      59    install -Dm644 Hacx2.0-Addon.pk3 "$pkgdir/usr/share/doom/diamond-dragon/addons/Hacx2.0-Addon.pk3"
    
      60    install -Dm644 NeonOver-Addon.pk3 "$pkgdir/usr/share/doom/diamond-dragon/addons/NeonOver-Addon.pk3"
    
      61    install -Dm644 CREDIT.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2