diamond-dragon

MEDIUM

maintainer lapsus 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt PK3 mod files from Google Drive, an unverifiable and swappable host, during prepare(), posing a supply-chain risk if the files were tampered with or replaced.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:37 local page=$(curl -fsSL "https://drive.google.com/uc?export=download&id=${id}")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt PK3 mod files from Google Drive, an unverifiable and swappable host, during prepare(), posing a supply-chain risk if the files were tampered with or replaced.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2pkgname=diamond-dragon
    
      3pkgver=20250707
    
      4pkgrel=3
    
      5pkgdesc="Catgirl cyberpunk action GZDoom gameplay mod"
    
      6arch=('any')
    
      7url="https://www.doomworld.com/forum/topic/153613-diamond-dragon-catgirl-cyberpunk-action-updated-7725/"
    
      8license=('custom')
    
      9depends=()
    
      10optdepends=('gzdoom: GZDoom source port'
    
      11            'uzdoom-bin: UZDoom fork of GZDoom')
    
      12makedepends=('curl')
    
      13
    
      14# Google Drive file IDs
    
      15_gdrive_main="1WgEfXcawz38fKKag1ADZdf-OCocWFmDb"        # DiamondDragon.pk3
    
      16_gdrive_augzen="1zGOJmaAjPBOVCDwFXxHe3sQJzJWBtE16"      # AugZen Addon.pk3
    
      17_gdrive_hacx="1FLWE-HtaNX1cZv7JT_nhwArJMBeOMvar"        # Hacx2.0 Addon.pk3
    
      18_gdrive_neonover="1bGV0IZgL57eW8bgaAotXArKKn_ETf6LU"    # NeonOver Addon.pk3
    
      19
    
      20latestver() {
    
      21    local _page
    
      22    # Doomworld sits behind Cloudflare bot management and its verdict on a given
    
      23    # User-Agent has already inverted once: bare curl was blocked in 2026-04, the
    
      24    # spoofed Chrome UA was challenged in 2026-09. Try both rather than bet on either.
    
      25    local _chrome_ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
    
      26    _page=$(curl -fsSL "$url") || _page=$(curl -fsSL -A "$_chrome_ua" "$url") || return 1
    
      27    python3 -c 'import re, sys
    
      28m = re.search(r"Updated ([0-9]{1,2})/([0-9]{1,2})/([0-9]{2})", sys.stdin.read())
    
      29if not m:
    
      30    raise SystemExit(1)
    
      31month, day, year = map(int, m.groups())
    
      32print(f"20{year:02d}{month:02d}{day:02d}")' <<< "$_page"
    
      33}
    
      34
    
      35_gdrive_fetch() {
    
      36    local id=$1 output=$2
    
      37    local page=$(curl -fsSL "https://drive.google.com/uc?export=download&id=${id}")
    
      38    if echo "$page" | grep -q 'download-form'; then
    
      39        local uuid=$(echo "$page" | grep -oP 'name="uuid" value="\K[^"]+')
    
      40        [[ -z "$uuid" ]] && { echo "Failed to extract uuid for $output"; return 1; }
    
      41        curl -fL --progress-bar -o "$output" \
    
      42            "https://drive.usercontent.google.com/download?id=${id}&export=download&confirm=t&uuid=${uuid}"
    
      43    else
    
      44        echo "$page" > "$output"
    
      45    fi
    
      46}
    
      47
    
      48prepare() {
    
      49    _gdrive_fetch "$_gdrive_main" "DiamondDragon.pk3"
    
      50    _gdrive_fetch "$_gdrive_augzen" "AugZen-Addon.pk3"
    
      51    _gdrive_fetch "$_gdrive_hacx" "Hacx2.0-Addon.pk3"
    
      52    _gdrive_fetch "$_gdrive_neonover" "NeonOver-Addon.pk3"
    
      53
    
      54    # Extract credits as license
    
      55    bsdtar -xf "DiamondDragon.pk3" CREDIT.txt
    
      56}
    
      57
    
      58package() {
    
      59    install -Dm644 DiamondDragon.pk3 "$pkgdir/usr/share/doom/diamond-dragon/DiamondDragon.pk3"
    
      60    install -Dm644 AugZen-Addon.pk3 "$pkgdir/usr/share/doom/diamond-dragon/addons/AugZen-Addon.pk3"
    
      61    install -Dm644 Hacx2.0-Addon.pk3 "$pkgdir/usr/share/doom/diamond-dragon/addons/Hacx2.0-Addon.pk3"
    
      62    install -Dm644 NeonOver-Addon.pk3 "$pkgdir/usr/share/doom/diamond-dragon/addons/NeonOver-Addon.pk3"
    
      63    install -Dm644 CREDIT.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      64}
    
      65

Changes since previous scan

--- PKGBUILD @ 2026-09-04 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -19,9 +19,11 @@
 
 latestver() {
     local _page
-    _page=$(curl -fsSL \
-        -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" \
-        "$url")
+    # Doomworld sits behind Cloudflare bot management and its verdict on a given
+    # User-Agent has already inverted once: bare curl was blocked in 2026-04, the
+    # spoofed Chrome UA was challenged in 2026-09. Try both rather than bet on either.
+    local _chrome_ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+    _page=$(curl -fsSL "$url") || _page=$(curl -fsSL -A "$_chrome_ua" "$url") || return 1
     python3 -c 'import re, sys
 m = re.search(r"Updated ([0-9]{1,2})/([0-9]{1,2})/([0-9]{2})", sys.stdin.read())
 if not m:

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 13:57:51	Medium	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2