dod-digglegods

maintainer toynbeeidea · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged This PKGBUILD installs a legitimately purchased game (Dungeons of Dredmor DLC) from Humble Bundle using the user's own personal key. The download is from humblebundle.com (a legitimate storefront), using the user's own purchase key stored in an environment variable. There is no checksum verification, but the source is the official vendor. The cheaper model flagged the wget download outside source=() as suspicious, but this is a well-known pattern for Humble Bundle game packages in the AUR — the user must own the game. The main concerns are: no integrity checking of the downloaded tarball, and the wget of an HTML page followed by parsing it with grep/cut is fragile and could theoretically be MITM'd (HTTP not HTTPS), but this is a sloppy/non-standard pattern rather than a genuine supply-chain attack. The package installs a legitimately purchased game binary, not malware. Rating: low (sloppy, no checksums, HTTP instead of HTTPS, but not a real supply-chain threat).

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): This PKGBUILD installs a legitimately purchased game (Dungeons of Dredmor DLC) from Humble Bundle using the user's own personal key. The download is from humblebundle.com (a legitimate storefront), using the user's own purchase key stored in an environment variable. There is no checksum verification, but the source is the official vendor. The cheaper model flagged the wget download outside source=() as suspicious, but this is a well-known pattern for Humble Bundle game packages in the AUR — the user must own the game. The main concerns are: no integrity checking of the downloaded tarball, and the wget of an HTML page followed by parsing it with grep/cut is fragile and could theoretically be MITM'd (HTTP not HTTPS), but this is a sloppy/non-standard pattern rather than a genuine supply-chain attack. The package installs a legitimately purchased game binary, not malware. Rating: low (sloppy, no checksums, HTTP instead of HTTPS, but not a real supply-chain threat).

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:31 wget http://www.humblebundle.com/?key=${_humbleintbundlekey}

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Babken Vardanyan <483ken 4tgma1l>
    
      2# Contributor: Tom Boshoven <tomboshoven@gmail.com>
    
      3# Contributor: Zachary A. Jones <jazzplayerl9@gmail.com>
    
      4
    
      5pkgname=dod-digglegods
    
      6pkgver=1.1.3
    
      7pkgrel=1
    
      8pkgdesc="Realm of the Diggle Gods:  DLC expansion for Dungeons of Dredmor"
    
      9arch=(i686 x86_64)
    
      10url="http://dungeonsofdredmor.com/"
    
      11license=(unknown)
    
      12depends=(dungeons-of-dredmor)
    
      13PKGEXT='.pkg.tar'
    
      14_gamepkg="Dredmor_humble-linux-realmofthedigglegods-${pkgver}.tar.gz"
    
      15_gamedir="dungeons-of-dredmor"
    
      16_execu="Dredmor-amd64"
    
      17[ "$CARCH" = 'x86_64' ] && _execu="Dredmor-x86"
    
      18package() {
    
      19
    
      20   cd "${srcdir}"
    
      21   msg "You need a full copy of this game in order to install it"
    
      22   msg "Searching for ${_gamepkg} in dir: $(readlink -f `pwd`/..)"
    
      23   if [[ -f "../${_gamepkg}" ]]; then
    
      24       msg "Found game package, installing..."
    
      25       ln -fs "../${_gamepkg}" .
    
      26   elif [[ -f "${_gamepkg}" ]]; then
    
      27	   msg "Found game package in ${srcdir}, installing..."
    
      28   elif [ -n "${_humbleintbundlekey}" ]; then
    
      29	   msg "Game package not found, trying to download..."
    
      30	   rm -f index.html\?key\=${_humbleintbundlekey}*
    
      31	   wget http://www.humblebundle.com/?key=${_humbleintbundlekey}
    
      32	   wget $(cat index.html\?key\=${_humbleintbundlekey} | grep "${_gamepkg}" | cut -d "'" -f 10)
    
      33	   mv ${_gamepkg}* ${_gamepkg}
    
      34   else
    
      35	   msg "Game package not found and download failed."
    
      36	   msg "You can add \'export _humbleintbundlekey\=\<Your key here\>\' to \.bashrc if you want automated download ability."
    
      37       error "Please type absolute path to ${_gamepkg} (/home/joe):"
    
      38       read pkgpath
    
      39       if [[ -f "${pkgpath}/${_gamepkg}" ]]; then
    
      40           msg "Found game package, installing..."
    
      41		   ln -fs "${pkgpath}/${_gamepkg}" .
    
      42	   else
    
      43	       error "Unable to find game package."
    
      44	       return 1
    
      45       fi
    
      46   fi
    
      47
    
      48  mkdir "$srcdir/dredmor"
    
      49  tar xvf "$srcdir/${_gamepkg}" -C "$srcdir/dredmor"
    
      50  cd "$srcdir"
    
      51  install -d "$pkgdir/opt/dredmor"
    
      52  
    
      53  cp -R "$srcdir/dredmor" "$pkgdir/opt"
    
      54
    
      55  }
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2