dod-wizardlands

maintainer toynbeeidea · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged This PKGBUILD packages a legitimately purchased DLC (Conquest of the Wizardlands) from Humble Bundle. The download, if it occurs, uses the user's own personal Humble Bundle key to fetch their own legitimately purchased copy of the game from humblebundle.com — this is the official Humble Bundle storefront, not an unofficial or personal host. The wget-based download is sloppy (scraping HTML, no checksum verification) but the source is the official vendor. No binary is executed during the build; the tarball is simply extracted and installed to /opt. The cheaper model's concern about 'untrusted host' is a false positive — humblebundle.com is the official distribution channel for this game. The real issues are: no integrity checking (no checksums on the downloaded tarball), the package runs entirely in package() with no build(), and the interactive read is non-standard for makepkg. These are quality/sloppy issues, not security threats. The package installs game data files, not executed scripts or binaries beyond what the parent dungeons-of-dredmor package already provides.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): This PKGBUILD packages a legitimately purchased DLC (Conquest of the Wizardlands) from Humble Bundle. The download, if it occurs, uses the user's own personal Humble Bundle key to fetch their own legitimately purchased copy of the game from humblebundle.com — this is the official Humble Bundle storefront, not an unofficial or personal host. The wget-based download is sloppy (scraping HTML, no checksum verification) but the source is the official vendor. No binary is executed during the build; the tarball is simply extracted and installed to /opt. The cheaper model's concern about 'untrusted host' is a false positive — humblebundle.com is the official distribution channel for this game. The real issues are: no integrity checking (no checksums on the downloaded tarball), the package runs entirely in package() with no build(), and the interactive read is non-standard for makepkg. These are quality/sloppy issues, not security threats. The package installs game data files, not executed scripts or binaries beyond what the parent dungeons-of-dredmor package already provides.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:31 wget http://www.humblebundle.com/?key=${_humbleintbundlekey}

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Babken Vardanyan <483ken 4tgma1l>
    
      2# Contributor: Tom Boshoven <tomboshoven@gmail.com>
    
      3# Contributor: Zachary A. Jones <jazzplayerl9@gmail.com>
    
      4
    
      5pkgname=dod-wizardlands
    
      6pkgver=1.1.3
    
      7pkgrel=1
    
      8pkgdesc="Conquest of the Wizardlands:  DLC expansion for Dungeons of Dredmor"
    
      9arch=(i686 x86_64)
    
      10url="http://dungeonsofdredmor.com/"
    
      11license=(unknown)
    
      12depends=(dungeons-of-dredmor)
    
      13PKGEXT='.pkg.tar'
    
      14_gamepkg="Dredmor_humble-linux-conquestofthewizardlands-${pkgver}.tar.gz"
    
      15_gamedir="dungeons-of-dredmor"
    
      16_execu="Dredmor-amd64"
    
      17[ "$CARCH" = 'x86_64' ] && _execu="Dredmor-x86"
    
      18package() {
    
      19
    
      20   cd "${srcdir}"
    
      21   msg "You need a full copy of this game in order to install it"
    
      22   msg "Searching for ${_gamepkg} in dir: $(readlink -f `pwd`/..)"
    
      23   if [[ -f "../${_gamepkg}" ]]; then
    
      24       msg "Found game package, installing..."
    
      25       ln -fs "../${_gamepkg}" .
    
      26   elif [[ -f "${_gamepkg}" ]]; then
    
      27	   msg "Found game package in ${srcdir}, installing..."
    
      28   elif [ -n "${_humbleintbundlekey}" ]; then
    
      29	   msg "Game package not found, trying to download..."
    
      30	   rm -f index.html\?key\=${_humbleintbundlekey}*
    
      31	   wget http://www.humblebundle.com/?key=${_humbleintbundlekey}
    
      32	   wget $(cat index.html\?key\=${_humbleintbundlekey} | grep "${_gamepkg}" | cut -d "'" -f 10)
    
      33	   mv ${_gamepkg}* ${_gamepkg}
    
      34   else
    
      35	   msg "Game package not found and download failed."
    
      36	   msg "You can add \'export _humbleintbundlekey\=\<Your key here\>\' to \.bashrc if you want automated download ability."
    
      37       error "Please type absolute path to ${_gamepkg} (/home/joe):"
    
      38       read pkgpath
    
      39       if [[ -f "${pkgpath}/${_gamepkg}" ]]; then
    
      40           msg "Found game package, installing..."
    
      41		   ln -fs "${pkgpath}/${_gamepkg}" .
    
      42	   else
    
      43	       error "Unable to find game package."
    
      44	       return 1
    
      45       fi
    
      46   fi
    
      47
    
      48  mkdir "$srcdir/dredmor"
    
      49  tar xvf "$srcdir/${_gamepkg}" -C "$srcdir/dredmor"
    
      50  cd "$srcdir"
    
      51  install -d "$pkgdir/opt/dredmor"
    
      52  
    
      53  cp -R "$srcdir/dredmor" "$pkgdir/opt"
    
      54
    
      55  }
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2