doom2df-bin-git

maintainer Perfecon · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt Linux binary (Doom2DF) directly from deadsoftware.ru with SKIP'd checksums. While deadsoftware.ru appears to be the official upstream host for Doom 2D Forever (the game's official site doom2d.org is associated with this project), the use of SKIP for all three remote sources means there is no integrity verification at all — any compromise of the host or a MITM attack would result in arbitrary binary execution on the user's system. The binary is installed with 755 permissions directly to /usr/bin. The 'latest' naming convention (no pinned version in the URL) means the downloaded binary can change at any time without the PKGBUILD being updated. This is a genuine supply-chain concern: an executed binary from a host with no checksum verification, even if the host is the legitimate upstream. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 'https://deadsoftware.ru/files/deaddoomer/d2df/win32-d2df-latest.zip'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads and installs a prebuilt Linux binary (Doom2DF) directly from deadsoftware.ru with SKIP'd checksums. While deadsoftware.ru appears to be the official upstream host for Doom 2D Forever (the game's official site doom2d.org is associated with this project), the use of SKIP for all three remote sources means there is no integrity verification at all — any compromise of the host or a MITM attack would result in arbitrary binary execution on the user's system. The binary is installed with 755 permissions directly to /usr/bin. The 'latest' naming convention (no pinned version in the URL) means the downloaded binary can change at any time without the PKGBUILD being updated. This is a genuine supply-chain concern: an executed binary from a host with no checksum verification, even if the host is the legitimate upstream. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Danil Yarantsev <tiberiumk12 at gmail dot com>
    
      2pkgname=doom2df-bin-git
    
      3pkgver=185
    
      4pkgrel=1
    
      5pkgdesc="Doom 2D Forever: A Doom 2D remake with multiplayer"
    
      6arch=(x86_64)
    
      7url="http://doom2d.org/"
    
      8license=('GPL3')
    
      9depends=(sdl2_mixer sdl2 enet libgl)
    
      10conflicts=(doom2df-git)
    
      11source=(
    
      12  'https://deadsoftware.ru/files/deaddoomer/d2df/win32-d2df-latest.zip'
    
      13  'https://deadsoftware.ru/files/deaddoomer/d2df/linux-amd64-d2df-latest-bin.zip'
    
      14  'https://deadsoftware.ru/files/deaddoomer/d2df/linux-amd64-d2df-latest-version.txt'
    
      15  'doom2df.desktop'
    
      16  'doom2df.png'
    
      17)
    
      18md5sums=(
    
      19  'SKIP'
    
      20  'SKIP'
    
      21  'SKIP'
    
      22  'a529aca738b79f2099fcef6e583fbed3'
    
      23  '191cd29a6994ab257abf6c0b1060b2fd'
    
      24)
    
      25
    
      26pkgver() {
    
      27  printf "$(cat linux-amd64-d2df-latest-version.txt | cut -d' ' -f1)"
    
      28}
    
      29
    
      30package() {
    
      31  cd "${srcdir}"
    
      32  install -Dm755 Doom2DF "${pkgdir}"/usr/bin/Doom2DF
    
      33  install -Dm644 doom2df.desktop "${pkgdir}"/usr/share/applications/doom2df.desktop
    
      34  install -Dm644 doom2df.png "${pkgdir}"/usr/share/pixmaps/doom2df.png
    
      35  mkdir -p "${pkgdir}"/usr/share/doom2df
    
      36  cp -r data maps wads "${pkgdir}"/usr/share/doom2df/
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2