doom3-bin

maintainer Slash · 13 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and executes a prebuilt binary installer (doom3-linux-1.3.1.1304.x86.run) from aur.slashbunny.com, which is a personal/unofficial host maintained by the package maintainer themselves. The installer is chmod +x'd and executed directly. While a SHA256 checksum is present (providing integrity verification against the known hash), the trust anchor is still the maintainer's personal server rather than an official id Software/Activision distribution channel. The official Doom 3 Linux installer was historically distributed by id Software/Loki, and this appears to be a rehosted copy. If the host were compromised or the maintainer acted maliciously, the checksum in the PKGBUILD could be updated simultaneously with the binary, defeating the integrity check. The package also installs PunkBuster libraries (pbag.so, pbcl.so, pbsv.so etc.) which are closed-source anti-cheat binaries with elevated system access. This is a genuine medium-severity supply-chain concern: executed binaries from a non-official personal host, even with checksums present.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://aur.slashbunny.com/doom3/doom3-linux-$pkgver.x86.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and executes a prebuilt binary installer (doom3-linux-1.3.1.1304.x86.run) from aur.slashbunny.com, which is a personal/unofficial host maintained by the package maintainer themselves. The installer is chmod +x'd and executed directly. While a SHA256 checksum is present (providing integrity verification against the known hash), the trust anchor is still the maintainer's personal server rather than an official id Software/Activision distribution channel. The official Doom 3 Linux installer was historically distributed by id Software/Loki, and this appears to be a rehosted copy. If the host were compromised or the maintainer acted maliciously, the checksum in the PKGBUILD could be updated simultaneously with the binary, defeating the integrity check. The package also installs PunkBuster libraries (pbag.so, pbcl.so, pbsv.so etc.) which are closed-source anti-cheat binaries with elevated system access. This is a genuine medium-severity supply-chain concern: executed binaries from a non-official personal host, even with checksums present.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Slash <demodevil5 [at] yahoo [dot] com>
    
      2# Contributor: Andrew Simmons <andrew.simmons@gmail.com>
    
      3# Contributor: teddy_beer_maniac <teddy_beer_maniac@wp.pl>
    
      4# Contributor: Babets
    
      5
    
      6pkgname=doom3-bin
    
      7pkgver=1.3.1.1304
    
      8pkgrel=1
    
      9pkgdesc='The stock Doom 3 binaries. Punkbuster compatible. You need the retail .pk4 files to play.'
    
      10url='http://www.doom3.com/'
    
      11license=('custom:"DOOM 3"' 'custom:"PunkBuster"')
    
      12depends_i686=('libxext' 'libgl' 'alsa-lib>=1.0.6')
    
      13depends_x86_64=('lib32-gcc-libs' 'lib32-libxdamage' 'lib32-libxext' 'lib32-libgl' 'lib32-alsa-lib>=1.0.6' 'lib32-libstdc++5' 'lib32-openal')
    
      14arch=('i686' 'x86_64')
    
      15install=doom3.install
    
      16source=('doom3.launcher' 'doom3-dedicated.launcher' 'doom3.desktop' \
    
      17'doom3.launcher64' 'doom3-dedicated.launcher64' 'doom3.png' \
    
      18"https://aur.slashbunny.com/doom3/doom3-linux-$pkgver.x86.run")
    
      19provides=('doom3')
    
      20conflicts=('doom3')
    
      21sha256sums=('ea9fe17fdb19cfe8a22e2b7859093f7a76eeaa51fd2571507b6dc37462515f21'
    
      22            'f7aa055489f581e3da3001b23becef68586b0994da70ee138425926fc580b204'
    
      23            'f9199b09981bb1fffba0f17a71e01021e4ea4aae6d99e553aa00c74d576e812b'
    
      24            '718378f2c3c42d56b916e9341e01261a2cfad5fb60ef15cc57954d1a4ce2a94e'
    
      25            'e6654e29773b5ed01f897294ecbc21a84dcb59afc30cb60eb0d5a3c03c7d3de1'
    
      26            'c9a701498a7b0f923182bf9f11aac8d2193026e509ae3643a5bc118b1a458c6b'
    
      27            '2f90dff20f2d3c0c47f17b3d6d45c4f0e7d27b986bf6084f21b85180cd1e03b4')
    
      28
    
      29build() {
    
      30    cd $srcdir
    
      31
    
      32    # Make Installer Executable
    
      33    chmod +x $srcdir/doom3-linux-$pkgver.x86.run
    
      34
    
      35    # Extract Game Files
    
      36    ./doom3-linux-$pkgver.x86.run --tar xf
    
      37}
    
      38
    
      39package() {
    
      40    # Create Destination Directories
    
      41    install -d $pkgdir/opt/doom3/{base,d3xp,pb/htm}
    
      42
    
      43    # Install Game Files
    
      44    install -m 644 base/*   $pkgdir/opt/doom3/base
    
      45    install -m 644 d3xp/*   $pkgdir/opt/doom3/d3xp
    
      46    install -m 644 pb/htm/* $pkgdir/opt/doom3/pb/htm
    
      47    install -m 644 {CHANGES,README,version.info} $pkgdir/opt/doom3
    
      48
    
      49    # Install Game Libraries
    
      50    install -m 755 $srcdir/{libgcc_s.so.1,libstdc++.so.6} \
    
      51        $pkgdir/opt/doom3
    
      52
    
      53    # Install Punkbuster Libraries
    
      54    install -m 755 $srcdir/pb/{pbag.so,pbags.so,pbcl.so,pbcls.so,pbsv.so} \
    
      55        $pkgdir/opt/doom3/pb
    
      56
    
      57    # Install Game Binaries
    
      58    install -m 755 $srcdir/bin/Linux/x86/{doom.x86,doomded.x86} \
    
      59        $pkgdir/opt/doom3
    
      60
    
      61    if [ "$CARCH" == "i686" ]; then
    
      62        # Install Game Launcher (Client)
    
      63        install -D -m 755 $srcdir/doom3.launcher \
    
      64            $pkgdir/usr/bin/doom3
    
      65
    
      66        # Install Game Launcher (Server)
    
      67        install -D -m 755 $srcdir/doom3-dedicated.launcher \
    
      68            $pkgdir/usr/bin/doom3-dedicated
    
      69    else
    
      70        # Install Game Launcher (Client)
    
      71        install -D -m 755 $srcdir/doom3.launcher64 \
    
      72            $pkgdir/usr/bin/doom3
    
      73
    
      74        # Install Game Launcher (Server)
    
      75        install -D -m 755 $srcdir/doom3-dedicated.launcher64 \
    
      76            $pkgdir/usr/bin/doom3-dedicated
    
      77    fi
    
      78
    
      79    # Install License (DOOM 3)
    
      80    install -D -m 644 $srcdir/License.txt \
    
      81        $pkgdir/usr/share/licenses/$pkgname/license.txt
    
      82
    
      83    # Install License (Punkbuster)
    
      84    install -D -m 644 $srcdir/pb/PB_EULA.txt \
    
      85        $pkgdir/usr/share/licenses/$pkgname/PB_EULA.txt
    
      86
    
      87    # Install Icon
    
      88    install -D -m 644 $srcdir/doom3.png \
    
      89        $pkgdir/usr/share/pixmaps/doom3.png
    
      90
    
      91    # Install Desktop File
    
      92    install -D -m 644 $srcdir/doom3.desktop \
    
      93        $pkgdir/usr/share/applications/doom3.desktop
    
      94
    
      95    # Remove Bundled Libraries (Doom3 will use the System Libraries)
    
      96    rm $pkgdir/opt/doom3/{libgcc_s.so.1,libstdc++.so.6}
    
      97}
    
      98

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2