doom3bfg-data-steam

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source URL (steamcdn-a.akamaihd.net) is Valve/Steam's official CDN (Akamai-hosted), not a personal or unofficial host. SteamCMD is the official Valve tool for downloading Steam games server-side. SKIP on the checksum is sloppy but steamcmd updates itself on first run anyway, making a pinned hash largely meaningless. The binary is executed to download legitimately-purchased game data using the user's own Steam credentials interactively. There is no obfuscation, no exfiltration, and no unofficial binary. The main concerns are: (1) SKIP checksum on an executed binary is non-ideal, and (2) the package installs proprietary game data which requires a valid Steam purchase. Neither rises to a genuine supply-chain threat given the official CDN origin. Rating: low (sloppy, not a real security risk).

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The source URL (steamcdn-a.akamaihd.net) is Valve/Steam's official CDN (Akamai-hosted), not a personal or unofficial host. SteamCMD is the official Valve tool for downloading Steam games server-side. SKIP on the checksum is sloppy but steamcmd updates itself on first run anyway, making a pinned hash largely meaningless. The binary is executed to download legitimately-purchased game data using the user's own Steam credentials interactively. There is no obfuscation, no exfiltration, and no unofficial binary. The main concerns are: (1) SKIP checksum on an executed binary is non-ideal, and (2) the package installs proprietary game data which requires a valid Steam purchase. Neither rises to a genuine supply-chain threat given the official CDN origin. Rating: low (sloppy, not a real security risk).

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("http://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ysblokje <ysblokje at gmail dot com>
    
      2# based on doom3-data-steam by Alan Jenkins <alan.james.jenkins [at] gmail.com>
    
      3pkgname=doom3bfg-data-steam
    
      4pkgver=1
    
      5pkgrel=1
    
      6pkgdesc="Doom 3 BFG data via Steam"
    
      7arch=('any')
    
      8provides=('doom3bfg-data')
    
      9#didn't work for me, just download the recent version from valve.
    
      10#depends=('steamcmd')
    
      11#steam eula??
    
      12license=('custom')
    
      13url='http://store.steampowered.com/app/208200'
    
      14source=("http://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz")
    
      15md5sums=(SKIP)
    
      16basedest='/usr/share/games/doom3bfg/'
    
      17PKGEXT='.pkg.tar'
    
      18
    
      19
    
      20build() {
    
      21    cd $srcdir
    
      22    doom3dir=$srcdir/doom3bfg
    
      23    mkdir -p $doom3dir
    
      24
    
      25    # Use steamcmd to get doom3bfg.
    
      26    printf "Enter your Steam username:"
    
      27    read steam_username
    
      28    ./steamcmd.sh +@sSteamCmdForcePlatformType windows +force_install_dir $doom3dir +login $steam_username +app_update 208200 validate +quit
    
      29    find -L $doom3dir -type d -exec chmod 755 {} +
    
      30    find -L $doom3dir -type f -exec chmod 644 {} +
    
      31}
    
      32
    
      33package() {
    
      34    cd $srcdir
    
      35    # Move required files to pkgdir
    
      36    mkdir -p $pkgdir/$basedest
    
      37    cp -a $srcdir/doom3bfg/base $pkgdir/$basedest/
    
      38}
    
      39
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2