doomrl-git

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate project source (GitHub) and downloads assets from a third-party host, but the assets are non-executable data files (music and sound) that do not affect code execution, making the risk low despite the non-standard host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project source (GitHub) and downloads assets from a third-party host, but the assets are non-executable data files (music and sound) that do not affect code execution, making the risk low despite the non-standard host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "http://www.libregeek.org/Linux/game-files/doomrl/${doomrl_assets}.tar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ProfessorKaos64 <mdeguzis@gmail.com>
    
      2
    
      3pkgname=doomrl-git
    
      4pkgver=r8.0cbac80
    
      5doomrl_assets='doomrl-linux-assets-x64-0997'
    
      6pkgrel=10
    
      7pkgdesc="Doom: The Rogue-like (git-latest) (WIP!)."
    
      8arch=(any)
    
      9url="http://drl.chaosforge.org/"
    
      10license=('GPL3')
    
      11depends=('sdl_mixer' 'zlib' 'lua51' 'timidity++' 'sdl_image')
    
      12makedepends=('git' 'fpc-svn' 'lua')
    
      13source=("${pkgname}::git+https://github.com/ChaosForge/doomrl"
    
      14	"fpcvalkyrie::git+https://github.com/ChaosForge/fpcvalkyrie"
    
      15	"http://www.libregeek.org/Linux/game-files/doomrl/${doomrl_assets}.tar"
    
      16	'disable-asmcse-opt.patch'
    
      17	'disable-offending-shell-code.patch'
    
      18	'hard-code-svn-revision.patch'
    
      19	'fix-lua-dynamic-linking.patch'
    
      20	'doomrl-launch'
    
      21	)
    
      22sha256sums=('SKIP'
    
      23	    'SKIP'
    
      24	    '590c28b4e7f655e23c01bca0b2f9ddf9b8dd024f3a8b7ac5ec65d79877a6450b'
    
      25	    '1844d4698da23f31276f71e2fdd369959b41eac0b69677a147bd534b9c32b5ce'
    
      26	    '439de08ce548b0dc7ff6ba31ace7f375a1e6f0ebac32addf8a05d3d31283e192'
    
      27	    'e57148577e3152c99a61adb7ae841272491b7be62b168b8d62ee73b322b37418'
    
      28	    '8b7be4a787422722da65b3c184178f221d5ec76e60f11fda371aa27c9808ea9d'
    
      29	    '1bd87b0e8707ed7c41ad4f3b409515e5ac66aa9f14127cef584a68c7644615bc'
    
      30	    )
    
      31
    
      32prepare()
    
      33{
    
      34
    
      35  msg2 "Cleaning files"
    
      36
    
      37  # clean
    
      38  find "${srcdir}/${pkgname}" "${srcdir}/fpcvalkyrie" \
    
      39  '(' -iname '*.o' -or -iname '*.ppu' ')' -exec rm -f '{}' ';'
    
      40
    
      41  # assets
    
      42  cp -ru "${srcdir}/$doomrl_assets/mp3"/* "${srcdir}/${pkgname}/bin/mp3"
    
      43  cp -ru "${srcdir}/$doomrl_assets/wavhq"/* "${srcdir}/${pkgname}/bin/wavhq" 
    
      44
    
      45  # symlinks
    
      46  rm -f "${srcdir}/${pkgname}/bin/lua5.1.so"
    
      47
    
      48  msg2 "Patching"
    
      49
    
      50  # patch
    
      51  cd "${srcdir}"
    
      52  patch -p1 < disable-asmcse-opt.patch
    
      53  patch -p1 < disable-offending-shell-code.patch
    
      54  patch -p1 < hard-code-svn-revision.patch
    
      55  patch -p1 < fix-lua-dynamic-linking.patch
    
      56
    
      57}
    
      58
    
      59pkgver() {
    
      60  cd "${pkgname}"
    
      61  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      62}
    
      63
    
      64build()
    
      65{
    
      66
    
      67  cd ${srcdir}/${pkgname}
    
      68  rm -rf tmp && mkdir tmp
    
      69
    
      70  # add Linux config
    
      71  msg2 "Compiling doomrl"
    
      72  echo "OS=\"LINUX\"" > "${srcdir}/${pkgname}/config.lua"
    
      73  echo "VALKYRIE_ROOT=\"${srcdir}/fpcvalkyrie/\"" >> "${srcdir}/${pkgname}/config.lua"
    
      74  
    
      75  # lua makefile can be called to do the build 
    
      76  # but it seems to miss building makewad
    
      77  # use lazbuild instead
    
      78  # lua makefile.lua hq
    
      79
    
      80  lazbuild "src/makewad.lpi"
    
      81  lazbuild "src/doomrl.lpi"
    
      82
    
      83  # Generate wad
    
      84  msg2 "Generating wad file(s)"
    
      85  cd "${srcdir}/${pkgname}/bin"
    
      86
    
      87  # makewad doesn't properly search for the lua lib, include our lib path
    
      88  # link and provide the path
    
      89  ln -s "/usr/lib/liblua5.1.so" "lua5.1.so"
    
      90  LD_LIBRARY_PATH=$LD_LIBRARY_PATH:. ./makewad
    
      91
    
      92}
    
      93
    
      94package() {
    
      95
    
      96  msg2 "Installing doomrl files"
    
      97
    
      98  # check for doomrl and wads
    
      99  # Even if compile fails, it often will just continue on
    
      100  # Doesn't seem to exit fully
    
      101
    
      102  file_check="doomrl core.wad doomrl.wad"
    
      103
    
      104  for file in ${file_check};
    
      105  do
    
      106
    
      107	if [[ ! -f "${srcdir}/${pkgname}/bin/${file}" ]]; then
    
      108
    
      109		echo "ERROR: Cannot find core file ${file}. Exiting build."
    
      110		exit 1
    
      111
    
      112	fi
    
      113
    
      114  done
    
      115
    
      116  cd "${srcdir}/${pkgname}"
    
      117
    
      118  #####################
    
      119  # Directories
    
      120  #####################
    
      121
    
      122  install -d "$pkgdir/usr/share/games/doomrl"
    
      123  # Modules should not include original source content, just readme
    
      124  install -d "$pkgdir/usr/share/games/doomrl/modules"
    
      125
    
      126  DIRS="backup mp3 wavhq screenshot backup mortem"
    
      127
    
      128  for dir in $DIRS;
    
      129  do
    
      130	cp -dr "bin/${dir}" "$pkgdir/usr/share/games/doomrl/${dir}"
    
      131
    
      132  done
    
      133
    
      134  #####################
    
      135  # bin/share files
    
      136  #####################
    
      137
    
      138  # Shouldn't need the extra scripts, but include them anyway
    
      139
    
      140  FILES="core.wad
    
      141	 doomrl.wad 
    
      142	 doomrl 
    
      143	 manual.txt 
    
      144	 version.txt
    
      145	 version_api.txt
    
      146	 unix_notes.txt
    
      147	 config.lua
    
      148	 colors.lua
    
      149	 keybindings.lua 
    
      150	 sound.lua
    
      151	 manual.txt
    
      152	 music.lua
    
      153	 musichq.lua
    
      154	 doomrl_gnome-terminal
    
      155	 doomrl_konsole
    
      156	 doomrl_xterm
    
      157	 modules/!readme.txt"
    
      158
    
      159  for file in $FILES;
    
      160  do
    
      161
    
      162	install -m755 "bin/${file}" "$pkgdir/usr/share/games/doomrl/$(basename ${file})"	
    
      163
    
      164  done
    
      165
    
      166  # launcher
    
      167  install -Dm755 "$startdir/doomrl-launch" "$pkgdir/usr/bin/doomrl"
    
      168
    
      169  msg2 "Fixing permissions"
    
      170  
    
      171  # doomrl must have write access to several files
    
      172  # Use a workaround, makeing the group owner games and
    
      173  # only modifying files we need to
    
      174  chown -R root:games "$pkgdir/usr/share/games/doomrl"
    
      175  chmod -R g+w "$pkgdir/usr/share/games/doomrl"
    
      176
    
      177  #############
    
      178  # libs
    
      179  #############
    
      180
    
      181  msg "Fixing up libs"
    
      182
    
      183  # doomrl expects the lib to be "lua5.1.so", not our liblua5.1.so
    
      184  # Need to use a hack (until otherwise fixed) to trick doomrl to find it
    
      185  # copy in the existing symlink in the $srcdir/$pkgname/bin dir, preserving
    
      186  # the symlink path
    
      187
    
      188  cp -P "bin/lua5.1.so" "$pkgdir/usr/share/games/doomrl"
    
      189
    
      190}
    
      191

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2