doukutsu-rs-git
LOW
maintainer damian101
0 votes
scanned 2026-10-17 15:20:46.728702
Why flagged
The non-standard host (cavestory.org) is the official Cave Story website downloading the freeware game data ZIP with a pinned checksum; the rest is building from the project's own GitHub source, so there is no meaningful supply-chain risk beyond the low-vote/new-package caveat.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The non-standard host (cavestory.org) is the official Cave Story website downloading the freeware game data ZIP with a pinned checksum; the rest is building from the project's own GitHub source, so there is no meaningful supply-chain risk beyond the low-vote/new-package caveat.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"https://www.cavestory.org/downloads/cavestoryen.zip"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Damian Höster <damian.hoester@posteo.de>
2
3
_pkgname=doukutsu-rs
4
pkgname=$_pkgname-git
5
pkgver=1.0.0.r50.d05995b
6
pkgrel=1
7
pkgdesc="A faithful and open-source remake of Cave Story's engine written in Rust"
8
arch=(
9
x86_64
10
aarch64
11
)
12
url=https://github.com/doukutsu-rs/doukutsu-rs
13
license=(
14
MIT
15
LicenseRef-freeware
16
)
17
depends=(
18
alsa-lib
19
gcc-libs
20
glibc
21
libglvnd
22
)
23
makedepends=(
24
cargo
25
cmake
26
git
27
)
28
provides=($_pkgname)
29
conflicts=($_pkgname)
30
source=(
31
"$_pkgname::git+$url.git"
32
"vanilla-extractor::git+https://github.com/doukutsu-rs/vanilla-extractor.git#tag=v1.0.2"
33
"https://www.cavestory.org/downloads/cavestoryen.zip"
34
)
35
sha256sums=(
36
'SKIP'
37
'SKIP'
38
'aa87fa30bee9b4980640c7e104791354e0f1f6411ee0d45a70af70046aa0685f'
39
)
40
41
pkgver() {
42
git -C $_pkgname describe --long --tags |
43
sed -E 's/^v//; s/-([^-]*)-g([^-]*)$/.r\1.\2/; s/-/./g'
44
}
45
46
prepare() {
47
export RUSTUP_TOOLCHAIN=stable
48
49
cd "$srcdir/$_pkgname"
50
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
51
52
cd "$srcdir/vanilla-extractor"
53
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
54
}
55
56
build() {
57
export RUSTUP_TOOLCHAIN=stable
58
export CARGO_TARGET_DIR=target
59
60
cd "$srcdir/$_pkgname"
61
cargo build --release --frozen --bin $_pkgname
62
63
cd "$srcdir/vanilla-extractor"
64
cargo build --release --frozen --bin vanilla-extractor
65
66
cd "$srcdir/CaveStory"
67
"$srcdir/vanilla-extractor/target/release/vanilla-extractor"
68
}
69
70
package() {
71
install -Dm755 "$srcdir/$_pkgname/target/release/$_pkgname" "$pkgdir/usr/lib/$_pkgname/$_pkgname"
72
73
install -dm755 "$pkgdir/usr/bin"
74
cat <<'EOF' >"$pkgdir/usr/bin/$_pkgname"
75
#!/bin/sh
76
set -e
77
78
USER_DATA_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/doukutsu-rs/data"
79
SYS_DATA_DIR="/usr/share/doukutsu-rs/data"
80
81
mkdir -p "${XDG_DATA_HOME:-$HOME/.local/share}/doukutsu-rs"
82
83
if [ -z "$CAVESTORY_DATA_DIR" ]; then
84
if [ -n "$(find "$USER_DATA_DIR" -mindepth 1 -print -quit 2>/dev/null)" ]; then
85
export CAVESTORY_DATA_DIR="$USER_DATA_DIR"
86
elif [ -d "$SYS_DATA_DIR" ]; then
87
export CAVESTORY_DATA_DIR="$SYS_DATA_DIR"
88
fi
89
fi
90
91
exec /usr/lib/doukutsu-rs/doukutsu-rs "$@"
92
EOF
93
chmod 755 "$pkgdir/usr/bin/$_pkgname"
94
95
install -dm755 "$pkgdir/usr/share/$_pkgname"
96
cp -r "$srcdir/CaveStory/data" "$pkgdir/usr/share/$_pkgname/"
97
chmod -R u=rwX,go=rX "$pkgdir/usr/share/$_pkgname/data"
98
99
cd "$srcdir/$_pkgname"
100
101
install -Dm644 res/flatpak/io.github.doukutsu_rs.doukutsu-rs.desktop \
102
"$pkgdir"/usr/share/applications/io.github.doukutsu_rs.doukutsu-rs.desktop
103
install -Dm644 res/flatpak/io.github.doukutsu_rs.doukutsu-rs.metainfo.xml \
104
"$pkgdir"/usr/share/metainfo/io.github.doukutsu_rs.doukutsu-rs.metainfo.xml
105
106
install -Dm644 res/macos/16x16.png \
107
"$pkgdir"/usr/share/icons/hicolor/16x16/apps/io.github.doukutsu_rs.doukutsu-rs.png
108
install -Dm644 res/macos/32x32.png \
109
"$pkgdir"/usr/share/icons/hicolor/32x32/apps/io.github.doukutsu_rs.doukutsu-rs.png
110
install -Dm644 res/macos/128x128.png \
111
"$pkgdir"/usr/share/icons/hicolor/128x128/apps/io.github.doukutsu_rs.doukutsu-rs.png
112
install -Dm644 res/macos/256x256.png \
113
"$pkgdir"/usr/share/icons/hicolor/256x256/apps/io.github.doukutsu_rs.doukutsu-rs.png
114
install -Dm644 res/macos/512x512.png \
115
"$pkgdir"/usr/share/icons/hicolor/512x512/apps/io.github.doukutsu_rs.doukutsu-rs.png
116
install -Dm644 res/macos/crabsue.svg \
117
"$pkgdir"/usr/share/icons/hicolor/scalable/apps/io.github.doukutsu_rs.doukutsu-rs.svg
118
119
install -Dm644 README.md -t "$pkgdir"/usr/share/doc/$pkgname
120
install -Dm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
121
122
install -Dm644 "$srcdir/CaveStory/Readme.txt" "$pkgdir/usr/share/licenses/$pkgname/CaveStory-Readme.txt"
123
install -Dm644 "$srcdir/CaveStory/Manual.html" "$pkgdir/usr/share/doc/$pkgname/Manual.html"
124
cp -r "$srcdir/CaveStory/Manual" "$pkgdir/usr/share/doc/$pkgname/"
125
chmod -R u=rwX,go=rX "$pkgdir/usr/share/doc/$pkgname/Manual"
126
}
127
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 15:20:46 | Low | 3 |
| 2026-10-17 15:18:35 | Medium | 2 |