dungeons-of-dredmor

LOW

maintainer toynbeeidea 13 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The download occurs only if a user-provided key is set and the game package is missing; otherwise, it prompts for a local file path, which is typical for AUR packages requiring proprietary data.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The download occurs only if a user-provided key is set and the game package is missing; otherwise, it prompts for a local file path, which is typical for AUR packages requiring proprietary data.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:34 wget http://www.humblebundle.com/?key=${_humbleintbundlekey}

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Babken Vardanyan <483ken 4tgma1l
    
      2# Contributor: Tom Boshoven <tomboshoven@gmail.com>
    
      3# Contributor: Zachary A. Jones <jazzplayerl9@gmail.com>
    
      4
    
      5pkgname=dungeons-of-dredmor
    
      6pkgver=1.1.3
    
      7pkgrel=1
    
      8pkgdesc="Rogue-like game with hilarity as the centerpiece.  Requires purchase from Humble Store (or Bundle)."
    
      9arch=(i686 x86_64)
    
      10url="http://dungeonsofdredmor.com/"
    
      11license=(unknown)
    
      12depends=(sdl_mixer sdl_image sdl_ttf gcc-libs openal)
    
      13source=(dredmor.desktop dredmor.png)
    
      14md5sums=('cc0659ad114563dd1122910f78b27dbb'
    
      15		 'a629a7939c0a8f4ef86fb351e72d6be9')
    
      16PKGEXT='.pkg.tar'
    
      17_gamepkg="dungeonsofdredmor-linux-${pkgver}.tgz"
    
      18_gamedir="dungeons-of-dredmor"
    
      19_execu="Dredmor-amd64"
    
      20[ "$CARCH" = 'x86_64' ] && _execu="Dredmor-x86"
    
      21package() {
    
      22
    
      23   cd "${srcdir}"
    
      24   msg "You need a full copy of this game in order to install it"
    
      25   msg "Searching for ${_gamepkg} in dir: $(readlink -f `pwd`/..)"
    
      26   if [[ -f "../${_gamepkg}" ]]; then
    
      27       msg "Found game package, installing..."
    
      28       ln -fs "../${_gamepkg}" .
    
      29   elif [[ -f "${_gamepkg}" ]]; then
    
      30	   msg "Found game package in ${srcdir}, installing..."
    
      31   elif [ -n "${_humbleintbundlekey}" ]; then
    
      32	   msg "Game package not found, trying to download..."
    
      33	   rm -f index.html\?key\=${_humbleintbundlekey}*
    
      34	   wget http://www.humblebundle.com/?key=${_humbleintbundlekey}
    
      35	   wget $(cat index.html\?key\=${_humbleintbundlekey} | grep "${_gamepkg}" | cut -d "'" -f 10)
    
      36	   mv ${_gamepkg}* ${_gamepkg}
    
      37   else
    
      38	   msg "Game package not found and download failed."
    
      39	   msg "You can add \'export _humbleintbundlekey\=\<Your key here\>\' to \.bashrc if you want automated download ability."
    
      40       error "Please type absolute path to ${_gamepkg} (/home/joe):"
    
      41       read pkgpath
    
      42       if [[ -f "${pkgpath}/${_gamepkg}" ]]; then
    
      43           msg "Found game package, installing..."
    
      44		   ln -fs "${pkgpath}/${_gamepkg}" .
    
      45	   else
    
      46	       error "Unable to find game package."
    
      47	       return 1
    
      48       fi
    
      49   fi
    
      50
    
      51  mkdir "$srcdir/dredmor"
    
      52  tar xvf "$srcdir/${_gamepkg}" -C "$srcdir/dredmor"
    
      53  cd "$srcdir"
    
      54  install -d "$pkgdir/opt/dredmor"
    
      55  
    
      56  #remove non-native libraries
    
      57  rm -rf "$srcdir/dredmor/x86"
    
      58  rm -rf "$srcdir/dredmor/amd64"
    
      59  rm "$srcdir/dredmor/${_execu}"
    
      60  
    
      61  # Fix mode
    
      62  chmod a+x "$srcdir/dredmor/Dredmor"
    
      63  
    
      64  cp -R "$srcdir/dredmor" "$pkgdir/opt"
    
      65
    
      66  cd "$pkgdir"
    
      67  
    
      68  #Install Desktop File
    
      69  install -m 644 -D "$srcdir/dredmor.desktop" usr/share/applications/dredmor.desktop
    
      70
    
      71  #Install Icon
    
      72  install -m 644 -D "$srcdir/dredmor.png" usr/share/icons/dredmor.png
    
      73  
    
      74  #Link Executable
    
      75  install -d usr/bin
    
      76  ln -s "/opt/dredmor/Dredmor" usr/bin/dredmor
    
      77}
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2