dustforce-hib-dustmod

maintainer J4913 · 1 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads Dustmod patches and game assets from dustkid.com, a community site for the game, which is not a standard or whitelisted host but hosts non-executable, game-specific data; the content is applied as patch files and resources, not remote code, and the build process otherwise uses official Humble Bundle installers and standard, safe operations.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads Dustmod patches and game assets from dustkid.com, a community site for the game, which is not a standard or whitelisted host but hosts non-executable, game-specific data; the content is applied as patch files and resources, not remote code, and the build process otherwise uses official Humble Bundle installers and standard, safe operations.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:26 'http://dustkid.com/getdustmod/linux64_drmfree'

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Joseph Lansdowne <J49137@gmail.com>
2# Forked from dustforce-hib
3# Commit: https://aur.archlinux.org/cgit/aur.git/commit/?h=dustforce-hib&id=652033563defbd0b002b57a14ab0b4070714e9a4
4# Author: Sam S. <smls75@gmail.com>
5
6# URL used for version checking: http://dustkid.com/backend8/dustmod_version.php
7
8pkgname=dustforce-hib-dustmod
9pkgver=1.0+h20141222_24.8.1
10_hibver=2014-12-22
11_hibver_windows=07012015
12pkgrel=2
13pkgdesc='A fast-paced 2D action platformer (Humble Bundle version, with Dustmod)'
14url='http://dustmod.com/'
15arch=('x86_64')
16license=('custom:commercial')
17depends=('mesa' 'libgl' 'sdl2' 'libxdamage' 'freealut' 'libidn11'
18 'libvorbis' 'libxft' 'xdg-utils' 'openssl-1.0')
19PKGEXT='.pkg.tar'
20DLAGENTS+=('hib::/usr/bin/echo "Could not find %u. Manually download it."; exit 1')
21
22_installer="Dustforce-Linux-${_hibver}.sh"
23_installer_windows="dustforce_dx_${_hibver_windows}.zip"
24source=("hib://${_installer}"
25 "hib://${_installer_windows}"
26 'http://dustkid.com/getdustmod/linux64_drmfree'
27 'dustmod-patch::http://dustkid.com/backend8/dustmod_package4.php?platform=linux64_drmfree'
28 'dustforce-dustmod'
29 'dustforce-hib-dustmod.desktop')
30sha256sums=('f7bc7ac00ef9166c0b4550e1fc120ffe78307e92be1e379f9c40a4513660fae1'
31 '386c82e28eb08eea443b9881ea360cc10f29d9baf7bdafa90457a96e75b3c72c'
32 '03eba46c134e43d76fbd13e0b0ad8cab39db54e15cb9a6aca8bc45b7c50fe58d'
33 'a23973f2fbaefabd597a397098609527df171a790b5f1d25ffa16b7092bb8292'
34 'ff3c4e8cb45f6e931b6545c55064aaf644b885eb99947b6e32c953faea77a3ce'
35 '031d9d6a6ed41c4f6c69ea7dc7037d1a53f656e37f16d33f220ca25db7e2912b')
36# zip with no top-level directory - will extract manually
37noextract=('linux64_drmfree')
38
39
40# extracts a Dustmod patch archive into the given directory
41# I haven't worked out any existing archive format that this uses, so this is a
42# simple inline implementation
43unarchive-patch () {
44 in="$1"
45 out="$2"
46
47 cat "$in" | while true; do
48 read -n 8 path_len_hex || break
49 read -n 8 data_len_hex || break
50 printf -v path_len "%d" "0x$path_len_hex"
51 printf -v data_len "%d" "0x$data_len_hex"
52 read -n "$path_len" path
53 mkdir -p "$(dirname "$out/$path")"
54 echo $path
55 if [ "$path" = "dustmod.bin.x86_64_dustmod" ]; then
56 dest="$out/dustmod.bin.x86_64"
57 else
58 dest="$out/$path"
59 fi
60 head -c "$data_len" > "$dest"
61 done
62}
63
64package() {
65 cd "$srcdir"
66 _installdir=/opt/dustforce-dustmod; _target="$pkgdir"/"$_installdir"
67
68 # install game files
69 mkdir -p "$pkgdir"/"$_installdir"
70 cp -TRl data/noarch "$pkgdir"/"$_installdir"
71 cp -TRl data/x86_64 "$pkgdir"/"$_installdir"
72
73 # include missing music track from Windows version
74 ln {"Dustforce DX","$pkgdir"/"$_installdir"}/"content/audio/music/Sun Bleach.ogg"
75
76 # install Dustmod
77 unzip -q "$srcdir"/linux64_drmfree -d "$pkgdir"/"$_installdir"/
78 # Apply Dustmod updates, which aren't distributed in the main download
79 unarchive-patch "$srcdir"/dustmod-patch "$pkgdir"/"$_installdir"
80
81 # Dustmod expects a version of curl we can't really obtain, but works with
82 # the version distributed with Dustforce
83 pushd "$pkgdir"/"$_installdir"/"lib64" > /dev/null
84 ln -s libcurl.so.{3,4}
85 popd > /dev/null
86
87 # fix permissions
88 find "$pkgdir" -type d -exec chmod 755 "{}" +
89 find "$pkgdir" -type f -exec chmod 644 "{}" +
90 chmod 755 "$_target"/Dustforce.bin.x86_64
91 chmod 755 "$_target"/dustmod.bin.x86_64
92
93 # install icon & desktop entry
94 install -Dm644 data/noarch/Dustforce.png \
95 "$pkgdir"/usr/share/pixmaps/dustforce-dustmod.png
96 install -Dm644 "$pkgname".desktop \
97 "$pkgdir"/usr/share/applications/"$pkgname".desktop
98
99 # install launcher
100 install -d "$pkgdir"/usr/bin
101 install -Dm755 dustforce-dustmod "$pkgdir"/usr/bin/dustforce-dustmod
102}
103

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion