dustforce-hib-dustmod
LOW
maintainer J4913
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads Dustmod patches and game assets from dustkid.com, a community site for the game, which is not a standard or whitelisted host but hosts non-executable, game-specific data; the content is applied as patch files and resources, not remote code, and the build process otherwise uses official Humble Bundle installers and standard, safe operations.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads Dustmod patches and game assets from dustkid.com, a community site for the game, which is not a standard or whitelisted host but hosts non-executable, game-specific data; the content is applied as patch files and resources, not remote code, and the build process otherwise uses official Humble Bundle installers and standard, safe operations.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
'http://dustkid.com/getdustmod/linux64_drmfree'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Joseph Lansdowne <J49137@gmail.com>
2
# Forked from dustforce-hib
3
# Commit: https://aur.archlinux.org/cgit/aur.git/commit/?h=dustforce-hib&id=652033563defbd0b002b57a14ab0b4070714e9a4
4
# Author: Sam S. <smls75@gmail.com>
5
6
# URL used for version checking: http://dustkid.com/backend8/dustmod_version.php
7
8
pkgname=dustforce-hib-dustmod
9
pkgver=1.0+h20141222_24.8.1
10
_hibver=2014-12-22
11
_hibver_windows=07012015
12
pkgrel=2
13
pkgdesc='A fast-paced 2D action platformer (Humble Bundle version, with Dustmod)'
14
url='http://dustmod.com/'
15
arch=('x86_64')
16
license=('custom:commercial')
17
depends=('mesa' 'libgl' 'sdl2' 'libxdamage' 'freealut' 'libidn11'
18
'libvorbis' 'libxft' 'xdg-utils' 'openssl-1.0')
19
PKGEXT='.pkg.tar'
20
DLAGENTS+=('hib::/usr/bin/echo "Could not find %u. Manually download it."; exit 1')
21
22
_installer="Dustforce-Linux-${_hibver}.sh"
23
_installer_windows="dustforce_dx_${_hibver_windows}.zip"
24
source=("hib://${_installer}"
25
"hib://${_installer_windows}"
26
'http://dustkid.com/getdustmod/linux64_drmfree'
27
'dustmod-patch::http://dustkid.com/backend8/dustmod_package4.php?platform=linux64_drmfree'
28
'dustforce-dustmod'
29
'dustforce-hib-dustmod.desktop')
30
sha256sums=('f7bc7ac00ef9166c0b4550e1fc120ffe78307e92be1e379f9c40a4513660fae1'
31
'386c82e28eb08eea443b9881ea360cc10f29d9baf7bdafa90457a96e75b3c72c'
32
'03eba46c134e43d76fbd13e0b0ad8cab39db54e15cb9a6aca8bc45b7c50fe58d'
33
'a23973f2fbaefabd597a397098609527df171a790b5f1d25ffa16b7092bb8292'
34
'ff3c4e8cb45f6e931b6545c55064aaf644b885eb99947b6e32c953faea77a3ce'
35
'031d9d6a6ed41c4f6c69ea7dc7037d1a53f656e37f16d33f220ca25db7e2912b')
36
# zip with no top-level directory - will extract manually
37
noextract=('linux64_drmfree')
38
39
40
# extracts a Dustmod patch archive into the given directory
41
# I haven't worked out any existing archive format that this uses, so this is a
42
# simple inline implementation
43
unarchive-patch () {
44
in="$1"
45
out="$2"
46
47
cat "$in" | while true; do
48
read -n 8 path_len_hex || break
49
read -n 8 data_len_hex || break
50
printf -v path_len "%d" "0x$path_len_hex"
51
printf -v data_len "%d" "0x$data_len_hex"
52
read -n "$path_len" path
53
mkdir -p "$(dirname "$out/$path")"
54
echo $path
55
if [ "$path" = "dustmod.bin.x86_64_dustmod" ]; then
56
dest="$out/dustmod.bin.x86_64"
57
else
58
dest="$out/$path"
59
fi
60
head -c "$data_len" > "$dest"
61
done
62
}
63
64
package() {
65
cd "$srcdir"
66
_installdir=/opt/dustforce-dustmod; _target="$pkgdir"/"$_installdir"
67
68
# install game files
69
mkdir -p "$pkgdir"/"$_installdir"
70
cp -TRl data/noarch "$pkgdir"/"$_installdir"
71
cp -TRl data/x86_64 "$pkgdir"/"$_installdir"
72
73
# include missing music track from Windows version
74
ln {"Dustforce DX","$pkgdir"/"$_installdir"}/"content/audio/music/Sun Bleach.ogg"
75
76
# install Dustmod
77
unzip -q "$srcdir"/linux64_drmfree -d "$pkgdir"/"$_installdir"/
78
# Apply Dustmod updates, which aren't distributed in the main download
79
unarchive-patch "$srcdir"/dustmod-patch "$pkgdir"/"$_installdir"
80
81
# Dustmod expects a version of curl we can't really obtain, but works with
82
# the version distributed with Dustforce
83
pushd "$pkgdir"/"$_installdir"/"lib64" > /dev/null
84
ln -s libcurl.so.{3,4}
85
popd > /dev/null
86
87
# fix permissions
88
find "$pkgdir" -type d -exec chmod 755 "{}" +
89
find "$pkgdir" -type f -exec chmod 644 "{}" +
90
chmod 755 "$_target"/Dustforce.bin.x86_64
91
chmod 755 "$_target"/dustmod.bin.x86_64
92
93
# install icon & desktop entry
94
install -Dm644 data/noarch/Dustforce.png \
95
"$pkgdir"/usr/share/pixmaps/dustforce-dustmod.png
96
install -Dm644 "$pkgname".desktop \
97
"$pkgdir"/usr/share/applications/"$pkgname".desktop
98
99
# install launcher
100
install -d "$pkgdir"/usr/bin
101
install -Dm755 dustforce-dustmod "$pkgdir"/usr/bin/dustforce-dustmod
102
}
103
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |