dwarffortress-phoebus

maintainer orphaned · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the official Dwarf Fortress binary and Phoebus tileset from their respective project-owned hosts (GitHub and bay12games.com); both sources are legitimate and expected for this package, with no code execution or supply-chain risks beyond standard AUR builds.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official Dwarf Fortress binary and Phoebus tileset from their respective project-owned hosts (GitHub and bay12games.com); both sources are legitimate and expected for this package, with no code execution or supply-chain risks beyond standard AUR builds.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "http://bay12games.com/dwarves/df_${_dfver}_linux.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Matthew Muresan  <matt_muresan [AT] hotmail [DOT] com>
    
      2# Former Maintainer: bidet <b [AT] t>
    
      3# Former Maintainer: ian kremlin <ian [AT] kremlin [DOT] cc>
    
      4# Former Maintainer: Dennis Hamester <dennis.hamester [AT] gmail [DOT] com>
    
      5
    
      6pkgname=dwarffortress-phoebus
    
      7pkgver=0.47.04
    
      8_dfver=47_04
    
      9_phver=47.04a
    
      10
    
      11# rewrite by kremlin, july 8th 2014
    
      12# with help from halosghost
    
      13pkgrel=18
    
      14epoch=1
    
      15
    
      16pkgdesc='Dwarf Fortress preloaded with Phoebus tileset'
    
      17
    
      18arch=('x86_64')
    
      19url='http://www.bay12games.com/dwarves/'
    
      20license=('custom:dwarffortress_phoebus')
    
      21groups=('games')
    
      22depends=('gcc-libs' 'glew' 'glib2' 'glu' 'gtk2' 'libsndfile' 'openal' 'sdl_image' 'sdl_ttf')
    
      23
    
      24source=("https://github.com/DFgraphics/Phoebus/archive/${_phver}.zip"
    
      25		"http://bay12games.com/dwarves/df_${_dfver}_linux.tar.bz2"
    
      26		'dwarf-fortress'
    
      27		'LICENSE')
    
      28
    
      29md5sums=('e3d2a6f4b0303106e927d05fefe09442'
    
      30'201944f2cc16fd4a8202e8bb55dda0c2'
    
      31'915f9b8efc7e2ea9e233bc6a9606038e'
    
      32'eddfb4bd478f9c64e6801bda7c7791ba'
    
      33)
    
      34
    
      35prepare() {
    
      36	
    
      37	# inject DF with phoebus' tilesets
    
      38	cp -arf "$srcdir"/Phoebus-${_phver}/raw/graphics/* "$srcdir"/df_linux/raw/graphics/
    
      39	cp -arf "$srcdir"/Phoebus-${_phver}/raw/objects/* "$srcdir"/df_linux/raw/objects/
    
      40
    
      41	cp -arf --no-preserve=ownership "$srcdir"/Phoebus-${_phver}/data/art/* "$srcdir"/df_linux/data/art/
    
      42	cp -arf --no-preserve=ownership "$srcdir"/Phoebus-${_phver}/data/init/* "$srcdir"/df_linux/data/init/
    
      43	#remove libstc++ as per http://www.bay12games.com/dwarves/mantisbt/view.php?id=9893
    
      44	rm "$srcdir"/df_linux/libs/'libstdc++.so.6'
    
      45	chmod -R a+rx "$srcdir"/df_linux/libs/Dwarf_Fortress
    
      46	chmod -R a+rx "$srcdir"/df_linux/data/*
    
      47	chmod -R a+rx "$srcdir"/df_linux/raw/*
    
      48	chmod -R a+rx "$srcdir"/df_linux/g_src/*
    
      49
    
      50	chmod a+rx "$srcdir"/df_linux/*
    
      51	chmod a+r "$srcdir"/df_linux/sdl/sdl\ license.txt
    
      52}
    
      53package() {
    
      54
    
      55	install -d "$pkgdir"/usr/lib32/"$pkgname"
    
      56   	install -m644 "$srcdir"/df_linux/libs/libgraphics.so "$pkgdir"/usr/lib32/"$pkgname"/libgraphics.so
    
      57	install -D -m755 "$srcdir"/dwarf-fortress "$pkgdir"/usr/bin/dwarf-fortress
    
      58	install -D -m644 "$srcdir"/LICENSE "$pkgdir"/usr/share/licenses/"$pkgname"/LICENSE
    
      59
    
      60	cp -a --no-preserve=ownership "$srcdir"/df_linux/* "$pkgdir"/usr/lib32/"$pkgname"/
    
      61	mkdir -p "$pkgdir"/usr/lib32/"$pkgname"/data/save/current/
    
      62
    
      63	chmod a+rw "$pkgdir"/usr/lib32/"$pkgname"/data/save/
    
      64	chmod a+rw "$pkgdir"/usr/lib32/"$pkgname"/data/save/current # save dir is worldwrite
    
      65	chmod a+w "$pkgdir"/usr/lib32/"$pkgname"/data/index # crashes otherwise
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2