dwarffortress-spacefox

LOW

maintainer Levitating 12 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads the Spacefox tileset from GitHub, a common and generally trusted source for project assets; the tileset is non-executable data, so even if the host were compromised, the risk is limited to visual or data tampering, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the Spacefox tileset from GitHub, a common and generally trusted source for project assets; the tileset is non-executable data, so even if the host were compromised, the risk is limited to visual or data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:45 https://www.bay12games.com/dwarves/df_${_pkgver}_linux.tar.bz2

PKGBUILD

1 offending line(s) highlighted

      1# New Maintainer: Rein Fernhout <me at levitati.ng>
    
      2# Maintainer: Felix Golatofski <contact@xdfr.de>
    
      3# Contributor: Lukas Winkler <derwinlu+aur at gmail . com>
    
      4# Modified from aur package dwarffortress-ironhand 
    
      5# Contributor: Chris Waddell <christopher at cwaddell . com >
    
      6# Contributor: Christoph Hoopmann <choopm at 0pointer.org>
    
      7# Contributor: Klaas Boesche <aurkagebe _at_ googlemail.com>
    
      8# Modified from aur package dwarffortress-mayday by
    
      9# Contributor: Patrick Chilton <chpatrick _at_ gmail _dot_ com>
    
      10# Original from community by
    
      11# Contributor: Sven-Hendrik Haase <sh@lutzhaase.com>
    
      12# Contributor: Daenyth <Daenyth+Arch [AT] gmail [DOT] com>
    
      13# Contributor: djnm <nmihalich [at} gmail dott com>
    
      14
    
      15pkgname=dwarffortress-spacefox
    
      16pkgver=0.47.05
    
      17_pkgver=47_05
    
      18_sfver=47.05
    
      19pkgrel=1
    
      20pkgdesc="A single-player fantasy game. You control a dwarven outpost or an adventurer in a randomly generated persistent world. Packed with Spacefox's tileset and graphics pack.  Does not replace other dwarffortress packages."
    
      21arch=(i686 x86_64)
    
      22url="http://www.bay12forums.com/smf/index.php?topic=129219.0"
    
      23install="dwarffortress-sf.install"
    
      24license=('custom:dwarffortress-sf')
    
      25makedepends=(unrar unzip git cmake)
    
      26depends_i686=(glew glu gtk2 libsndfile libxdamage ncurses openal sdl_image sdl_ttf zlib)
    
      27depends_x86_64=(lib32-glew lib32-glu lib32-gtk2 lib32-libsndfile lib32-libxdamage lib32-ncurses lib32-openal lib32-sdl_image lib32-sdl_ttf lib32-zlib)
    
      28optdepends=('nvidia-utils: If you have nvidia graphics'
    
      29            'catalyst-utils: If you have ATI graphics'
    
      30            'alsa-lib: for alsa sound'
    
      31            'libpulse: for pulse sound')
    
      32if test "$CARCH" == "x86_64"; then
    
      33    optdepends=('lib32-nvidia-utils: If you have nvidia graphics'
    
      34                'lib32-catalyst-utils: If you have ATI graphics'
    
      35                'lib32-alsa-lib: for alsa sound'
    
      36                'lib32-libpulse: for pulse sound')
    
      37fi
    
      38
    
      39backup=(opt/$pkgname/data/init/colors.txt
    
      40        opt/$pkgname/data/init/init.txt
    
      41        opt/$pkgname/data/init/d_init.txt
    
      42        opt/$pkgname/data/init/interface.txt)
    
      43
    
      44source=(git+https://github.com/svenstaro/dwarf_fortress_unfuck.git#tag=${pkgver}
    
      45		https://www.bay12games.com/dwarves/df_${_pkgver}_linux.tar.bz2
    
      46		spacefox_${_pkgver}.zip::https://github.com/DFgraphics/Spacefox/archive/${_sfver}.zip
    
      47        dwarffortress-sf
    
      48        dwarffortress-sf.desktop
    
      49        dwarffortress-sf.png
    
      50        LICENSE-sf)
    
      51
    
      52sha256sums=(
    
      53            '1b80b0f76ed2268957b16f4046fa665f0a194d96932fd8d285da829e5a585c25'
    
      54            'ac74a6dbb7d7d9621f430405080322ab50c35f6632352ff2ea923f6dc5affca3'
    
      55            'e9608bdf9d47dbcf42567c57430a110f19ac5040fc55b87d47b927a0c3f24f5d'
    
      56            'a2ffa10c38bbd611d3ef72a8ebc7b0dda202786293168c40b7befbbab39a394b'
    
      57            '21fe09beb0fce25562cca51257998fded7c36588fcbac3e5c8c4f87075cbe6fd'
    
      58            '83183abc70b11944720b0d86f4efd07468f786b03fa52fe429ca8e371f708e0f'
    
      59            '769a5f6a7587a1fd1982beec159ad26d8ff6bf28e5e06747458dd71b5e3fbfc8')
    
      60
    
      61build() {
    
      62  cd dwarf_fortress_unfuck
    
      63  cmake .
    
      64  make
    
      65}
    
      66
    
      67package() {
    
      68  install -dm755 "$pkgdir"/opt/
    
      69  cp -r "$srcdir"/df_linux "$pkgdir"/opt/$pkgname
    
      70  rm -r "$pkgdir"/opt/$pkgname/df "$pkgdir"/opt/$pkgname/libs/* "$pkgdir"/opt/$pkgname/g_src
    
      71
    
      72  find "$pkgdir"/opt/$pkgname -type d -exec chmod 755 {} +
    
      73  find "$pkgdir"/opt/$pkgname -type f -exec chmod 644 {} +
    
      74
    
      75  install -Dm755 "$srcdir"/df_linux/libs/Dwarf_Fortress "$pkgdir"/opt/$pkgname/libs/Dwarf_Fortress
    
      76  install -Dm755 "$srcdir"/dwarf_fortress_unfuck/libgraphics.so "$pkgdir"/opt/$pkgname/libs/libgraphics.so
    
      77  install -Dm755 "$srcdir"/dwarffortress-sf "$pkgdir"/usr/bin/$pkgname
    
      78
    
      79  # cp tileset
    
      80  cp -rf $srcdir/Spacefox-${_sfver}/* $pkgdir/opt/$pkgname/
    
      81
    
      82  # No idea why we need this. Really. This isn't being loaded dynamically, it's not linked and
    
      83  # in general there is no indication this is being used. However, it doesn't work without this symlink.
    
      84  ln -s /usr/lib/libpng.so "$pkgdir"/opt/$pkgname/libs/libpng.so.3
    
      85
    
      86  # Set pkgname in runscript
    
      87  sed -i "s/^pkgname=.*/pkgname=$pkgname/" "$pkgdir"/usr/bin/$pkgname
    
      88
    
      89  # Desktop launcher with icon
    
      90  install -Dm644 "$srcdir"/dwarffortress-sf.desktop "$pkgdir"/usr/share/applications/"$pkgname".desktop
    
      91  install -Dm644 "$srcdir"/dwarffortress-sf.png     "$pkgdir"/usr/share/pixmaps/"$pkgname".png
    
      92
    
      93  install -Dm644 "$srcdir"/df_linux/readme.txt "$pkgdir"/usr/share/licenses/$pkgname/readme.txt
    
      94}
    
      95
    
      96# vim:set ts=2 sw=2 et:
    
      97

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2