fortressone-bin

LOW

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged non-standard host (mirafiori.com) hosts only the Quake shareware media file 'pak0.pak', which is non-executable game data; the worst case of a swap is limited to asset tampering, not code execution or system compromise.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged non-standard host (mirafiori.com) hosts only the Quake shareware media file 'pak0.pak', which is non-executable game data; the worst case of a swap is limited to asset tampering, not code execution or system compromise.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "pak0.pak::https://www.mirafiori.com/ftp/pub/gaming/pak0.pak"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: peeweep <peeweep at 0x0 dot ee>
    
      2
    
      3pkgname=fortressone-bin
    
      4_pkgname=fortressone
    
      5pkgver=3.1
    
      6pkgrel=1
    
      7pkgdesc="An all in one QuakeWorld Team Fortress package"
    
      8arch=('x86_64')
    
      9url="https://www.fortressone.org"
    
      10license=('GPL')
    
      11depends=('libjpeg-turbo' 'libglvnd' 'libxxf86vm' 'jansson' 'sdl2' 'libpng' 'curl' 'speex')
    
      12makedepends=('git')
    
      13install=fortressone.install
    
      14source=(
    
      15  "linux-installer::git+https://github.com/FortressOne/linux-installer.git"
    
      16
    
      17  # default configuration files
    
      18  "client-configs::git+https://github.com/FortressOne/client-configs.git"
    
      19
    
      20  # FortressOne client
    
      21  "${_pkgname}::https://github.com/FortressOne/ezquake-source/releases/download/v${pkgver}/fortressone-linux-x86_64"
    
      22
    
      23  # FortressOne fragfile.dat
    
      24  "fragfile.dat::https://github.com/FortressOne/ezquake-source/releases/download/v${pkgver}/fragfile.dat"
    
      25
    
      26  # server browser sources
    
      27  "sb.zip::https://github.com/FortressOne/ezquake-source/releases/download/v${pkgver}/sb.zip"
    
      28
    
      29  # FortressOne client media files
    
      30  "${_pkgname}.pk3::https://github.com/FortressOne/ezquake-media/releases/download/v1.0.0/fortressone.pk3"
    
      31
    
      32  # Quake shareware media files
    
      33  "pak0.pak::https://www.mirafiori.com/ftp/pub/gaming/pak0.pak"
    
      34
    
      35  # FortressOne server media files
    
      36  "pak0.pk3::https://github.com/FortressOne/assets/releases/download/1.0.0/pak0.pk3"
    
      37
    
      38  # Update desktop file
    
      39  "fortressone-desktop.patch")
    
      40noextract=('fortressone.pk3' 'pak0.pk3' 'pak0.pak')
    
      41sha256sums=('SKIP'
    
      42            'SKIP'
    
      43            'f2795591ea88b939655fbd2accec48df11cc56ff9b32dc11637c541835c35435'
    
      44            '3272f0771dcdc9af47b7e1fb2a8129ef400cea11b9feab145c26eb765469215c'
    
      45            '75acb892217af91c79ad6af834f457d92c78a7757eaba4f4ca8abb08ba93457c'
    
      46            '0622ff7e5528f472d6bc111d929ef297d3358a8def574a8b669ec4df57428df8'
    
      47            'eec9a020b6d8b6df73a5b911e19985f6e2539c1c6857b4a9f400553b9599677d'
    
      48            'f7fa960e555b5bda48699c08ad32c0a69a3c134f018023194f7db3ec22045495'
    
      49            'aec4d0ed76cc1a48fa96cde712ad23bbe20c5c452f590fd26134f9694315b73b')
    
      50
    
      51prepare() {
    
      52  cd "${srcdir}/linux-installer/bin"
    
      53  patch -p1 <"${srcdir}/fortressone-desktop.patch"
    
      54}
    
      55
    
      56package() {
    
      57  # .desktop
    
      58  install -Dm755 "${srcdir}/linux-installer/bin/fortressone.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      59
    
      60  # icon
    
      61  install -Dm755 "${srcdir}/linux-installer/bin/logo.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      62
    
      63  # FortressOne fragfile.dat
    
      64  install -Dm777 "${srcdir}/fragfile.dat" "${pkgdir}/usr/share/${_pkgname}/fortress/fragfile.dat"
    
      65
    
      66  # FortressOne client
    
      67  install -Dm777 "${srcdir}/fortressone" "${pkgdir}/usr/bin/${_pkgname}"
    
      68
    
      69  # server browser sources
    
      70  cp -r "${srcdir}/sb/" "${pkgdir}/usr/share/${_pkgname}/ezquake"
    
      71
    
      72  # Quake shareware media files
    
      73  install -Dm777 "${srcdir}/pak0.pak" "${pkgdir}/usr/share/${_pkgname}/id1/pak0.pak"
    
      74
    
      75  # FortressOne server media files
    
      76  install -Dm777 "${srcdir}/pak0.pk3" "${pkgdir}/usr/share/${_pkgname}/fortress/pak0.pk3"
    
      77
    
      78  # FortressOne client media files
    
      79  install -Dm777 "${srcdir}/fortressone.pk3" "${pkgdir}/usr/share/${_pkgname}/fortress/fortressone.pk3"
    
      80
    
      81  # default configuration files
    
      82  cp -r "${srcdir}/client-configs"/* "${pkgdir}/usr/share/${_pkgname}"
    
      83}
    
      84
    
      85# vim: ts=2 sw=2 et:
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2