fortressone-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged non-standard host (mirafiori.com) hosts only the Quake shareware media file 'pak0.pak', which is non-executable game data; the worst case of a swap is limited to asset tampering, not code execution or system compromise.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged non-standard host (mirafiori.com) hosts only the Quake shareware media file 'pak0.pak', which is non-executable game data; the worst case of a swap is limited to asset tampering, not code execution or system compromise.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "pak0.pak::https://www.mirafiori.com/ftp/pub/gaming/pak0.pak"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: peeweep <peeweep at 0x0 dot ee>
    
      2
    
      3pkgname=fortressone-bin
    
      4_pkgname=fortressone
    
      5pkgver=3.1
    
      6pkgrel=1
    
      7pkgdesc="An all in one QuakeWorld Team Fortress package"
    
      8arch=('x86_64')
    
      9url="https://www.fortressone.org"
    
      10license=('GPL')
    
      11depends=('libjpeg-turbo' 'libglvnd' 'libxxf86vm' 'jansson' 'sdl2' 'libpng' 'curl' 'speex')
    
      12makedepends=('git')
    
      13install=fortressone.install
    
      14source=(
    
      15  "linux-installer::git+https://github.com/FortressOne/linux-installer.git"
    
      16
    
      17  # default configuration files
    
      18  "client-configs::git+https://github.com/FortressOne/client-configs.git"
    
      19
    
      20  # FortressOne client
    
      21  "${_pkgname}::https://github.com/FortressOne/ezquake-source/releases/download/v${pkgver}/fortressone-linux-x86_64"
    
      22
    
      23  # FortressOne fragfile.dat
    
      24  "fragfile.dat::https://github.com/FortressOne/ezquake-source/releases/download/v${pkgver}/fragfile.dat"
    
      25
    
      26  # server browser sources
    
      27  "sb.zip::https://github.com/FortressOne/ezquake-source/releases/download/v${pkgver}/sb.zip"
    
      28
    
      29  # FortressOne client media files
    
      30  "${_pkgname}.pk3::https://github.com/FortressOne/ezquake-media/releases/download/v1.0.0/fortressone.pk3"
    
      31
    
      32  # Quake shareware media files
    
      33  "pak0.pak::https://www.mirafiori.com/ftp/pub/gaming/pak0.pak"
    
      34
    
      35  # FortressOne server media files
    
      36  "pak0.pk3::https://github.com/FortressOne/assets/releases/download/1.0.0/pak0.pk3"
    
      37
    
      38  # Update desktop file
    
      39  "fortressone-desktop.patch")
    
      40noextract=('fortressone.pk3' 'pak0.pk3' 'pak0.pak')
    
      41sha256sums=('SKIP'
    
      42            'SKIP'
    
      43            'f2795591ea88b939655fbd2accec48df11cc56ff9b32dc11637c541835c35435'
    
      44            '3272f0771dcdc9af47b7e1fb2a8129ef400cea11b9feab145c26eb765469215c'
    
      45            '75acb892217af91c79ad6af834f457d92c78a7757eaba4f4ca8abb08ba93457c'
    
      46            '0622ff7e5528f472d6bc111d929ef297d3358a8def574a8b669ec4df57428df8'
    
      47            'eec9a020b6d8b6df73a5b911e19985f6e2539c1c6857b4a9f400553b9599677d'
    
      48            'f7fa960e555b5bda48699c08ad32c0a69a3c134f018023194f7db3ec22045495'
    
      49            'aec4d0ed76cc1a48fa96cde712ad23bbe20c5c452f590fd26134f9694315b73b')
    
      50
    
      51prepare() {
    
      52  cd "${srcdir}/linux-installer/bin"
    
      53  patch -p1 <"${srcdir}/fortressone-desktop.patch"
    
      54}
    
      55
    
      56package() {
    
      57  # .desktop
    
      58  install -Dm755 "${srcdir}/linux-installer/bin/fortressone.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      59
    
      60  # icon
    
      61  install -Dm755 "${srcdir}/linux-installer/bin/logo.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      62
    
      63  # FortressOne fragfile.dat
    
      64  install -Dm777 "${srcdir}/fragfile.dat" "${pkgdir}/usr/share/${_pkgname}/fortress/fragfile.dat"
    
      65
    
      66  # FortressOne client
    
      67  install -Dm777 "${srcdir}/fortressone" "${pkgdir}/usr/bin/${_pkgname}"
    
      68
    
      69  # server browser sources
    
      70  cp -r "${srcdir}/sb/" "${pkgdir}/usr/share/${_pkgname}/ezquake"
    
      71
    
      72  # Quake shareware media files
    
      73  install -Dm777 "${srcdir}/pak0.pak" "${pkgdir}/usr/share/${_pkgname}/id1/pak0.pak"
    
      74
    
      75  # FortressOne server media files
    
      76  install -Dm777 "${srcdir}/pak0.pk3" "${pkgdir}/usr/share/${_pkgname}/fortress/pak0.pk3"
    
      77
    
      78  # FortressOne client media files
    
      79  install -Dm777 "${srcdir}/fortressone.pk3" "${pkgdir}/usr/share/${_pkgname}/fortress/fortressone.pk3"
    
      80
    
      81  # default configuration files
    
      82  cp -r "${srcdir}/client-configs"/* "${pkgdir}/usr/share/${_pkgname}"
    
      83}
    
      84
    
      85# vim: ts=2 sw=2 et:
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2