hyrule-conquest

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a game mod (data/assets for 0ad) hosted on Dropbox, verified by an md5sum. The content is a mod archive installed as read-only data files under /usr/share/0ad/data/mods — no binaries are executed, no scripts are run from the archive, and no code is compiled. Dropbox is an unofficial host and the md5sum is weak (not sha256), but the mod is pure game data (maps, scripts, assets) for a well-known open-source game engine. The supply-chain concern is real but low-impact: even if the archive were tampered with, the worst realistic outcome is corrupted game data or malicious JavaScript-like scripts interpreted by 0ad's SpiderMonkey engine — a non-trivial but limited attack surface. This is sloppy packaging (weak checksum, personal cloud host) but not a clear medium-severity supply-chain threat involving executed native binaries or libraries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): The source is a game mod (data/assets for 0ad) hosted on Dropbox, verified by an md5sum. The content is a mod archive installed as read-only data files under /usr/share/0ad/data/mods — no binaries are executed, no scripts are run from the archive, and no code is compiled. Dropbox is an unofficial host and the md5sum is weak (not sha256), but the mod is pure game data (maps, scripts, assets) for a well-known open-source game engine. The supply-chain concern is real but low-impact: even if the archive were tampered with, the worst realistic outcome is corrupted game data or malicious JavaScript-like scripts interpreted by 0ad's SpiderMonkey engine — a non-trivial but limited attack surface. This is sloppy packaging (weak checksum, personal cloud host) but not a clear medium-severity supply-chain threat involving executed native binaries or libraries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=('https://www.dropbox.com/s/c3pzx72sarj0hog/hyrule0.8.tar.xz?dl=0')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ryan Jeffrey <ryan@ryanmj.xyz>
    
      2# aka Mallock
    
      3pkgname=hyrule-conquest
    
      4pkgver=0.8
    
      5pkgrel=3
    
      6pkgdesc="Hyrule Conquest. Mod for 0ad created by Chasen Lindsey (aka Undying Nephalim)."
    
      7arch=(x86_64)
    
      8url="https://www.moddb.com/mods/hyrule-conquest"
    
      9license=('unknown')
    
      10depends=('0ad')
    
      11makedepends=('xz' 'curl')
    
      12source=('https://www.dropbox.com/s/c3pzx72sarj0hog/hyrule0.8.tar.xz?dl=0')
    
      13md5sums=('02513578a96276fc9394a7a756c2d282')
    
      14noextract=('hyrule0.8.tar.xz?dl=0')
    
      15
    
      16options=(!strip)
    
      17
    
      18build() {
    
      19    mv 'hyrule0.8.tar.xz?dl=0' hyrule0.8.tar.xz
    
      20    tar -xvf hyrule0.8.tar.xz
    
      21}
    
      22
    
      23package() {
    
      24    install -d -m755 $pkgdir/usr/share/0ad/data/mods
    
      25    cp -r hc $pkgdir/usr/share/0ad/data/mods/$pkgname
    
      26    find $pkgdir/usr/share/0ad/data/mods/$pkgname -type d -exec chmod 755 "{}" \;
    
      27    find $pkgdir/usr/share/0ad/data/mods/$pkgname -type f -exec chmod 644 "{}" \;
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2