ioquake3-git

maintainer Slash · 82 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a Quake 3 patch file from a non-whitelisted but well-known academic mirror (ftp.gwdg.de), which is used to extract official .pk3 data files; these are game assets, not executable code, and the build uses the project's own source from GitHub, making the risk low despite the unverifiable origin of the patch.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Quake 3 patch file from a non-whitelisted but well-known academic mirror (ftp.gwdg.de), which is used to extract official .pk3 data files; these are game assets, not executable code, and the build uses the project's own source from GitHub, making the risk low despite the unverifiable origin of the patch.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 'http://ftp.gwdg.de/pub/misc/ftp.idsoftware.com/idstuff/quake3/linux/linuxq3apoint-1.32b-3.x86.run'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Slash <demodevil5[at]yahoo[dot]com>
    
      2# Contributors: OttoA (AUR), hoschi (AUR), samlt (AUR), andreyv (AUR)
    
      3
    
      4pkgname=ioquake3-git
    
      5pkgver=20251007.ged080d3a
    
      6pkgrel=1
    
      7pkgdesc="The de-facto OSS Quake 3 distribution. You need the retail/demo .pk3 files to play."
    
      8url="http://ioquake3.org/"
    
      9license=('GPL-2.0-only')
    
      10arch=('i686' 'x86_64' 'aarch64')
    
      11depends=('curl' 'freetype2' 'libjpeg' 'libvorbis' 'openal' 'opus' 'opusfile' 'sdl2' 'zlib')
    
      12makedepends=('git' 'cmake')
    
      13optdepends=('mumble: Mumble VoIP support')
    
      14conflicts=('quake3' 'quake3-icculus-svn' 'quake3-svn' 'ioquake3-svn')
    
      15provides=('quake3' 'ioquake3')
    
      16replaces=('quake3-icculus-svn' 'ioquake3-svn')
    
      17install=quake3.install
    
      18source=('quake3.desktop' 'quake3.png' 'ioquake3.launcher' 'ioq3ded.launcher'
    
      19'http://ftp.gwdg.de/pub/misc/ftp.idsoftware.com/idstuff/quake3/linux/linuxq3apoint-1.32b-3.x86.run'
    
      20'quake3::git+https://github.com/ioquake/ioq3.git')
    
      21b2sums=('0b8618375af8f47654660577f9cb4d4ca88ba4c8dedf42fd96c9e0b030cfcf8a03a66f8923c5584d5e3ba61682c727fa6a2a174f530f7388bd5c44a337b91d3a'
    
      22        'dac1ebad61fd1eec809fcc397fda9cbb9effed9e646d37435e6b3b23249f8dd9f09488e1323cf307da22786be618464ffd087d1aff100b2c09d9cdecbbd5de14'
    
      23        'cf7e648261b8afbd822c0d1e868cf96ab002e121f0df91c962e34a183333cc4b65890050a9edb206ffc23bff597a451cdc3a216e39e6795618f425cd853d0cc2'
    
      24        'a435f6b72d55f969e0ca4997e2fe0219347acf70229d9776ec4bb1625a637bed43dff1b5382449b862d669c82558d9d20468fc95900141e9777a3936a2654536'
    
      25        '79585534d930a466af58cd34acaac7b9d95da2ad665525b7f7d9ad2e05f3efe5f94b7958b5adca8dd8f687b37d82323a76a701af4bd2cf6011df1e4cc59f4ca9'
    
      26        'SKIP')
    
      27
    
      28pkgver() {
    
      29    cd "${srcdir}/quake3"
    
      30
    
      31    git log -1 --format="%cd.g%h" --date=short | sed 's/-//g'
    
      32}
    
      33
    
      34prepare() {
    
      35    cd "${srcdir}"
    
      36
    
      37    # Make latest quake3 patch executable
    
      38    chmod +x "${srcdir}/linuxq3apoint-1.32b-3.x86.run"
    
      39
    
      40    # Extract Patch Files
    
      41    "${srcdir}/linuxq3apoint-1.32b-3.x86.run" --tar xf
    
      42}
    
      43
    
      44build() {
    
      45    cd "${srcdir}/quake3"
    
      46
    
      47    # Configure
    
      48    cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
    
      49        -DBUILD_SERVER=ON           \
    
      50        -DBUILD_CLIENT=ON           \
    
      51        -DBUILD_RENDERER_GL1=ON     \
    
      52        -DBUILD_RENDERER_GL2=ON     \
    
      53        -DBUILD_GAME_LIBRARIES=OFF  \
    
      54        -DBUILD_GAME_QVMS=OFF       \
    
      55        -DBUILD_STANDALONE=OFF      \
    
      56        -DUSE_ARCHLESS_FILENAMES=ON \
    
      57        -DUSE_RENDERER_DLOPEN=ON    \
    
      58        -DUSE_OPENAL=ON             \
    
      59        -DUSE_OPENAL_DLOPEN=OFF     \
    
      60        -DUSE_HTTP=ON               \
    
      61        -DUSE_CODEC_VORBIS=ON       \
    
      62        -DUSE_CODEC_OPUS=ON         \
    
      63        -DUSE_VOIP=ON               \
    
      64        -DUSE_MUMBLE=ON             \
    
      65        -DUSE_FREETYPE=ON           \
    
      66        -DUSE_INTERNAL_LIBS=OFF     \
    
      67        -DCMAKE_INSTALL_PREFIX=/opt/quake3 \
    
      68        -DCMAKE_C_FLAGS_RELEASE="${CFLAGS}"
    
      69
    
      70    # Build
    
      71    cmake --build build
    
      72}
    
      73
    
      74package() {
    
      75    cd "${srcdir}/quake3"
    
      76
    
      77    # Create Destination Directories
    
      78    install -d "${pkgdir}"/{usr/bin,/opt/quake3/{baseq3,missionpack,demoq3}}
    
      79
    
      80    # Install Compiled Files
    
      81    cmake --install build --prefix "${pkgdir}/opt/quake3"
    
      82
    
      83    # Install Quake 3 Patch Files
    
      84    install -m 644 "${srcdir}"/baseq3/*.pk3 \
    
      85        "${pkgdir}/opt/quake3/baseq3/"
    
      86
    
      87    # Install Quake 3 Expansion Pack Patch Files
    
      88    install -m 644 "${srcdir}"/missionpack/*.pk3 \
    
      89        "${pkgdir}/opt/quake3/missionpack/"
    
      90
    
      91    # Link pk3 files to demoq3
    
      92    ln -sf /opt/quake3/baseq3/pak{1..8}.pk3 "${pkgdir}/opt/quake3/demoq3/"
    
      93
    
      94    # Install Launcher (Client)
    
      95    install -D -m 755 "${srcdir}/ioquake3.launcher" \
    
      96        "${pkgdir}/usr/bin/ioquake3"
    
      97
    
      98    # Install Launcher (Server)
    
      99    install -D -m 755 "${srcdir}/ioq3ded.launcher" \
    
      100        "${pkgdir}/usr/bin/ioq3ded"
    
      101
    
      102    # Create symlink aliases in /usr/bin
    
      103    ln -sf "/usr/bin/ioquake3" "${pkgdir}/usr/bin/quake3"
    
      104    ln -sf "/usr/bin/ioq3ded"  "${pkgdir}/usr/bin/q3ded"
    
      105
    
      106    # Install systemd service file
    
      107    install -D -m 644 "${srcdir}/quake3/misc/linux/q3a.service" \
    
      108        "${pkgdir}/usr/lib/systemd/system/q3a.service"
    
      109
    
      110    # Patch systemd service file
    
      111    sed -i -e "s@/usr/local/games/quake3/ioq3ded.x86_64@/opt/quake3/ioq3ded@" \
    
      112        "${pkgdir}/usr/lib/systemd/system/q3a.service"
    
      113
    
      114    # Install Desktop File
    
      115    install -D -m 644 "${srcdir}/quake3.desktop" \
    
      116        "${pkgdir}/usr/share/applications/quake3.desktop"
    
      117
    
      118    # Install Icon File
    
      119    install -D -m 644 "${srcdir}/quake3.png" \
    
      120        "${pkgdir}/usr/share/pixmaps/quake3.png"
    
      121}
    
      122

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2