jazzjackrabbit

maintainer gameslayer · 1 votes · scanned 2026-08-03 00:08:14.047287

HIGH

piracy

Why flagged This PKGBUILD downloads a GOG-sourced copy of Jazz Jackrabbit ('Jazz Jackrabbit GOG v1.3 + Orbitus 2 fix.zip') from archive.org during the build process. Jazz Jackrabbit is proprietary commercial software; distributing or automating the download of a GOG copy without a license constitutes piracy. Additionally: (1) the download has no checksum verification (sha256sums=SKIP on the source, and no hash on the wget'd archive), meaning the archive.org file could be silently replaced with malicious content; (2) the cleanup removes .exe files but leaves behind game data files (.jj1, .j2l, etc.) that are proprietary; (3) the wget happens inside prepare() at build time, which is non-standard and bypasses any integrity checking. The piracy concern alone warrants high severity per policy, independent of the supply-chain risk from the unverified binary archive download.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:25 wget "https://archive.org/download/jazzpack/Jazz%20Jackrabbit%20GOG%20v1.3%20%2B%20Orbitus%202%20fix.zip"

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 92%): This PKGBUILD downloads a GOG-sourced copy of Jazz Jackrabbit ('Jazz Jackrabbit GOG v1.3 + Orbitus 2 fix.zip') from archive.org during the build process. Jazz Jackrabbit is proprietary commercial software; distributing or automating the download of a GOG copy without a license constitutes piracy. Additionally: (1) the download has no checksum verification (sha256sums=SKIP on the source, and no hash on the wget'd archive), meaning the archive.org file could be silently replaced with malicious content; (2) the cleanup removes .exe files but leaves behind game data files (.jj1, .j2l, etc.) that are proprietary; (3) the wget happens inside prepare() at build time, which is non-standard and bypasses any integrity checking. The piracy concern alone warrants high severity per policy, independent of the supply-chain risk from the unverified binary archive download.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=jazzjackrabbit
    
      2_pkgname=JazzJackrabbit
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="Jazz Jackrabbit game powered by the openjazz."
    
      6arch=('x86_64' 'aarch64')
    
      7license=('GPL')
    
      8depends=('openjazz-bin' 'wget' 'unzip' 'yad')
    
      9makedepends=('unzip')
    
      10url="https://gitlab.com/jazzproject"
    
      11source=("https://gitlab.com/jazzproject/jazz-jackrabbit/jazz/-/archive/$pkgver/jazz-$pkgver.tar.bz2")
    
      12sha256sums=("SKIP")
    
      13
    
      14prepare() {
    
      15   # Check if Sources folder exists so it doesn't redownload the file when it doesn't need to.
    
      16    FILE="/usr/share/games/$_pkgname/SPRITES.*"
    
      17if [ -f "$FILE" ]; then
    
      18    echo "Game files exists, skipping download."
    
      19    cp -r "/usr/share/games/$_pkgname/*" "$pkgdir/usr/share/games/$_pkgname"
    
      20else
    
      21    echo "Game files do not exist, starting download.."
    
      22    cd "$srcdir/jazz-$pkgver" || { echo "Failed to change directory"; exit 1; }
    
      23   # Deleting any existing downloads
    
      24    rm -rf "Jazz Jackrabbit GOG v1.3 + Orbitus 2 fix.zip"
    
      25    wget "https://archive.org/download/jazzpack/Jazz%20Jackrabbit%20GOG%20v1.3%20%2B%20Orbitus%202%20fix.zip"
    
      26    if [ $? -ne 0 ]; then
    
      27        echo "Download failed"
    
      28        exit 1
    
      29    fi
    
      30       mkdir -p "$srcdir/tmp"
    
      31       unzip -u "Jazz Jackrabbit GOG v1.3 + Orbitus 2 fix.zip" -d "$srcdir/tmp"
    
      32     #Cleanup of uneeded files before packaging
    
      33       rm -rf "$srcdir/tmp/cloud_saves"
    
      34       rm -rf "$srcdir/tmp/DOSBOX"
    
      35       rm -rf "$srcdir/tmp/HH95"
    
      36       rm -rf "$srcdir/tmp/dosbox_*"
    
      37       rm "$srcdir/tmp/webcache.zip"
    
      38       find "$srcdir/tmp" -type f -iname "*unins000.*" -exec rm -- {} +
    
      39       find "$srcdir/tmp" -type f -iname "*.exe" -exec rm -- {} +
    
      40       find "$srcdir/tmp" -type f -iname "*.ico" -exec rm -- {} +
    
      41       find "$srcdir/tmp" -type f -iname "*.lnk" -exec rm -- {} +
    
      42       find "$srcdir/tmp" -type f -iname "*.hashdb" -exec rm -- {} +
    
      43       find "$srcdir/tmp" -type f -iname "*.doc" -exec rm -- {} +
    
      44       find "$srcdir/tmp" -type f -iname "*.unins000" -exec rm -- {} +
    
      45fi    
    
      46}
    
      47package() {
    
      48    install -dm755 "$pkgdir/usr/bin"
    
      49    install -dm775 "$pkgdir/usr/share/games/$_pkgname"
    
      50    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      51    
    
      52    cp -r "$srcdir/jazz-$pkgver/$pkgname" "$pkgdir/usr/bin"
    
      53    cp -r "$srcdir/jazz-$pkgver/$pkgname" "$pkgdir/usr/share/games/$_pkgname/"
    
      54    cp -r "$srcdir/jazz-$pkgver/$pkgname.png" "$pkgdir/usr/share/games/$_pkgname/"
    
      55    cp -r "$srcdir/jazz-$pkgver/$pkgname.png" "$pkgdir/usr/share/pixmaps"
    
      56    cp -r "$srcdir/tmp/." "$pkgdir/usr/share/games/$_pkgname/"
    
      57
    
      58    # Desktop Entry
    
      59    install -Dm644 "$srcdir/jazz-$pkgver/$pkgname.desktop" \
    
      60    "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      61    sed -i s%/usr/share%/opt% "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2