jazzjackrabbit2

maintainer gameslayer · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD performs a runtime wget download of 'Jazz2-source.zip' from archive.org inside the package() function, outside of the source=() array. This means the file has no integrity check (no sha256sum verification), and archive.org is a mutable, community-editable host where content can be replaced. The downloaded ZIP is directly unzipped into the package installation directory, meaning any tampered or malicious content in that archive would be installed onto the user's system. Additionally, sha256sums=('SKIP') for the main source is sloppy. The wget/unzip of game data files from an unofficial archive host without integrity verification is a genuine supply-chain concern — not clearly malicious, but a real medium-severity risk. The package also lists 'wget', 'unzip', and 'yad' as runtime depends, suggesting the wrapper script may also perform downloads at runtime, compounding the concern.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:30 wget "https://archive.org/download/jazz-2-source/Jazz2-source.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD performs a runtime wget download of 'Jazz2-source.zip' from archive.org inside the package() function, outside of the source=() array. This means the file has no integrity check (no sha256sum verification), and archive.org is a mutable, community-editable host where content can be replaced. The downloaded ZIP is directly unzipped into the package installation directory, meaning any tampered or malicious content in that archive would be installed onto the user's system. Additionally, sha256sums=('SKIP') for the main source is sloppy. The wget/unzip of game data files from an unofficial archive host without integrity verification is a genuine supply-chain concern — not clearly malicious, but a real medium-severity risk. The package also lists 'wget', 'unzip', and 'yad' as runtime depends, suggesting the wrapper script may also perform downloads at runtime, compounding the concern.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=jazzjackrabbit2
    
      2_pkgname=JazzJackrabbit2
    
      3pkgver=1.0.3
    
      4pkgrel=1
    
      5pkgdesc="Jazz Jackrabbit 2 game powered by the jazz2."
    
      6arch=('x86_64' 'aarch64')
    
      7license=('GPL')
    
      8depends=('jazz2-native-bin' 'wget' 'unzip' 'yad')
    
      9makedepends=('unzip')
    
      10url="https://gitlab.com/jazzproject"
    
      11source=("https://gitlab.com/jazzproject/jazzjackrabbit2/jazz2/-/archive/$pkgver/jazz2-$pkgver.tar.bz2")
    
      12sha256sums=("SKIP")
    
      13
    
      14package() {
    
      15    install -dm755 "$pkgdir/usr/bin"
    
      16    install -dm775 "$pkgdir/usr/share/games/$_pkgname"
    
      17    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      18
    
      19    # Packaging files
    
      20    # Check if Sources folder exists so it doesn't redownload the file when it doesn't need to.
    
      21    DIR="/usr/share/games/$_pkgname/Source"
    
      22if [ -d "$DIR" ]; then
    
      23    echo "$DIR exists, skipping download."
    
      24    cp -r "/usr/share/games/$_pkgname/Source" "$pkgdir/usr/share/games/$_pkgname"
    
      25else
    
      26    echo "$DIR does not exist, starting download.."
    
      27    cd "$srcdir/jazz2-$pkgver" || { echo "Failed to change directory"; exit 1; }
    
      28    # Deleting any existing downloads
    
      29    rm -rf Jazz2-source.zip
    
      30    wget "https://archive.org/download/jazz-2-source/Jazz2-source.zip"
    
      31    if [ $? -ne 0 ]; then
    
      32        echo "Download failed"
    
      33        exit 1
    
      34    fi
    
      35       unzip Jazz2-source.zip -d "$pkgdir/usr/share/games/$_pkgname"
    
      36fi    
    
      37    cp "$srcdir/jazz2-$pkgver/$pkgname" "$pkgdir/usr/bin"
    
      38    
    
      39    cp -r "$srcdir/jazz2-$pkgver/$pkgname" "$pkgdir/usr/share/games/$_pkgname/"
    
      40    cp -r "$srcdir/jazz2-$pkgver/$pkgname.png" "$pkgdir/usr/share/games/$_pkgname/"
    
      41    cp "$srcdir/jazz2-$pkgver/$pkgname.png" "$pkgdir/usr/share/pixmaps"
    
      42
    
      43    # Desktop Entry
    
      44    install -Dm644 "$srcdir/jazz2-$pkgver/$pkgname.desktop" \
    
      45    "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      46    sed -i s%/usr/share%/opt% "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2