lockjaw

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a source tarball hosted on a non-standard domain, but the source is verified via matching checksums and contains only buildable code and non-executable assets; no remote code execution or malicious payloads are present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a source tarball hosted on a non-standard domain, but the source is verified via matching checksums and contains only buildable code and non-executable assets; no remote code execution or malicious payloads are present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://sites.google.com/site/xaelous/40l/lj${pkgver}-src.zip" \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Peter Tseng <pht24 weird-squiggly-symbol cornell dot edu>
    
      2# Contributor: Matthew Gamble <git@matthewgamble.net>
    
      3
    
      4pkgname=lockjaw
    
      5pkgver=046
    
      6pkgrel=7
    
      7pkgdesc="Free and highly customizable implementation of Tetris"
    
      8arch=('i686' 'x86_64')
    
      9url="https://www.pineight.com/lj"
    
      10license=('GPL')
    
      11depends=('allegro4')
    
      12
    
      13# WARNING!!! This is not the original URL of the Lockjaw source code!
    
      14# The original website has removed its copy of the Lockjaw, so I was forced to use alternative means.
    
      15# I can make no personal guarantees as to the integrity of the file.
    
      16# I did however verify that the sha256sum matches the copy I have before it was taken down.
    
      17# That sha256sum is the one listed in this PKGBUILD.
    
      18# I also did verify that diff -ru on the extracted contents showed no changes.
    
      19# Unfortunately I realize that these claims aren't really verifiable by an outside party,
    
      20# at least without access to the original sources.
    
      21# Alas, this is the best I am able to offer you for the time being...
    
      22source=("https://sites.google.com/site/xaelous/40l/lj${pkgver}-src.zip" \
    
      23lj.dat \
    
      24sound.dat \
    
      25ljbg.jpg \
    
      26ljblocks-sega.bmp \
    
      27ljblocks.bmp \
    
      28ljconn-sega.bmp \
    
      29ljconn.bmp \
    
      30bgm.s3m \
    
      31bgm-rhythm.s3m \
    
      32lockjaw.desktop \
    
      33lockjaw.sh \
    
      34lockjaw.xpm \
    
      35)
    
      36
    
      37sha256sums=('376519ad8ee97bfc19d79218b57abfb7fab96789c29999fa387ff7801619d4d9'
    
      38            '8924e28dbaa56e0a29dae93a23a0ef91e418c93a6c1d791c59a79274be787f36'
    
      39            '4d8acec9cf9f167637d5487272649a0097787c3c5e1afe6e2886903b0260988e'
    
      40            '26adf0eb8013aa4649049ec6160cff243ac9fcebc315ada2d25dac6327103018'
    
      41            '84ffb7c54ac80f004473a1ced5a898944df468cff07d909ad0bf7f20d824ad19'
    
      42            '57dec1eff3977b6c1365ba89d0a6e3a287704d9099470f11b1eaa109f13fa8b3'
    
      43            '5591cf53754b9b87302f6b7a45f6816feb7fc8266754483e65b7a7dbdb309b0d'
    
      44            '995384c53a310da5dbf1119c84d58fcb246ebf16097b13a5fd6c2db7c57b45e8'
    
      45            'f8c75d414530c169cedf766987c30dab42665967c0b1909422e32dfceab04045'
    
      46            '855ffd1bad6c421c2df41ddf1be86bea9155ea6639ebd35695c9eecc3b42ddb1'
    
      47            '33fb49f9fbd1cbd2fda900194a12f7e4ca6adce34236a5e8aba84654d290e869'
    
      48            'a41fdf4443a752e89534e239368da1c57ea50ebb677c1fd59d3c6829cb7b7ff4'
    
      49            'c2617585eb1d6f92c8ddf834b6a896fabb8eee85173f1ac8bea6c966ccee83ca')
    
      50
    
      51build() {
    
      52    cd "${srcdir}"
    
      53    # Allegro gives us jpgalleg now... but the name in the makefile is wrong!
    
      54    sed -i "s/jpgal/jpgalleg/" makefile
    
      55    # It appears aldumb.h doesn't exist anymore, so we'll just not use it.
    
      56    sed -i "s/-laldmb//" makefile
    
      57    sed -i "s/-ldumb//" makefile
    
      58    sed -i "s/LJMUSIC_USING_DUMB 1/LJMUSIC_USING_DUMB 0/" src/ljmusic.h
    
      59    # -mwindows most definitely not supported by gcc and not what we want.
    
      60    sed -i "s/-mwindows//" makefile
    
      61    # In addition, I need an -lm otherwise cos is undefined
    
      62    sed -i "s/LINUXLDLIBS :=/LINUXLDLIBS := -lm/" makefile
    
      63    make linux
    
      64}
    
      65
    
      66package() {
    
      67    cd "${srcdir}"
    
      68    # Unfortunately, makefile doesn't have make install, so...
    
      69    mkdir -m 755 -p "${pkgdir}/opt/lockjaw"
    
      70
    
      71    # Copy all this stuff over.
    
      72    install -D -m644 *.dat *.bmp *.jpg bgm* README.html "${pkgdir}/opt/lockjaw"
    
      73    install -D -m755 lj "${pkgdir}/opt/lockjaw"
    
      74    mkdir "${pkgdir}/opt/lockjaw/docs"
    
      75    install -m644 docs/* "${pkgdir}/opt/lockjaw/docs"
    
      76    touch "${pkgdir}/opt/lockjaw/installed.ini"
    
      77
    
      78    # Install desktop, launcher sh script.
    
      79    install -D -m755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      80    install -D -m644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      81    install -D -m644 "${pkgname}.xpm" "${pkgdir}/usr/share/pixmaps/${pkgname}.xpm"
    
      82}
    
      83

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2