lockjaw
LOW
maintainer orphaned
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from a source tarball hosted on a non-standard domain, but the source is verified via matching checksums and contains only buildable code and non-executable assets; no remote code execution or malicious payloads are present.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a source tarball hosted on a non-standard domain, but the source is verified via matching checksums and contains only buildable code and non-executable assets; no remote code execution or malicious payloads are present.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
source=("https://sites.google.com/site/xaelous/40l/lj${pkgver}-src.zip" \
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Peter Tseng <pht24 weird-squiggly-symbol cornell dot edu>
2
# Contributor: Matthew Gamble <git@matthewgamble.net>
3
4
pkgname=lockjaw
5
pkgver=046
6
pkgrel=7
7
pkgdesc="Free and highly customizable implementation of Tetris"
8
arch=('i686' 'x86_64')
9
url="https://www.pineight.com/lj"
10
license=('GPL')
11
depends=('allegro4')
12
13
# WARNING!!! This is not the original URL of the Lockjaw source code!
14
# The original website has removed its copy of the Lockjaw, so I was forced to use alternative means.
15
# I can make no personal guarantees as to the integrity of the file.
16
# I did however verify that the sha256sum matches the copy I have before it was taken down.
17
# That sha256sum is the one listed in this PKGBUILD.
18
# I also did verify that diff -ru on the extracted contents showed no changes.
19
# Unfortunately I realize that these claims aren't really verifiable by an outside party,
20
# at least without access to the original sources.
21
# Alas, this is the best I am able to offer you for the time being...
22
source=("https://sites.google.com/site/xaelous/40l/lj${pkgver}-src.zip" \
23
lj.dat \
24
sound.dat \
25
ljbg.jpg \
26
ljblocks-sega.bmp \
27
ljblocks.bmp \
28
ljconn-sega.bmp \
29
ljconn.bmp \
30
bgm.s3m \
31
bgm-rhythm.s3m \
32
lockjaw.desktop \
33
lockjaw.sh \
34
lockjaw.xpm \
35
)
36
37
sha256sums=('376519ad8ee97bfc19d79218b57abfb7fab96789c29999fa387ff7801619d4d9'
38
'8924e28dbaa56e0a29dae93a23a0ef91e418c93a6c1d791c59a79274be787f36'
39
'4d8acec9cf9f167637d5487272649a0097787c3c5e1afe6e2886903b0260988e'
40
'26adf0eb8013aa4649049ec6160cff243ac9fcebc315ada2d25dac6327103018'
41
'84ffb7c54ac80f004473a1ced5a898944df468cff07d909ad0bf7f20d824ad19'
42
'57dec1eff3977b6c1365ba89d0a6e3a287704d9099470f11b1eaa109f13fa8b3'
43
'5591cf53754b9b87302f6b7a45f6816feb7fc8266754483e65b7a7dbdb309b0d'
44
'995384c53a310da5dbf1119c84d58fcb246ebf16097b13a5fd6c2db7c57b45e8'
45
'f8c75d414530c169cedf766987c30dab42665967c0b1909422e32dfceab04045'
46
'855ffd1bad6c421c2df41ddf1be86bea9155ea6639ebd35695c9eecc3b42ddb1'
47
'33fb49f9fbd1cbd2fda900194a12f7e4ca6adce34236a5e8aba84654d290e869'
48
'a41fdf4443a752e89534e239368da1c57ea50ebb677c1fd59d3c6829cb7b7ff4'
49
'c2617585eb1d6f92c8ddf834b6a896fabb8eee85173f1ac8bea6c966ccee83ca')
50
51
build() {
52
cd "${srcdir}"
53
# Allegro gives us jpgalleg now... but the name in the makefile is wrong!
54
sed -i "s/jpgal/jpgalleg/" makefile
55
# It appears aldumb.h doesn't exist anymore, so we'll just not use it.
56
sed -i "s/-laldmb//" makefile
57
sed -i "s/-ldumb//" makefile
58
sed -i "s/LJMUSIC_USING_DUMB 1/LJMUSIC_USING_DUMB 0/" src/ljmusic.h
59
# -mwindows most definitely not supported by gcc and not what we want.
60
sed -i "s/-mwindows//" makefile
61
# In addition, I need an -lm otherwise cos is undefined
62
sed -i "s/LINUXLDLIBS :=/LINUXLDLIBS := -lm/" makefile
63
make linux
64
}
65
66
package() {
67
cd "${srcdir}"
68
# Unfortunately, makefile doesn't have make install, so...
69
mkdir -m 755 -p "${pkgdir}/opt/lockjaw"
70
71
# Copy all this stuff over.
72
install -D -m644 *.dat *.bmp *.jpg bgm* README.html "${pkgdir}/opt/lockjaw"
73
install -D -m755 lj "${pkgdir}/opt/lockjaw"
74
mkdir "${pkgdir}/opt/lockjaw/docs"
75
install -m644 docs/* "${pkgdir}/opt/lockjaw/docs"
76
touch "${pkgdir}/opt/lockjaw/installed.ini"
77
78
# Install desktop, launcher sh script.
79
install -D -m755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
80
install -D -m644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
81
install -D -m644 "${pkgname}.xpm" "${pkgdir}/usr/share/pixmaps/${pkgname}.xpm"
82
}
83
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |