nquake
LOW
maintainer Sid127
8 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source files from GitHub, which hosts the official nQuake project releases; despite SKIP'd checksums, all fetched content consists of non-executable game assets and data, with no remote code execution or malicious payload observed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from GitHub, which hosts the official nQuake project releases; despite SKIP'd checksums, all fetched content consists of non-executable game assets and data, with no remote code execution or malicious payload observed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:38
"CC0-1.0::https://creativecommons.org/publicdomain/zero/1.0/legalcode.txt")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sid Pranjale <sidpranjale127@protonmail.com>
2
3
#TODO: set up permissions (e.g. fortress/{progs,sounds, etc.} to be sticky-bit and writable? that way maybe at least files can be downloaded. create maps dir for all mods too.
4
#TODO: change permissions for all .cfg's to 664?
5
#TODO: way to force mode/ownership of newly created files? umask per dir?
6
# NOTE: as of 2.3-8, with pacman 5 there is crippled support for split-package. so we build one friggin' huge thing.
7
# sorry, community- i do hope someday that pacman devs stop making arbitrary changes on a whim.
8
9
pkgname=('nquake')
10
pkgver=latest
11
pkgrel=15
12
pkgdesc="The easiest, quickest, and most popular QuakeWorld client."
13
url="http://nquake.com/"
14
license=('GPL2' 'custom')
15
depends=('unzip' 'ezquake')
16
optdepends=('nquakesv: the nquake server' 'quake-qrp-textures: high-res textures for quake')
17
arch=('any')
18
install=nquake.install
19
20
_alt_pkgver=$(echo ${pkgver} | sed -e 's/\.//g')
21
22
# http://nquake.sourceforge.net/nquake.ini for list of mirrors
23
#_nQ_MIRROR="http://qw.quakephil.com/nquake" # NY, US
24
#_nQ_MIRROR="http://quakeservers.nquake.com" # Dusseldorf, DE
25
#_nQ_MIRROR="http://nquake.localghost.net" # Lulea, SE
26
#_nQ_MIRROR="http://fnu.nquake.com" # Uppsala, SE
27
28
#nQuake moved their mirrors to GitHub, as the quakeservers link tells us, so that's what we'll use
29
_nQ_MIRROR="https://github.com/nQuake/distfiles/releases/download/snapshot"
30
31
32
source=("${_nQ_MIRROR}/gpl.zip"
33
"${_nQ_MIRROR}/non-gpl.zip"
34
"${_nQ_MIRROR}/linux.zip"
35
"${_nQ_MIRROR}/addon-clanarena.zip"
36
"${_nQ_MIRROR}/addon-fortress.zip"
37
"${_nQ_MIRROR}/qsw106.zip"
38
"CC0-1.0::https://creativecommons.org/publicdomain/zero/1.0/legalcode.txt")
39
40
noextract=('qsw106.zip')
41
42
sha512sums=('SKIP' # gpl.zip
43
'SKIP' # non-gpl.zip
44
'SKIP' # linux.zip
45
'SKIP' # addon-clanarena.zip
46
'SKIP' # addon-fortress.zip
47
'SKIP' # qsw106.zip
48
'1eb4436f8d58766cbe99db97e5e8c0db8a706376afd291c337de1ba7a6b066d3791dc85ad034bdd54ea336bed6e6e8e7a037d8b04b2773c9c7517b9d9921d1fa' # CC0-1.0
49
)
50
51
prepare () {
52
unzip -o -j "qsw106.zip" "ID1/PAK0.PAK"
53
unzip -o -j "qsw106.zip" "LICINFO.TXT"
54
unzip -o -j "qsw106.zip" "README.TXT"
55
unzip -o -j "qsw106.zip" "SLICNSE.TXT"
56
}
57
58
package () {
59
## BASE ##
60
install -d -m775 -g users /opt/quake
61
# Most of these files are in gpl.zip
62
install -d -m 0755 ${pkgdir}/opt/quake/{id1,qw,ezquake}
63
install -d -m 0755 ${pkgdir}/usr/share/nquake
64
install -d -m 0755 ${pkgdir}/usr/share/doc/nquake
65
install -d -m 0755 ${pkgdir}/usr/share/licenses/nquake
66
install -d -m 0755 ${pkgdir}/usr/bin
67
# Fix ezquake packages.
68
install -d -m 0770 ${pkgdir}/opt/quake/ezquake/{sb/cache,temp}
69
# Implement the following in ezQuake
70
#chgrp games ${pkgdir}/usr/bin/ezquake
71
#chmod 0750 ${pkgdir}/usr/bin/ezquake
72
73
# These are provided by ezQuake.
74
for i in player_{base,blue,cyan,green,orange,pink,purple,red,white,yellow}.png;
75
do
76
rm -f ${srcdir}/qw/skins/${i}
77
done
78
79
# And the Business-End(TM). Do the thing.
80
cp -a ${srcdir}/id1/gpl_maps.pk3 ${pkgdir}/usr/share/nquake/. # handy to have lying around if you don't have the retail pak*.pak files
81
cp -a ${srcdir}/qw/ktx.pk3 ${pkgdir}/opt/quake/qw/.
82
cp -a ${srcdir}/ezquake/ezquake.pk3 ${pkgdir}/opt/quake/ezquake/nquake_ezquake.pk3 # we rename to avoid conflicts in the future
83
cp -a ${srcdir}/ezquake/configs ${pkgdir}/opt/quake/ezquake/. # actually part of the linux.zip, not gpl.zip
84
85
ln -sf /usr/bin/ezquake ${pkgdir}/usr/bin/nquake
86
87
## DEMO DATA ##
88
install -D -m 0644 ${srcdir}/PAK0.PAK ${pkgdir}/opt/quake/id1/pak0.pak
89
install -D -m 0644 ${srcdir}/LICINFO.TXT ${pkgdir}/usr/share/doc/nquake/quake_shareware_license_info.txt
90
install -D -m 0644 ${srcdir}/README.TXT ${pkgdir}/usr/share/doc/nquake/quake_shareware_readme.txt
91
install -D -m 0644 ${srcdir}/SLICNSE.TXT ${pkgdir}/usr/share/licenses/nquake/quake_shareware.txt
92
93
## NON-FREE ##
94
# Most of these files are in non-gpl.zip
95
install -d -m 0755 ${pkgdir}/opt/quake/qw/{skins,matchinfo}
96
install -d -m 0755 ${pkgdir}/usr/share/doc/nquake
97
install -d -m 0755 ${pkgdir}/usr/share/licenses/${pkgname}
98
cp -a ${srcdir}/CC0-1.0 ${pkgdir}/usr/share/licenses/${pkgname}/.
99
# And the Business-End(TM). Do the thing.
100
cp -a ${srcdir}/qw/matchinfo ${pkgdir}/opt/quake/qw/. # Demos
101
cp -a ${srcdir}/qw/models.pk3 ${pkgdir}/opt/quake/qw/. # Models
102
cp -a ${srcdir}/qw/nquake.pk3 ${pkgdir}/opt/quake/qw/. # nQuake tweaks
103
cp -a ${srcdir}/readme.txt ${pkgdir}/usr/share/doc/nquake/. # nQuake FAQ, credits, etc.
104
cp -a ${srcdir}/qw/readme.txt ${pkgdir}/opt/quake/qw/. # Directory structure schema
105
cp -a ${srcdir}/qw/skins ${pkgdir}/opt/quake/qw/. # Skins for models
106
107
108
# Security is worthless without a modicum of usability. We're kind of stepping on other packagers' toes here, but... c'est la vie.
109
# Remind me to submit a patch to https://aur.archlinux.org/packages/ezquake/ (and incorporate into ezquake-git, which I maintain).
110
# Scratch that, ezquake uses "users" group. Works for me!
111
chgrp -R users ${pkgdir}/opt/quake/
112
chgrp users ${pkgdir}/usr/share/nquake
113
114
## FORTRESS ##
115
# Most of these files are in addon-fortress.zip
116
install -d -m 0755 ${pkgdir}/opt/quake/
117
install -d -m 0755 ${pkgdir}/usr/share/licenses/${pkgname}
118
cp -a ${srcdir}/CC0-1.0 ${pkgdir}/usr/share/licenses/${pkgname}/.
119
# And the Business-End(TM). Do the thing.
120
cp -a ${srcdir}/fortress ${pkgdir}/opt/quake/. # The entire mod
121
122
## ARENA ##
123
# Most of these files are in addon-clanarena.zip
124
install -d -m 0755 ${pkgdir}/opt/quake/
125
install -d -m 0755 ${pkgdir}/usr/share/licenses/${pkgname}
126
cp -a ${srcdir}/CC0-1.0 ${pkgdir}/usr/share/licenses/${pkgname}/.
127
# And the Business-End(TM). Do the thing.
128
cp -a ${srcdir}/arena ${pkgdir}/opt/quake/. # The entire mod
129
cp -a ${srcdir}/prox ${pkgdir}/opt/quake/. # QuakeProxy, I think?
130
131
## TEXTURES ##
132
# TODO: is aur/quake-qrp-textures more up-to-date than the QRP in the nQuake mirrors? If so, make that a dependency and symlink or copy.
133
# Most of these files are in addon-textures.zip
134
install -d -m 0755 ${pkgdir}/opt/quake/qw
135
install -d -m 0755 ${pkgdir}/usr/share/licenses/${pkgname}
136
cp -a ${srcdir}/CC0-1.0 ${pkgdir}/usr/share/licenses/${pkgname}/.
137
# And the Business-End(TM). Do the thing.
138
ln -sf /opt/quake/id1/QRP_map_textures_v.1.00.pk3 ${pkgdir}/opt/quake/qw/QRP_map_textures_v.1.00.pk3
139
ln -sf /opt/quake/id1/QRP_normalmap_textures_add-on_v.1.00.pk3 ${pkgdir}/opt/quake/qw/QRP_normalmap_textures_add-on_v.1.00.pk3
140
}
141
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |