omaquake
LOW
maintainer rsd
0 votes
scanned 2026-10-05 00:08:03.938595
Why flagged
The non-standard host hosts only the freely redistributable Quake shareware data (quake106.zip), which is non-executable game content; the actual code is built from verified GitHub sources, making the worst-case impact of a swapped download limited to non-malicious data substitution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host hosts only the freely redistributable Quake shareware data (quake106.zip), which is non-executable game content; the actual code is built from verified GitHub sources, making the worst-case impact of a swapped download limited to non-malicious data substitution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:30
"https://ftp.gwdg.de/pub/misc/ftp.idsoftware.com/idstuff/quake/quake106.zip")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Raul Dias <raul@dias.com.br>
2
3
pkgbase=omaquake
4
pkgname=('omaquake' 'omaquake-shareware-data')
5
pkgver=0.1.1
6
pkgrel=1
7
pkgdesc="Quake 1 rendered as characters in a terminal"
8
arch=('x86_64')
9
url="https://github.com/rsd/omaquake"
10
license=('GPL-2.0-only') # matches the Quake engine source
11
# chafa, libcaca and alsa-lib are runtime depends of the omaquake package
12
# only, and in a split PKGBUILD per-package depends are not installed before
13
# build(). The Makefile detects all three via pkg-config and silently omits a
14
# backend it cannot find, so in a clean chroot they must be makedepends too or
15
# the binary ships with no video backend at all.
16
makedepends=('git' 'make' 'gcc' 'pkgconf' 'libarchive' 'chafa' 'libcaca' 'alsa-lib')
17
18
# The engine is a submodule and makepkg will not fetch submodules itself, so
19
# tyrquake is a second source entry and prepare() rewires the submodule at it.
20
#
21
# The tag pin is what makes this reproducible: an unpinned branch would
22
# silently build whatever master happens to be while still calling itself
23
# 0.1.1. Bumping pkgver means moving this tag too.
24
#
25
# quake106.zip is the 1996 shareware release: freely redistributable, and the
26
# only pak0.pak that may be handed out. It is fetched, never shipped in this
27
# repo. Mirror: https://www.gamers.org/pub/idgames/idstuff/quake/quake106.zip
28
source=("$pkgbase::git+https://github.com/rsd/omaquake.git#tag=v0.1.1"
29
"tyrquake::git+https://github.com/libretro/tyrquake.git"
30
"https://ftp.gwdg.de/pub/misc/ftp.idsoftware.com/idstuff/quake/quake106.zip")
31
sha256sums=('SKIP'
32
'SKIP'
33
'ec6c9d34b1ae0252ac0066045b6611a7919c2a0d78a3a66d9387a8f597553239')
34
35
prepare() {
36
cd "$srcdir/$pkgbase"
37
git submodule init
38
git config submodule.third_party/tyrquake.url "$srcdir/tyrquake"
39
# protocol.file.allow: git refuses file:// submodule transport by default
40
# since CVE-2022-39253. The URL we just pointed it at is makepkg's own
41
# verified checkout, not anything the network chose, so allow it here only.
42
git -c protocol.file.allow=always submodule update
43
44
# makepkg unpacks quake106.zip for us, but the payload inside it is
45
# resource.1: a DOS self-extracting LHA archive. libarchive reads LHA, so
46
# bsdtar opens it directly -- no lhasa/dosbox needed. Member names are
47
# uppercase in the archive; everything downstream (oq_find_pak's dir/id1
48
# probe, tyrquake's walk up from the pak to its base directory) expects
49
# lowercase id1/pak0.pak, so rename on the way out.
50
cd "$srcdir"
51
bsdtar -xf resource.1 ID1/PAK0.PAK LICINFO.TXT SLICNSE.TXT README.TXT
52
install -Dm644 ID1/PAK0.PAK "$srcdir/id1/pak0.pak"
53
}
54
55
build() {
56
cd "$srcdir/$pkgbase"
57
make engine
58
make
59
}
60
61
check() {
62
cd "$srcdir/$pkgbase"
63
# Renders one frame of the test pattern; needs no game data.
64
# TODO: needs a pty, so this must run under `script` or be dropped.
65
./build/omaquake --help >/dev/null
66
}
67
68
package_omaquake() {
69
# alsa-lib is a real link-time dependency, not just an optional backend --
70
# namcap flags its absence. chafa and libcaca are optional at build time but
71
# hard deps here so `--video=` always has both choices at runtime.
72
depends=('chafa' 'libcaca' 'alsa-lib')
73
optdepends=('omaquake-shareware-data: freely redistributable pak0.pak')
74
75
cd "$srcdir/$pkgbase"
76
make DESTDIR="$pkgdir" PREFIX=/usr install
77
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgbase/README.md"
78
install -Dm644 docs/DESIGN.md "$pkgdir/usr/share/doc/$pkgbase/DESIGN.md"
79
}
80
81
package_omaquake-shareware-data() {
82
pkgdesc="Quake 1 shareware game data (episode 1) for omaquake"
83
arch=('any')
84
license=('LicenseRef-Quake-Shareware')
85
86
# /usr/share/omaquake is already on oq_find_pak's system search list, so an
87
# id1/ under it is found with no arguments and no config.
88
install -Dm644 "$srcdir/id1/pak0.pak" \
89
"$pkgdir/usr/share/omaquake/id1/pak0.pak"
90
install -Dm644 "$srcdir/LICINFO.TXT" \
91
"$pkgdir/usr/share/licenses/$pkgname/LICINFO.TXT"
92
install -Dm644 "$srcdir/SLICNSE.TXT" \
93
"$pkgdir/usr/share/licenses/$pkgname/SLICNSE.TXT"
94
install -Dm644 "$srcdir/README.TXT" \
95
"$pkgdir/usr/share/doc/$pkgname/README.TXT"
96
}
97
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |