omaquake-shareware-data
MEDIUM
maintainer rsd
0 votes
base
omaquake
scanned 2026-08-21 01:13:51.509442
Why flagged
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:30
"https://ftp.gwdg.de/pub/misc/ftp.idsoftware.com/idstuff/quake/quake106.zip")
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Raul Dias <raul@dias.com.br>
2
3
pkgbase=omaquake
4
pkgname=('omaquake' 'omaquake-shareware-data')
5
pkgver=0.1.0
6
pkgrel=1
7
pkgdesc="Quake 1 rendered as characters in a terminal"
8
arch=('x86_64')
9
url="https://github.com/rsd/omaquake"
10
license=('GPL-2.0-only') # matches the Quake engine source
11
# chafa, libcaca and alsa-lib are runtime depends of the omaquake package
12
# only, and in a split PKGBUILD per-package depends are not installed before
13
# build(). The Makefile detects all three via pkg-config and silently omits a
14
# backend it cannot find, so in a clean chroot they must be makedepends too or
15
# the binary ships with no video backend at all.
16
makedepends=('git' 'make' 'gcc' 'pkgconf' 'libarchive' 'chafa' 'libcaca' 'alsa-lib')
17
18
# The engine is a submodule and makepkg will not fetch submodules itself, so
19
# tyrquake is a second source entry and prepare() rewires the submodule at it.
20
#
21
# The tag pin is what makes this reproducible: an unpinned branch would
22
# silently build whatever master happens to be while still calling itself
23
# 0.1.0. Bumping pkgver means moving this tag too.
24
#
25
# quake106.zip is the 1996 shareware release: freely redistributable, and the
26
# only pak0.pak that may be handed out. It is fetched, never shipped in this
27
# repo. Mirror: https://www.gamers.org/pub/idgames/idstuff/quake/quake106.zip
28
source=("$pkgbase::git+https://github.com/rsd/omaquake.git#tag=v0.1.0"
29
"tyrquake::git+https://github.com/libretro/tyrquake.git"
30
"https://ftp.gwdg.de/pub/misc/ftp.idsoftware.com/idstuff/quake/quake106.zip")
31
sha256sums=('SKIP'
32
'SKIP'
33
'ec6c9d34b1ae0252ac0066045b6611a7919c2a0d78a3a66d9387a8f597553239')
34
35
prepare() {
36
cd "$srcdir/$pkgbase"
37
git submodule init
38
git config submodule.third_party/tyrquake.url "$srcdir/tyrquake"
39
# protocol.file.allow: git refuses file:// submodule transport by default
40
# since CVE-2022-39253. The URL we just pointed it at is makepkg's own
41
# verified checkout, not anything the network chose, so allow it here only.
42
git -c protocol.file.allow=always submodule update
43
44
# makepkg unpacks quake106.zip for us, but the payload inside it is
45
# resource.1: a DOS self-extracting LHA archive. libarchive reads LHA, so
46
# bsdtar opens it directly -- no lhasa/dosbox needed. Member names are
47
# uppercase in the archive; everything downstream (oq_find_pak's dir/id1
48
# probe, tyrquake's walk up from the pak to its base directory) expects
49
# lowercase id1/pak0.pak, so rename on the way out.
50
cd "$srcdir"
51
bsdtar -xf resource.1 ID1/PAK0.PAK LICINFO.TXT SLICNSE.TXT README.TXT
52
install -Dm644 ID1/PAK0.PAK "$srcdir/id1/pak0.pak"
53
}
54
55
build() {
56
cd "$srcdir/$pkgbase"
57
make engine
58
make
59
}
60
61
check() {
62
cd "$srcdir/$pkgbase"
63
# Renders one frame of the test pattern; needs no game data.
64
# TODO: needs a pty, so this must run under `script` or be dropped.
65
./build/omaquake --help >/dev/null
66
}
67
68
package_omaquake() {
69
# alsa-lib is a real link-time dependency, not just an optional backend --
70
# namcap flags its absence. chafa and libcaca are optional at build time but
71
# hard deps here so `--video=` always has both choices at runtime.
72
depends=('chafa' 'libcaca' 'alsa-lib')
73
optdepends=('omaquake-shareware-data: freely redistributable pak0.pak')
74
75
cd "$srcdir/$pkgbase"
76
make DESTDIR="$pkgdir" PREFIX=/usr install
77
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgbase/README.md"
78
install -Dm644 docs/DESIGN.md "$pkgdir/usr/share/doc/$pkgbase/DESIGN.md"
79
}
80
81
package_omaquake-shareware-data() {
82
pkgdesc="Quake 1 shareware game data (episode 1) for omaquake"
83
arch=('any')
84
license=('LicenseRef-Quake-Shareware')
85
86
# /usr/share/omaquake is already on oq_find_pak's system search list, so an
87
# id1/ under it is found with no arguments and no config.
88
install -Dm644 "$srcdir/id1/pak0.pak" \
89
"$pkgdir/usr/share/omaquake/id1/pak0.pak"
90
install -Dm644 "$srcdir/LICINFO.TXT" \
91
"$pkgdir/usr/share/licenses/$pkgname/LICINFO.TXT"
92
install -Dm644 "$srcdir/SLICNSE.TXT" \
93
"$pkgdir/usr/share/licenses/$pkgname/SLICNSE.TXT"
94
install -Dm644 "$srcdir/README.TXT" \
95
"$pkgdir/usr/share/doc/$pkgname/README.TXT"
96
}
97
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-21 01:13:51 | Medium | 2 |
| 2026-08-20 23:15:15 | Clean | 3 |
| 2026-08-20 23:13:41 | Medium | 2 |