openarena-git

maintainer Opvolger · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a data-only zip file (game assets) from a non-whitelisted but project-associated host (tuxfamily.org), which is not executable and poses no code execution risk; the actual binary is built from source via GitHub.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a data-only zip file (game assets) from a non-whitelisted but project-associated host (tuxfamily.org), which is not executable and poses no code execution risk; the actual binary is built from source via GitHub.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "http://download.tuxfamily.org/openarena/rel/${_relver}/openarena-${_openarenaver}.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Bas Magré <Opvolger@gmail.com>
    
      2
    
      3pkgname='openarena-git'
    
      4pkgver=0.8.8.r2428.f507a7a8
    
      5_relver='088'
    
      6_openarenaver='0.8.8'
    
      7pkgrel=2
    
      8makedepends=('git' 'make' 'grep')
    
      9conflicts=('openarena')
    
      10provides=('openarena')
    
      11pkgdesc="A violent, sexy, multiplayer first person shooter based on the ioquake3 engine (binary package)"
    
      12arch=('i686' 'x86_64' 'aarch64' 'armv7h')
    
      13url="http://openarena.ws/"
    
      14license=('GPL')
    
      15depends=('sdl' 'libvorbis' 'curl' 'libxmp')
    
      16optdepends=('openal: to silence SDL fallback warning')
    
      17source=('git+https://github.com/OpenArena/engine.git'
    
      18        "http://download.tuxfamily.org/openarena/rel/${_relver}/openarena-${_openarenaver}.zip"
    
      19        'openarena-runner.sh'
    
      20        'openarena.png'
    
      21        'openarena-server.png'
    
      22        'openarena.desktop'
    
      23        'openarena-server.desktop')
    
      24sha512sums=('SKIP'
    
      25            '9fa4dabe8a3428dc3cbec97f3b4d20c04569c14cdd00b60e6391c6dd61e310f246ff5ec97e7549821b3d6f5f94b140eb5411a2ddd83dafcad66937b7f78ea8dd'
    
      26            '3ea0d57070ba9e6652d704639823d4bcf9f1aa031836634d9418774392b69178ecc460284ed3e42668d968e3608d28545490f0f8763e6dc72015849d619a753b'
    
      27            'ef68f8eb6251c3424464702ff894a6b88b473a3f4c1512af613125f5e5a7124f268490a9f6042095ff5bb807817e1f302c80d21987a2ed178e680f993d70b6f1'
    
      28            '9e8c860fe8e9a6fefa9839907df6e74f11564daaa2bf12b4c261dec34d65917e7110a41aa7777f16d3842c8371b9e960468d75c439d8b815454feeb8c01ed6e6'
    
      29            '5acd934f451559ad68b76a4de4b132b9ead9542dd078df7c7489ce2b2774557d81c6405622e8090ced2ace5f05165af1ed5dee8674d3fef725cd633727c92538'
    
      30            '426734a1517802b00b062006fcac4e321b4bf2fa8f3a3f7670a11ae62cf6cdd417bd158d0d613c0017e44e5a9528d72ef77e383a4fda2b230f0cc0f8ef9185d1')
    
      31
    
      32
    
      33pkgver() {
    
      34  cd "${srcdir}/engine"
    
      35  echo -n "0.8.8.r" && git rev-list --count HEAD | sed -z 's/\n//g' && echo -n "." && git describe --always
    
      36}
    
      37
    
      38prepare() {
    
      39  # add aarch64 if missing
    
      40  cd "${srcdir}/engine"
    
      41}
    
      42
    
      43build() {
    
      44  cd "${srcdir}/openarena-${_openarenaver}"
    
      45  # no Windows
    
      46  rm *.dll *.exe
    
      47  # no Mac
    
      48  rm -rf __MACOSX *.app
    
      49  # we will compile new files!
    
      50  rm *.{i386,x86_64}
    
      51
    
      52  # now build openarena
    
      53  cd "${srcdir}/engine"
    
      54  # add aarch64 if not in source
    
      55  if [ $(uname -m) == 'aarch64' ]; then
    
      56    if grep -qF "aarch64" code/qcommon/q_platform.h; then
    
      57      echo "Code has aarch64!"
    
      58    else
    
      59      echo "Give code aarch64!"
    
      60      sed -i 's/arm/aarch64/g' code/qcommon/q_platform.h
    
      61    fi
    
      62  fi
    
      63  #build!
    
      64  make
    
      65}
    
      66
    
      67package() {
    
      68  # create dirs
    
      69  install -dm755 "${pkgdir}/usr/bin" "${pkgdir}/usr/lib" "$pkgdir"/usr/share/pixmaps/ "$pkgdir"/usr/share/applications/
    
      70  
    
      71  # copy zipfile to openarena
    
      72  mv "${srcdir}/openarena-${_openarenaver}" "${pkgdir}/usr/lib/openarena"
    
      73  find "${pkgdir}/usr/lib/openarena" -type f -exec chmod 644 {} \;
    
      74  find "${pkgdir}/usr/lib/openarena" -type d -exec chmod 755 {} \;
    
      75
    
      76  # copy compiled files
    
      77  install -Dm 755 "${srcdir}"/engine/build/release-linux-$(uname -m)/o*.$(uname -m) "${pkgdir}/usr/lib/openarena"
    
      78
    
      79  # create application-shortcuts
    
      80  install -Dm 644 "$srcdir"/openarena{,-server}.png "$pkgdir"/usr/share/pixmaps/
    
      81  install -Dm 644 "$srcdir"/openarena{,-server}.desktop "$pkgdir"/usr/share/applications/
    
      82  
    
      83  # create bash-script for link.
    
      84  install -Dm 755 "$srcdir"/openarena-runner.sh "$pkgdir"/usr/lib/openarena/openarena-runner.sh
    
      85
    
      86  # create link to arch.
    
      87  ln -s /usr/lib/openarena/openarena-runner.sh "${pkgdir}/usr/bin/openarena"
    
      88  ln -s /usr/lib/openarena/openarena-runner.sh "${pkgdir}/usr/bin/openarena-server"
    
      89  ln -s /usr/lib/openarena/openarena-runner.sh "${pkgdir}/usr/bin/oa_ded"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2