openjk-bin

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary tarball from builds.openjk.org, which is the official OpenJK CI/build server operated by the JACoders project (the upstream maintainers of OpenJK). This is not a random personal host — it is the project's own dedicated build distribution server, analogous to how many projects host release artifacts on a subdomain separate from their GitHub page. The binaries are verified with sha256sums. However, the concern is real in the sense that: (1) prebuilt binaries are installed and executed rather than compiled from source, (2) the host is not GitHub Releases or another widely-audited platform, and (3) the package is dated 2018 so the build artifact is old and the host's continued trustworthiness cannot be assumed. This is a genuine medium-level supply-chain concern (executed binary from a non-primary forge), not a false positive, but also not evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://builds.openjk.org/openjk-$_pkgver-linux-64.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball from builds.openjk.org, which is the official OpenJK CI/build server operated by the JACoders project (the upstream maintainers of OpenJK). This is not a random personal host — it is the project's own dedicated build distribution server, analogous to how many projects host release artifacts on a subdomain separate from their GitHub page. The binaries are verified with sha256sums. However, the concern is real in the sense that: (1) prebuilt binaries are installed and executed rather than compiled from source, (2) the host is not GitHub Releases or another widely-audited platform, and (3) the package is dated 2018 so the build artifact is old and the host's continued trustworthiness cannot be assumed. This is a genuine medium-level supply-chain concern (executed binary from a non-primary forge), not a false positive, but also not evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nikos Fytilis <n-fit@hotmail.com>
    
      2# Contributor: Pavel Lymarev <x-user at bk dot ru>
    
      3# Contributor: Jameson Pugh <imntreal@gmail.com>
    
      4# Contributor: Rene Schoebel (wesley) <schoebel.r at gmail dot com>
    
      5
    
      6pkgname=openjk-bin
    
      7_pkgver='2018-02-26-e3f22070'
    
      8pkgver=$(echo $_pkgver | tr - .)
    
      9pkgrel=1
    
      10pkgdesc="Open Source Jedi Knight II + III Engine - pre built"
    
      11arch=('x86_64')
    
      12url="https://github.com/JACoders/OpenJK"
    
      13license=('GPL')
    
      14depends=('libgl' 'openal' 'zlib' 'sdl2' 'libjpeg' 'glu')
    
      15makedepends=()
    
      16optdepends=('libpng')
    
      17provides=(openjk)
    
      18conflicts=(openjk-git)
    
      19source=("https://builds.openjk.org/openjk-$_pkgver-linux-64.tar.gz"
    
      20	'openjkmp.png'
    
      21	'openjksp.png'
    
      22	'openjkmp.desktop'
    
      23	'openjksp.desktop')
    
      24sha256sums=('80b831c821ba5676fb981becc1b655b728d09114c16135211f62ada32480184a'
    
      25            '0e82e720777eeb2043c2c25cdbce702c6d4ca077543aedfe51e5c4e96cf03969'
    
      26            'afb2c1a757720c70798e7f7218f823297a43bc61e0cb192e9443df67c2963903'
    
      27            'd3ad7dd270e57d36a22caef21bff17f2eb4acb0ad9087f6a17ca4a0bf9c566fc'
    
      28            'd03554bd926954218c243a1a97d39ea9700d064a2374f671249a533ebd970375')
    
      29package() {
    
      30	cd "${srcdir}"
    
      31	install -d "${pkgdir}"/opt/JediAcademy
    
      32	cp -r install/JediAcademy/* "${pkgdir}"/opt/JediAcademy
    
      33
    
      34
    
      35	mkdir -p "${pkgdir}/usr/bin"
    
      36	_jkarch=$arch
    
      37	cat > ${pkgdir}/usr/bin/openjk << EOF
    
      38#!/bin/bash
    
      39cd /opt/JediAcademy
    
      40exec ./openjk.${_jkarch} \$@
    
      41EOF
    
      42	cat > ${pkgdir}/usr/bin/openjk_sp << EOF
    
      43#!/bin/bash
    
      44cd /opt/JediAcademy
    
      45exec ./openjk_sp.${_jkarch} \$@
    
      46EOF
    
      47	cat > ${pkgdir}/usr/bin/openjkded << EOF
    
      48#!/bin/bash
    
      49cd /opt/JediAcademy
    
      50exec ./openjkded.${_jkarch} \$@
    
      51EOF
    
      52	chmod +x ${pkgdir}/usr/bin/openjk
    
      53	chmod +x ${pkgdir}/usr/bin/openjk_sp
    
      54	chmod +x ${pkgdir}/usr/bin/openjkded
    
      55
    
      56	chmod 755 -R ${pkgdir}/opt/JediAcademy
    
      57
    
      58	install -Dm755 "${srcdir}/openjkmp.png" "${pkgdir}/usr/share/pixmaps/openjkmp.png"
    
      59	install -Dm755 "${srcdir}/openjksp.png" "${pkgdir}/usr/share/pixmaps/openjksp.png"
    
      60	install -Dm755 "${srcdir}/openjkmp.desktop" "${pkgdir}/usr/share/applications/openjkmp.desktop"
    
      61	install -Dm755 "${srcdir}/openjksp.desktop" "${pkgdir}/usr/share/applications/openjksp.desktop"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2