openmw-freefps-rubic0n-native-git

maintainer darkbasic · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Package builds OpenMW from a public GitGud fork and a GitHub dependency (Rubic0n), applies local patches, and compiles everything from source with no prebuilt binaries or obfuscated payloads; the non-whitelisted host (gitgud.io) is plausibly the project's own forge, and the only real concern is the SKIP'd checksums on the git sources (normal for VCS) and the few-votes/new status, not any malicious behaviour.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Package builds OpenMW from a public GitGud fork and a GitHub dependency (Rubic0n), applies local patches, and compiles everything from source with no prebuilt binaries or obfuscated payloads; the non-whitelisted host (gitgud.io) is plausibly the project's own forge, and the only real concern is the SKIP'd checksums on the git sources (normal for VCS) and the few-votes/new status, not any malicious behaviour.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:45 'openmw-fps::git+https://gitgud.io/loregamer/openmw-fps.git#branch=master'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Niccolo Belli <niccolo.belli@linuxsystems.it>
    
      2
    
      3pkgname=openmw-freefps-rubic0n-native-git
    
      4pkgver=0.51.0.r6.g5e309685.rubic0n.r3542.gf3ee18af
    
      5pkgrel=2
    
      6pkgdesc='OpenMW 0.51 FreeFPS build with private Rubic0n, background Lua GC, LTO, and native CPU tuning'
    
      7arch=('x86_64')
    
      8url='https://gitgud.io/loregamer/openmw-fps'
    
      9license=('GPL-3.0-or-later' 'Apache-2.0' 'MIT' 'OFL-1.1' 'LicenseRef-DejaVuLGCSansMono')
    
      10depends=(
    
      11  'boost-libs'
    
      12  'bullet-dp'
    
      13  'ffmpeg'
    
      14  'glibc'
    
      15  'icu'
    
      16  'libgcc'
    
      17  'libstdc++'
    
      18  'libxt'
    
      19  'lz4'
    
      20  'mygui-openmw'
    
      21  'openal'
    
      22  'openscenegraph-openmw-git'
    
      23  'qt6-base'
    
      24  'qt6-declarative'
    
      25  'qt6-svg'
    
      26  'qt6-tools'
    
      27  'recastnavigation-openmw'
    
      28  'sdl2'
    
      29  'sqlite'
    
      30  'unshield'
    
      31  'yaml-cpp'
    
      32  'zlib'
    
      33)
    
      34makedepends=('boost' 'cmake' 'doxygen' 'git' 'ninja')
    
      35provides=('openmw=0.51.0')
    
      36conflicts=('openmw' 'openmw-git' 'openmw-stable-git')
    
      37install="${pkgname}.install"
    
      38options=('!debug' 'lto' 'strip')
    
      39
    
      40# FreeFPS master and Rubic0n development are deliberately tracked.
    
      41# This is the OpenMW commit from which the FreeFPS fork's own first-parent
    
      42# history starts; it is only a pkgver() anchor, not a source pin.
    
      43_freefps_base='673981c7f552089f1370d97fdac95e7221d4debc'
    
      44source=(
    
      45  'openmw-fps::git+https://gitgud.io/loregamer/openmw-fps.git#branch=master'
    
      46  'rubic0n::git+https://github.com/DreamWeave-MP/rubic0n.git#branch=development'
    
      47  'backport-background-lua-gc.patch'
    
      48  'private-rubic0n-static.patch'
    
      49  'maskedoc-native-baseline.patch'
    
      50)
    
      51sha256sums=(
    
      52  'SKIP'
    
      53  'SKIP'
    
      54  '15a38f070c6401d34278d898fe6b344c899afe3500fdf7c024192f3e180bd638'
    
      55  'ed442d7dcaec98d88fe5a2b7597b4fb1806b35fde6eab6dac67060212432aa91'
    
      56  '2299bf55ddeb4704834148c8cda6a7710816a10cceae471ff2d4323eba6f15b4'
    
      57)
    
      58
    
      59pkgver() {
    
      60  local openmw_revision openmw_hash rubic0n_revision rubic0n_hash
    
      61
    
      62  git -C "${srcdir}/openmw-fps" merge-base --is-ancestor \
    
      63    "${_freefps_base}" HEAD || return 1
    
      64  openmw_revision="$(git -C "${srcdir}/openmw-fps" rev-list \
    
      65    --first-parent --count "${_freefps_base}..HEAD")"
    
      66  openmw_hash="$(git -C "${srcdir}/openmw-fps" rev-parse --short=8 HEAD)"
    
      67  rubic0n_revision="$(git -C "${srcdir}/rubic0n" rev-list --count HEAD)"
    
      68  rubic0n_hash="$(git -C "${srcdir}/rubic0n" rev-parse --short=8 HEAD)"
    
      69
    
      70  printf '0.51.0.r%s.g%s.rubic0n.r%s.g%s' \
    
      71    "${openmw_revision}" "${openmw_hash}" "${rubic0n_revision}" "${rubic0n_hash}"
    
      72}
    
      73
    
      74prepare() {
    
      75  cd "${srcdir}/openmw-fps"
    
      76
    
      77  # Exact backports of OpenMW ec26c521 and its required race fix d7c2f416.
    
      78  patch -Np1 -i "${srcdir}/backport-background-lua-gc.patch"
    
      79
    
      80  # Add an explicit static-Rubic0n integration path to OpenMW's CMake build.
    
      81  patch -Np1 -i "${srcdir}/private-rubic0n-static.patch"
    
      82
    
      83  # Keep MOC's baseline dispatch unit free of AVX/VEX instructions and disable
    
      84  # strict-aliasing assumptions for its non-conforming SIMD lane accessors.
    
      85  patch -Np1 -i "${srcdir}/maskedoc-native-baseline.patch"
    
      86
    
      87  # Rubic0n enables Lua 5.2 compatibility. Its resource fixes OpenMW 0.51's
    
      88  # __ipairs implementation for those semantics.
    
      89  install -Dm644 \
    
      90    "${srcdir}/rubic0n/resources/lua_libs/content.lua" \
    
      91    components/lua_ui/content.lua
    
      92}
    
      93
    
      94build() {
    
      95  # This package is intentionally tied to the CPU on which makepkg is run.
    
      96  local file_prefix_map="-ffile-prefix-map=${srcdir}=/usr/src/${pkgname}"
    
      97  export CFLAGS="${CFLAGS} -march=native ${file_prefix_map}"
    
      98  export CXXFLAGS="${CXXFLAGS} -march=native ${file_prefix_map}"
    
      99
    
      100  make -C "${srcdir}/rubic0n" clean
    
      101  make -C "${srcdir}/rubic0n" BUILDMODE=static
    
      102
    
      103  export CMAKE_POLICY_VERSION_MINIMUM=3.5
    
      104  cmake \
    
      105    -S "${srcdir}/openmw-fps" \
    
      106    -B "${srcdir}/build" \
    
      107    -G Ninja \
    
      108    -D CMAKE_BUILD_TYPE=Release \
    
      109    -D CMAKE_INSTALL_PREFIX=/usr \
    
      110    -D OPENMW_LTO_BUILD=ON \
    
      111    -D OPENMW_RUBIC0N_ROOT="${srcdir}/rubic0n" \
    
      112    -D OPENMW_USE_SYSTEM_BULLET=ON \
    
      113    -D OPENMW_USE_SYSTEM_MYGUI=ON \
    
      114    -D OPENMW_USE_SYSTEM_OSG=ON \
    
      115    -D OPENMW_USE_SYSTEM_RECASTNAVIGATION=ON
    
      116
    
      117  cmake --build "${srcdir}/build"
    
      118}
    
      119
    
      120package() {
    
      121  DESTDIR="${pkgdir}" cmake --install "${srcdir}/build"
    
      122
    
      123  install -Dm644 "${srcdir}/openmw-fps/LICENSE" \
    
      124    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.openmw"
    
      125  install -Dm644 "${srcdir}/openmw-fps/extern/maskedoc/license.txt" \
    
      126    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.maskedoc"
    
      127  install -Dm644 "${srcdir}/rubic0n/COPYRIGHT" \
    
      128    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.rubic0n"
    
      129}
    
      130
    
      131# vim: ts=2 sw=2 et:
    
      132

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 17:37:55	LOW	3
2026-08-16 17:33:23	MEDIUM	2