openq4-bin

LOW

maintainer jmsq 0 votes scanned 2026-10-25 21:44:49.492570

View on AUR

Why flagged

The non-standard host (aur.slashbunny.com) serves the official Quake 4 1.4.2 Linux point-release installer, which is a prebuilt executable run at build time, but it has a pinned SHA-256 checksum and the host appears to be a long-standing AUR contributor mirror for Quake data; the main engine binaries come from the project's own GitHub releases with checksums, so the realistic risk is low rather than medium.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The non-standard host (aur.slashbunny.com) serves the official Quake 4 1.4.2 Linux point-release installer, which is a prebuilt executable run at build time, but it has a pinned SHA-256 checksum and the host appears to be a long-standing AUR contributor mirror for Quake data; the main engine binaries come from the project's own GitHub releases with checksums, so the realistic risk is low rather than medium.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "https://aur.slashbunny.com/quake4/quake4-linux-${_q4ver}.x86.run")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: John-Michael Mulesa <jmulesa at gmail dot com>
    
      2# Contributor: Slash <demodevil5 [at] yahoo [dot] com>
    
      3
    
      4pkgname=openq4-bin
    
      5_pkgname=openq4
    
      6pkgver=0.13.2
    
      7_q4ver=1.4.2
    
      8pkgrel=1
    
      9pkgdesc="Open-source Quake 4 engine and game code replacement (binary release). You need the retail Quake 4 data to play."
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://github.com/themuffinator/openQ4"
    
      12license=('GPL-3.0-or-later' 'LicenseRef-Quake4-SDK' 'LicenseRef-Quake4-EULA')
    
      13depends=('gcc-libs' 'glibc' 'libgl' 'libx11' 'libxcursor' 'libxext' 'libxi' 'libxrandr' 'openal')
    
      14optdepends=('quake4-data: retail Quake 4 data in /opt/quake4 (otherwise a Steam/GOG install is detected)'
    
      15            'vulkan-icd-loader: experimental Vulkan renderer (r_renderApi vulkan)'
    
      16            'wayland: native Wayland video'
    
      17            'libxkbcommon: native Wayland keyboard input'
    
      18            'libdecor: Wayland window decorations')
    
      19provides=("${_pkgname}=${pkgver}")
    
      20conflicts=("${_pkgname}" "${_pkgname}-git")
    
      21options=('!strip' '!debug')
    
      22install=${pkgname}.install
    
      23source=("openq4.sh"
    
      24        "https://aur.slashbunny.com/quake4/quake4-linux-${_q4ver}.x86.run")
    
      25source_x86_64=("${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64.tar.xz")
    
      26source_aarch64=("${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64-preview.tar.xz")
    
      27noextract=("quake4-linux-${_q4ver}.x86.run")
    
      28sha256sums=('15423ab60c6a738fa92926d994e63c12ea71a59a7b0fd50a62283d964b882f4b'
    
      29            '9203b387b1a4075a1b9ad1eb7be32b49a88141a448d9330d9cbe1f40a145bd6a')
    
      30sha256sums_x86_64=('04f146ee96da1a0afcf839e31223222b49be2a8bcc7cfe239ea858552f551208')
    
      31sha256sums_aarch64=('2415cf1d4591591403d81e333da4d2441fdcacc65c80799469d4289e675a716c')
    
      32
    
      33# Upstream names its binaries and modules by architecture tag.
    
      34case "${CARCH}" in
    
      35    x86_64)  _arch=x64 ;;
    
      36    aarch64) _arch=arm64 ;;
    
      37esac
    
      38
    
      39prepare() {
    
      40    # Unpack the Quake 4 1.4.2 Linux point release (makeself archive) for its
    
      41    # patch paks. openQ4 requires pak013.pk4 - pak022.pk4, which the
    
      42    # quake4-data-* packages leave out.
    
      43    rm -rf "quake4-${_q4ver}"
    
      44    sh "quake4-linux-${_q4ver}.x86.run" --noexec --nox11 --target "quake4-${_q4ver}"
    
      45}
    
      46
    
      47package() {
    
      48    local _q4dir="${srcdir}/quake4-${_q4ver}"
    
      49
    
      50    # The arm64 archive carries a -preview suffix.
    
      51    cd "${srcdir}/${_pkgname}-${pkgver}-linux-${_arch}"*/
    
      52
    
      53    # Install engine, renderers and openQ4 runtime content
    
      54    install -D -m 755 -t "${pkgdir}/opt/${_pkgname}/" \
    
      55        "openQ4-client_${_arch}" "openQ4-ded_${_arch}" renderer-*_"${_arch}".so
    
      56    install -D -m 644 -t "${pkgdir}/opt/${_pkgname}/" VERSION.txt
    
      57    install -D -m 755 -t "${pkgdir}/opt/${_pkgname}/baseoq4/" baseoq4/*.so
    
      58    install -D -m 644 -t "${pkgdir}/opt/${_pkgname}/baseoq4/" baseoq4/*.pk4 baseoq4/mod.json
    
      59
    
      60    # Install Quake 4 1.4.2 patch paks into the q4base overlay
    
      61    install -D -m 644 -t "${pkgdir}/opt/${_pkgname}/q4base/" \
    
      62        "${_q4dir}"/q4base/pak0??.pk4 \
    
      63        "${_q4dir}"/q4base/q4cmp_pak001.pk4 \
    
      64        "${_q4dir}"/q4base/zpak_english_0?.pk4 \
    
      65        "${_q4dir}"/us/q4base/*.pk4
    
      66
    
      67    # Install launcher and its dedicated server / Steam Deck aliases
    
      68    sed "s/@ARCH@/${_arch}/g" "${srcdir}/openq4.sh" > "${srcdir}/openq4"
    
      69    install -D -m 755 "${srcdir}/openq4" "${pkgdir}/usr/bin/openq4"
    
      70    ln -s openq4 "${pkgdir}/usr/bin/openq4-dedicated"
    
      71    ln -s openq4 "${pkgdir}/usr/bin/openq4-steamdeck"
    
      72
    
      73    # Install desktop files, pointed at the launcher
    
      74    for _desktop in share/applications/*.desktop; do
    
      75        sed -e 's/^Exec=openQ4-steamdeck/Exec=openq4-steamdeck/' \
    
      76            -e 's/^Exec=openQ4-client_.*/Exec=openq4/' "${_desktop}" > "${srcdir}/${_desktop##*/}"
    
      77        install -D -m 644 "${srcdir}/${_desktop##*/}" "${pkgdir}/usr/share/applications/${_desktop##*/}"
    
      78    done
    
      79
    
      80    # Install icons
    
      81    for _icon in share/icons/hicolor/*/apps/openq4.*; do
    
      82        install -D -m 644 "${_icon}" "${pkgdir}/usr/${_icon}"
    
      83    done
    
      84
    
      85    # Install documentation
    
      86    install -d "${pkgdir}/usr/share/doc/${_pkgname}"
    
      87    install -m 644 README.html "${pkgdir}/usr/share/doc/${_pkgname}/"
    
      88    cp -r --no-preserve=ownership docs "${pkgdir}/usr/share/doc/${_pkgname}/"
    
      89
    
      90    # Install licenses (openQ4 GPL, id Software license for the patch paks)
    
      91    install -D -m 644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      92    install -D -m 644 "${_q4dir}/License.txt" "${pkgdir}/usr/share/licenses/${pkgname}/Quake4-License.txt"
    
      93}
    
      94

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 21:44:49	Low	3
2026-10-25 21:43:05	Medium	3