opentitus

maintainer myself601 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code and assets from various hosts including non-whitelisted ones, but all are used for building or as static data; the only executable built comes from verifiable project sources, and non-standard hosts provide either documentation, images, or game data that cannot execute code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and assets from various hosts including non-whitelisted ones, but all are used for building or as static data; the only executable built comes from verifiable project sources, and non-standard hosts provide either documentation, images, or game data that cannot execute code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 https://download.sf.net/$pkgname/OpenTitus_${pkgver}_src.zip
PKGBUILD:15 https://archive.org/download/Disk7/Disk7.iso

PKGBUILD

2 offending line(s) highlighted

      1pkgname=opentitus
    
      2pkgver=0.8.1
    
      3pkgrel=3
    
      4pkgdesc='Rewrite of the game engine used in the old DOS-based games Titus the Fox and Moktar (the French version)'
    
      5arch=(x86_64 aarch64)
    
      6url=https://opentitus.sourceforge.net/
    
      7license=(GPL3)
    
      8depends=(sdl_{mixer,image})
    
      9makedepends=(gcc9)
    
      10install=$pkgname.install
    
      11source=(
    
      12	https://download.sf.net/$pkgname/OpenTitus_${pkgver}_src.zip
    
      13	https://github.com/usineur/opentitus/raw/1f1c661392a71c734e5ee3916e2df5c3f9bef464/src/gates.c
    
      14	https://github.com/chocolate-doom/chocolate-doom/archive/refs/tags/chocolate-doom-2.0.0.tar.gz
    
      15	https://archive.org/download/Disk7/Disk7.iso
    
      16	usrlevel.7z	# http://ttf.mine.nu/cgi-bin/usrlevel.cgi, converted to SQZ with https://github.com/kaimitai/vtitus
    
      17	titus_usrlevel.diff
    
      18	$pkgname{.sh,{,-moktar,-usrlevel}.desktop}
    
      19	{titus,moktar,lagbonus}.png
    
      20	titusbig.webp	# https://www.artstation.com/artwork/ba3Olo
    
      21	lagafbig.webp)	# https://cpcrulez.fr/GamesTest/les_aventures_de_moktar.htm#DL, cutout with https://zyro.com/tools/image-background-remover
    
      22noextract=(
    
      23	${source[2]##*/}
    
      24	Disk7.iso
    
      25	usrlevel.7z)
    
      26md5sums=(
    
      27	96d8226064c7f6072dadd25f1460b135
    
      28	68f094cbc2c6af90a88a2672127f26f8
    
      29	e8f6ce424e40308bdd5f8282856876fa
    
      30	4996178ebf01d3271520de05727e2b99
    
      31	SKIP{,,,,,,,,,,})
    
      32build(){
    
      33	bsdtar xf ${source[2]##*/} chocolate-doom-chocolate-doom-2.0.0/opl/opl{.c,_{internal.h,queue.{c,h},sdl.c,timer.{c,h}}}
    
      34	cd OpenTitus_${pkgver}_src
    
      35	cp ../gates.c src
    
      36	mv ../chocolate-doom-chocolate-doom-2.0.0/opl/* opl
    
      37	sed -i 's,libopl_linux.a,dbopl_light.o opl/opl.o opl/opl_sdl.o opl/opl_queue.o,;1s,$, -I/usr/include/SDL,' Makefile_linux
    
      38	CC=gcc-9 make -f Makefile_linux
    
      39	sed -i /^videomode/s/0/1/ titus{,_moktar}.conf	# fullscreen by default
    
      40}
    
      41package(){
    
      42	mkdir -p "$pkgdir"/usr/share/$pkgname
    
      43	bsdtar xf Disk7.iso FOX/{FONTS,LEVELD,MENU,SPREXP,TIT{RE,US}}.SQZ
    
      44	mv FOX "$pkgdir"/usr/share/$pkgname/titus
    
      45	install {titus,moktar,lagbonus}.png -Dt "$pkgdir"/usr/share/icons/hicolor/32x32/apps
    
      46	install titusbig.webp -D "$pkgdir"/usr/share/icons/hicolor/512x512/apps/titus.png
    
      47	cp lagafbig.webp "$pkgdir"/usr/share/icons/hicolor/512x512/apps/moktar.png
    
      48	install $pkgname{,-moktar,-usrlevel}.desktop -Dt "$pkgdir"/usr/share/applications
    
      49	cd OpenTitus_${pkgver}_src
    
      50	install $pkgname ../$pkgname.sh -Dt "$pkgdir"/usr/bin
    
      51	cp -r titus{,_moktar.conf} moktar "$pkgdir"/usr/share/$pkgname
    
      52	bsdtar xf ../usrlevel.7z -C"$pkgdir"/usr/share/$pkgname
    
      53	patch titus.conf ../titus_usrlevel.diff -o "$pkgdir"/usr/share/$pkgname/titus_usrlevel.conf
    
      54	cp {,"$pkgdir"/usr/share/$pkgname/titus_}titus.conf
    
      55	install flags/bordered_18x12/00_cctld/{no,il,nl}.png -Dt "$pkgdir"/usr/share/$pkgname/flags/bordered_18x12/00_cctld
    
      56	install -D {,"$pkgdir"/usr/share/doc/$pkgname/}flags/readme.txt
    
      57	cp -r doc {Changelog,readme{,_linux}}.txt "$pkgdir"/usr/share/doc/$pkgname
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2