openttd-n-ice

maintainer entrix · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a patch archive from Dropbox (a personal/unofficial host) and applies it to the OpenTTD source before compiling. The Dropbox URL is mutable — the owner can swap the file at any time — and while a sha256sum is provided, that only protects against accidental corruption or a naive swap; it does not guarantee the content is trustworthy since the hash itself was supplied by the same maintainer. The patch is applied with `patch -p1 ... || true` (errors silently ignored), and a compiled binary plus a .grf data file from the same archive are installed. This is a classic medium-severity supply-chain concern: compiled code whose patch source is an unofficial, personally-controlled host rather than an upstream release mirror or VCS tag. The OpenTTD source itself comes from the official CDN with a checksum, so that part is fine. The risk is real but not evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://cdn.$_pkgname.org/$_pkgname-releases/$pkgver/$_pkgname-$pkgver-source.tar.xz"
PKGBUILD:23 "$pkgname-patches.zip::https://www.dropbox.com/s/pn8vepuxi26hj9x/${_pkgnamepretty}_${pkgver}_${_nice_release}_patch.zip?dl=1")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a patch archive from Dropbox (a personal/unofficial host) and applies it to the OpenTTD source before compiling. The Dropbox URL is mutable — the owner can swap the file at any time — and while a sha256sum is provided, that only protects against accidental corruption or a naive swap; it does not guarantee the content is trustworthy since the hash itself was supplied by the same maintainer. The patch is applied with `patch -p1 ... || true` (errors silently ignored), and a compiled binary plus a .grf data file from the same archive are installed. This is a classic medium-severity supply-chain concern: compiled code whose patch source is an unofficial, personally-controlled host rather than an upstream release mirror or VCS tag. The OpenTTD source itself comes from the official CDN with a checksum, so that part is fine. The risk is real but not evidence of active malice.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: entrix <invalid@invalid>
    
      2# Contributor: HeyCitizen <4637290+InTheMorning@users.noreply.github.com>
    
      3# Contributor: Vesa Kaihlavirta <vegai@iki.fi>
    
      4# Contributor: Hal Gentz <zegentzy@protonmail.com>
    
      5
    
      6pkgname=openttd-n-ice
    
      7_pkgname=openttd
    
      8_pkgnamepretty=OpenTTD
    
      9_nice_release=122A
    
      10pkgver=12.2
    
      11pkgrel=1
    
      12pkgdesc='OpenTTD with n-ice patches.'
    
      13arch=('x86_64')
    
      14url='http://www.n-ice.org/openttd/forum/index.php?topic=609.msg3555'
    
      15license=('GPL')
    
      16depends=(fluidsynth fontconfig hicolor-icon-theme libpng)
    
      17optdepends=('openttd-opengfx: free graphics'
    
      18            'openttd-openmsx: free musicset'
    
      19            'openttd-opensfx: free soundset')
    
      20makedepends=('cmake' 'ninja')
    
      21
    
      22source=("https://cdn.$_pkgname.org/$_pkgname-releases/$pkgver/$_pkgname-$pkgver-source.tar.xz"
    
      23        "$pkgname-patches.zip::https://www.dropbox.com/s/pn8vepuxi26hj9x/${_pkgnamepretty}_${pkgver}_${_nice_release}_patch.zip?dl=1")
    
      24sha256sums=(
    
      25            '81508f0de93a0c264b216ef56a05f8381fff7bffa6d010121a21490b4dace95c'
    
      26            '6efe936b6ef605e60372ba565cf91c977eced7096bf4fdbd569af5607adfa56a')
    
      27conflicts=('openttd')
    
      28
    
      29prepare() {
    
      30  cd $_pkgname-$pkgver
    
      31  sed -i '/sse/d;/SSE/d' CMakeLists.txt
    
      32  patch -p1 < "../${_pkgnamepretty}_${pkgver}_${_nice_release}_patch/public_${_nice_release}.diff" || true
    
      33}
    
      34
    
      35build() {
    
      36  cmake \
    
      37    -B build \
    
      38    -D CMAKE_BUILD_TYPE=Release \
    
      39    -D CMAKE_INSTALL_PREFIX=/usr \
    
      40    -D CMAKE_INSTALL_BINDIR=bin \
    
      41    -D CMAKE_INSTALL_DATADIR=/usr/share \
    
      42    -G Ninja \
    
      43    -S $_pkgname-$pkgver
    
      44  ninja -C build
    
      45}
    
      46
    
      47package() {
    
      48  DESTDIR="$pkgdir" ninja -C build install
    
      49  mkdir -p "${pkgdir}/usr/share/openttd/baseset/newgrf/"
    
      50  install -m644 -D "${_pkgnamepretty}_${pkgver}_${_nice_release}_patch/newgrf/innerhighlight.grf" "${pkgdir}/usr/share/openttd/baseset/newgrf/innerhighlight.grf"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2