openttd-n-ice

MEDIUM

maintainer entrix 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a patch archive from Dropbox (a personal/unofficial host) and applies it to the OpenTTD source before compiling. The Dropbox URL is mutable — the owner can swap the file at any time — and while a sha256sum is provided, that only protects against accidental corruption or a naive swap; it does not guarantee the content is trustworthy since the hash itself was supplied by the same maintainer. The patch is applied with `patch -p1 ... || true` (errors silently ignored), and a compiled binary plus a .grf data file from the same archive are installed. This is a classic medium-severity supply-chain concern: compiled code whose patch source is an unofficial, personally-controlled host rather than an upstream release mirror or VCS tag. The OpenTTD source itself comes from the official CDN with a checksum, so that part is fine. The risk is real but not evidence of active malice.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://cdn.$_pkgname.org/$_pkgname-releases/$pkgver/$_pkgname-$pkgver-source.tar.xz"
PKGBUILD:23 "$pkgname-patches.zip::https://www.dropbox.com/s/pn8vepuxi26hj9x/${_pkgnamepretty}_${pkgver}_${_nice_release}_patch.zip?dl=1")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a patch archive from Dropbox (a personal/unofficial host) and applies it to the OpenTTD source before compiling. The Dropbox URL is mutable — the owner can swap the file at any time — and while a sha256sum is provided, that only protects against accidental corruption or a naive swap; it does not guarantee the content is trustworthy since the hash itself was supplied by the same maintainer. The patch is applied with `patch -p1 ... || true` (errors silently ignored), and a compiled binary plus a .grf data file from the same archive are installed. This is a classic medium-severity supply-chain concern: compiled code whose patch source is an unofficial, personally-controlled host rather than an upstream release mirror or VCS tag. The OpenTTD source itself comes from the official CDN with a checksum, so that part is fine. The risk is real but not evidence of active malice.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: entrix <invalid@invalid>
    
      2# Contributor: HeyCitizen <4637290+InTheMorning@users.noreply.github.com>
    
      3# Contributor: Vesa Kaihlavirta <vegai@iki.fi>
    
      4# Contributor: Hal Gentz <zegentzy@protonmail.com>
    
      5
    
      6pkgname=openttd-n-ice
    
      7_pkgname=openttd
    
      8_pkgnamepretty=OpenTTD
    
      9_nice_release=122A
    
      10pkgver=12.2
    
      11pkgrel=1
    
      12pkgdesc='OpenTTD with n-ice patches.'
    
      13arch=('x86_64')
    
      14url='http://www.n-ice.org/openttd/forum/index.php?topic=609.msg3555'
    
      15license=('GPL')
    
      16depends=(fluidsynth fontconfig hicolor-icon-theme libpng)
    
      17optdepends=('openttd-opengfx: free graphics'
    
      18            'openttd-openmsx: free musicset'
    
      19            'openttd-opensfx: free soundset')
    
      20makedepends=('cmake' 'ninja')
    
      21
    
      22source=("https://cdn.$_pkgname.org/$_pkgname-releases/$pkgver/$_pkgname-$pkgver-source.tar.xz"
    
      23        "$pkgname-patches.zip::https://www.dropbox.com/s/pn8vepuxi26hj9x/${_pkgnamepretty}_${pkgver}_${_nice_release}_patch.zip?dl=1")
    
      24sha256sums=(
    
      25            '81508f0de93a0c264b216ef56a05f8381fff7bffa6d010121a21490b4dace95c'
    
      26            '6efe936b6ef605e60372ba565cf91c977eced7096bf4fdbd569af5607adfa56a')
    
      27conflicts=('openttd')
    
      28
    
      29prepare() {
    
      30  cd $_pkgname-$pkgver
    
      31  sed -i '/sse/d;/SSE/d' CMakeLists.txt
    
      32  patch -p1 < "../${_pkgnamepretty}_${pkgver}_${_nice_release}_patch/public_${_nice_release}.diff" || true
    
      33}
    
      34
    
      35build() {
    
      36  cmake \
    
      37    -B build \
    
      38    -D CMAKE_BUILD_TYPE=Release \
    
      39    -D CMAKE_INSTALL_PREFIX=/usr \
    
      40    -D CMAKE_INSTALL_BINDIR=bin \
    
      41    -D CMAKE_INSTALL_DATADIR=/usr/share \
    
      42    -G Ninja \
    
      43    -S $_pkgname-$pkgver
    
      44  ninja -C build
    
      45}
    
      46
    
      47package() {
    
      48  DESTDIR="$pkgdir" ninja -C build install
    
      49  mkdir -p "${pkgdir}/usr/share/openttd/baseset/newgrf/"
    
      50  install -m644 -D "${_pkgnamepretty}_${pkgver}_${_nice_release}_patch/newgrf/innerhighlight.grf" "${pkgdir}/usr/share/openttd/baseset/newgrf/innerhighlight.grf"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2