purity

LOW

maintainer MCMic 6 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads game data files (pk3) from the project's own domain, which is not on the whitelist but plausibly official; these are non-executable assets, so the worst case of a swapped source is limited to data tampering, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads game data files (pk3) from the project's own domain, which is not on the whitelist but plausibly official; these are non-executable assets, so the worst case of a swapped source is limited to data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=('http://vectorpoem.com/purity/latest_content/core.pk3'

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: MCMic <come@chilliet.eu>
    
      2
    
      3pkgname=purity
    
      4pkgver=20071027
    
      5pkgrel=6
    
      6pkgdesc="An abstract first-person shooter built on the Quake3 engine."
    
      7arch=('i686' 'x86_64')
    
      8url="http://vectorpoem.com/purity/"
    
      9license=('GPL')
    
      10depends=()
    
      11makedepends=('make' 'mercurial')
    
      12optdepends=('zenity: allow using purity-zen to choose graphically the map')
    
      13source=('http://vectorpoem.com/purity/latest_content/core.pk3'
    
      14        'http://vectorpoem.com/purity/latest_content/map0.pk3'
    
      15        'http://vectorpoem.com/purity/latest_content/vm.pk3'
    
      16        'purity-zen'
    
      17        'hg+https://bitbucket.org/JPLeBreton/purity')
    
      18noextract=( 'core.pk3'
    
      19            'map0.pk3'
    
      20            'vm.pk3')
    
      21md5sums=('4f5b6af36a738a54570f21fb24177edd'
    
      22         'b7f5730e443ea5c066d7ef67bce09892'
    
      23         '8396c0dfe49c31ff866800837bf80d9d'
    
      24         '8361d4586bf2c0dd1a31edddf8b70d89'
    
      25         'SKIP')
    
      26
    
      27pgkver() {
    
      28    cd $srcdir/$pkgname
    
      29
    
      30    # As per the wiki the version is r<commit number>.<commit hash>
    
      31    printf "r%s.%s" "$(hg identify -n)" "$(hg identify -i)"
    
      32}
    
      33
    
      34build() {
    
      35    cd $srcdir/$pkgname
    
      36    make
    
      37    
    
      38    msg "Cleaning and adapting scripts"
    
      39    build_folder=`ls ${srcdir}/$pkgname/build`
    
      40    bin_name=`ls ${srcdir}/$pkgname/build/$build_folder | grep "purity\."`
    
      41    bin_serv=`ls ${srcdir}/$pkgname/build/$build_folder | grep "purity-ded"`
    
      42    bin_path=/opt/$pkgname/build/$build_folder/$bin_name
    
      43    serv_path=/opt/$pkgname/build/$build_folder/$bin_serv
    
      44    _bin=`echo $bin_path | sed "s|\/|\\\/|g"`
    
      45    _serv=`echo $serv_path | sed "s|\/|\\\/|g"`
    
      46    rm *.exe
    
      47    for i in `ls *.bat | cut -d'.' -f1`
    
      48        do sed -i "s|@start purity.x86|$_bin|" $i.bat
    
      49        sed -i "s|@start purity-ded.x86|$_serv|" $i.bat
    
      50        mv $i.bat $i.sh
    
      51        chmod +x $i.sh
    
      52    done
    
      53
    
      54    sed -i "s|purity_cmd|$_bin|" ${srcdir}/purity-zen
    
      55}
    
      56
    
      57package() {
    
      58    mkdir -p ${pkgdir}/usr/bin
    
      59    cp ${srcdir}/$pkgname/purity.sh ${pkgdir}/usr/bin/
    
      60    cp ${srcdir}/purity-zen ${pkgdir}/usr/bin/
    
      61    mkdir -p ${pkgdir}/opt/$pkgname/build/$build_folder/base
    
      62    cp -r ${srcdir}/$pkgname ${pkgdir}/opt/
    
      63    cp ${srcdir}/*.pk3 ${pkgdir}/opt/$pkgname/build/$build_folder/base/
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2