quake4

maintainer Slash · 55 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and executes a prebuilt binary installer (quake4-linux-1.4.2.x86.run) from aur.slashbunny.com, which is a personal/unofficial host rather than id Software or any official mirror. The binary is executed directly during the build process to extract game files. While a sha256sum is provided (offering some integrity protection against accidental corruption or simple MITM), the trust anchor is the maintainer's own server — if that host were compromised or the maintainer were malicious, the checksum in the PKGBUILD would simply be updated to match a trojaned binary. This is a classic supply-chain concern: an executed binary from a non-upstream, non-authoritative host. The original Quake 4 Linux installer was distributed by id Software/Activision; hosting a copy on a personal AUR-companion server is non-standard. This is a real medium-severity supply-chain risk, not a false positive, though there is no evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://aur.slashbunny.com/quake4/quake4-linux-${pkgver}.x86.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and executes a prebuilt binary installer (quake4-linux-1.4.2.x86.run) from aur.slashbunny.com, which is a personal/unofficial host rather than id Software or any official mirror. The binary is executed directly during the build process to extract game files. While a sha256sum is provided (offering some integrity protection against accidental corruption or simple MITM), the trust anchor is the maintainer's own server — if that host were compromised or the maintainer were malicious, the checksum in the PKGBUILD would simply be updated to match a trojaned binary. This is a classic supply-chain concern: an executed binary from a non-upstream, non-authoritative host. The original Quake 4 Linux installer was distributed by id Software/Activision; hosting a copy on a personal AUR-companion server is non-standard. This is a real medium-severity supply-chain risk, not a false positive, though there is no evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Slash <demodevil5 [at] yahoo [dot] com>
    
      2
    
      3pkgname=quake4
    
      4pkgver=1.4.2
    
      5pkgrel=5
    
      6pkgdesc="Quake 4 Engine. You need the retail .pk4 files to play."
    
      7url="https://web.archive.org/web/20061205073314/http://www.idsoftware.com/games/quake/quake4/"
    
      8license=('custom:"Quake 4"' \
    
      9         'custom:"PunkBuster"')
    
      10depends_x86_64=('lib32-glibc' 'lib32-sdl' 'lib32-libx11' 'lib32-libxext' 'lib32-zlib')
    
      11optdepends_x86_64=('lib32-nvidia-utils: Accelerated 3D with the NVIDIA binary blob video driver'
    
      12                   'lib32-catalyst-utils: Accelerated 3D with the AMD/ATI binary blob video driver')
    
      13depends_i686=('gcc-libs' 'libgl' 'sdl' 'zlib')
    
      14arch=('i686' 'x86_64')
    
      15install=quake4.install
    
      16source=('quake4.desktop' 'quake4.launcher' 'quake4-dedicated.launcher' 'quake4-smp.launcher' 'quake4.png' \
    
      17        "https://aur.slashbunny.com/quake4/quake4-linux-${pkgver}.x86.run")
    
      18sha256sums=('eb12f3832213af66eceb3a1639605522d10f7169b0a093b7892738bcab04dcf6'
    
      19            '3b5e0992f3399e1a01929008fd36b7c0e0216dcdd29da9f0665823f93ee4fb0f'
    
      20            'cfb3353c8c9d8be8a9a32ba05a48dca7c2125cef20159b85de7135c78a950e73'
    
      21            '62ba170609ca961430e39f7a24e23e1a3b28376e42f779e7e28714868d7758d1'
    
      22            '8bb8443f1f95e399ed16f8ae5c56a580185958d49ec1c8ecb29931bcbaa1bf79'
    
      23            '9203b387b1a4075a1b9ad1eb7be32b49a88141a448d9330d9cbe1f40a145bd6a')
    
      24
    
      25package() {
    
      26    cd "${srcdir}"
    
      27
    
      28    # Create Destination Directories
    
      29    install -d "${pkgdir}/opt/"
    
      30
    
      31    # Make Installer Executable
    
      32    chmod +x "${srcdir}/quake4-linux-${pkgver}.x86.run"
    
      33
    
      34    # Extract Files from Installer
    
      35    "${srcdir}/quake4-linux-${pkgver}.x86.run" --noexec --target quake4
    
      36
    
      37    # Move pk4 files to correct location
    
      38    mv "${srcdir}/quake4/us/q4base/"*.pk4 \
    
      39        "${srcdir}/quake4/q4base/"
    
      40
    
      41    # Move Executables and Libraries
    
      42    install -m 755 -t "${srcdir}/quake4/" \
    
      43        "${srcdir}/quake4/bin/Linux/x86/"{lib*,q4ded*,quake4*}
    
      44
    
      45    # Make Everything World-Readable
    
      46    chmod -R a+r "${srcdir}/quake4/"
    
      47
    
      48    # Remove Unneeded Files
    
      49    rm -rf "${srcdir}/quake4/"{germany/,setup.data/,setup.sh,us/,bin/}
    
      50
    
      51    # Move Quake4 to Destination Directory
    
      52    mv "${srcdir}/quake4" "${pkgdir}/opt/"
    
      53
    
      54    # Install Launcher (Client)
    
      55    install -D -m 755 "${srcdir}/quake4.launcher" \
    
      56        "${pkgdir}/usr/bin/quake4"
    
      57
    
      58    # Install Launcher (Client - SMP)
    
      59    install -D -m 755 "${srcdir}/quake4-smp.launcher" \
    
      60        "${pkgdir}/usr/bin/quake4-smp"
    
      61
    
      62    # Install Launcher (Server)
    
      63    install -D -m 755 "${srcdir}/quake4-dedicated.launcher" \
    
      64        "${pkgdir}/usr/bin/quake4-dedicated"
    
      65
    
      66    # Install License (Quake 4)
    
      67    install -D -m 644 "${pkgdir}/opt/quake4/License.txt" \
    
      68        "${pkgdir}/usr/share/licenses/quake4/License.txt"
    
      69
    
      70    # Install License (PunkBuster)
    
      71    install -D -m 644 "${pkgdir}/opt/quake4/pb/PBEULA.txt" \
    
      72        "${pkgdir}/usr/share/licenses/quake4/PBEULA.txt"
    
      73
    
      74    # Install Desktop File
    
      75    install -D -m 644 "${srcdir}/quake4.desktop" \
    
      76        "${pkgdir}/usr/share/applications/quake4.desktop"
    
      77
    
      78    # Install Icon File
    
      79    install -D -m 644 "${srcdir}/quake4.png" \
    
      80        "${pkgdir}/usr/share/pixmaps/quake4.png"
    
      81
    
      82    # Remove breaking local libraries
    
      83    rm ${pkgdir}/opt/quake4/{libgcc_s.so.1,libstdc++.so.6}
    
      84}
    
      85

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2