quake4-demo

maintainer Slash · 8 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and executes a prebuilt binary installer (quake4-linux-1.0-demo.x86.run) from aur.slashbunny.com, which is a personal/unofficial host rather than the original id Software or a well-known mirror. The installer is run directly during the build process (./quake4-linux-${pkgver}-demo.x86.run), meaning any compromise of that host or substitution of the file would result in arbitrary code execution on the builder's machine. The sha256sum provides some protection against in-transit tampering, but does not protect against the host owner serving a malicious file that matches a known-good hash (i.e., if the hash was set when the file was already malicious, or if the host owner updates both). The original id Software demo installer is no longer officially available, so hosting on a personal mirror is understandable, but it still represents a genuine supply-chain risk. This is a classic medium-severity concern: executed binary from an unofficial personal host with no way to verify it against an authoritative upstream source.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 'https://aur.slashbunny.com/quake4/quake4-linux-1.0-demo.x86.run')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and executes a prebuilt binary installer (quake4-linux-1.0-demo.x86.run) from aur.slashbunny.com, which is a personal/unofficial host rather than the original id Software or a well-known mirror. The installer is run directly during the build process (./quake4-linux-${pkgver}-demo.x86.run), meaning any compromise of that host or substitution of the file would result in arbitrary code execution on the builder's machine. The sha256sum provides some protection against in-transit tampering, but does not protect against the host owner serving a malicious file that matches a known-good hash (i.e., if the hash was set when the file was already malicious, or if the host owner updates both). The original id Software demo installer is no longer officially available, so hosting on a personal mirror is understandable, but it still represents a genuine supply-chain risk. This is a classic medium-severity concern: executed binary from an unofficial personal host with no way to verify it against an authoritative upstream source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Slash <demodevil5[at]yahoo[dot]com>
    
      2# Contributor: Andrew Simmons <andrew.simmons@gmail.com>
    
      3
    
      4pkgname=quake4-demo
    
      5pkgver=1.0
    
      6pkgrel=5
    
      7pkgdesc="Quake 4 demo"
    
      8url="https://web.archive.org/web/20061205073314/http://www.idsoftware.com/games/quake/quake4/"
    
      9arch=('i686' 'x86_64')
    
      10license=('custom:"Quake 4 Demo"')
    
      11depends_x86_64=('lib32-glibc' 'lib32-sdl' 'lib32-libx11' 'lib32-libxext' 'lib32-zlib')
    
      12depends_i686=('gcc-libs' 'libgl' 'sdl' 'zlib')
    
      13optdepends_x86_64=('lib32-nvidia-utils: Accelerated 3D with the NVIDIA binary blob video driver'
    
      14            'lib32-catalyst-utils: Accelerated 3D with the AMD/ATI binary blob video driver')
    
      15install="quake4-demo.install"
    
      16source=("${pkgname}.sh" "${pkgname}-dedicated.sh" \
    
      17    'https://aur.slashbunny.com/quake4/quake4-linux-1.0-demo.x86.run')
    
      18sha256sums=('6f0620a70380214bc57977b27e0d3584f48443e396faa136fabcb8f712b3b581'
    
      19            '57c10f7c4771c28ca2e24e5dd6671d01d93e6a5af8df99c42648b54748f7bfdd'
    
      20            '69e69e8cb22dd1496bcc98dc63f244d35c516c2e770aba64c72275827814bc73')
    
      21PKGEXT=.pkg.tar
    
      22
    
      23package() {
    
      24    cd ${srcdir}
    
      25
    
      26    # Create Destination Directories
    
      27    install -d ${pkgdir}/opt/ \
    
      28        ${pkgdir}/usr/bin \
    
      29        ${pkgdir}/usr/share/licenses/${pkgname}
    
      30
    
      31    # Make Installer Executable
    
      32    chmod +x quake4-linux-${pkgver}-demo.x86.run
    
      33
    
      34    # Run Installer
    
      35    ./quake4-linux-${pkgver}-demo.x86.run --noexec --target quake4
    
      36
    
      37    # Move Executables and Libraries
    
      38    install -m 755 -t ${srcdir}/quake4/ \
    
      39        ${srcdir}/quake4/bin/Linux/x86/{lib*,q4ded*,quake4*}
    
      40
    
      41    # Make Everything World-Readable
    
      42    chmod -R a+r ${srcdir}/quake4/
    
      43
    
      44    # Remove Unneeded Files
    
      45    rm -rf ${srcdir}/quake4/{germany/,setup.data/,setup.sh,us/,bin/}
    
      46
    
      47    # Move Quake4 to Destination Directory
    
      48    mv ${srcdir}/quake4 ${pkgdir}/opt/${pkgname}
    
      49
    
      50    # Install Client Launcher
    
      51    install -m755 -D ${pkgname}.sh \
    
      52        ${pkgdir}/opt/${pkgname}/${pkgname}
    
      53
    
      54    # Install Server Launcher
    
      55    install -m755 -D ${pkgname}-dedicated.sh \
    
      56        ${pkgdir}/opt/${pkgname}/${pkgname}-dedicated
    
      57
    
      58    # Symlink Client Launcher
    
      59    ln -sf /opt/${pkgname}/${pkgname} \
    
      60        ${pkgdir}/usr/bin/${pkgname}
    
      61
    
      62    # Symlink Server Launcher
    
      63    ln -sf /opt/${pkgname}/${pkgname}-dedicated \
    
      64        ${pkgdir}/usr/bin/${pkgname}-dedicated
    
      65
    
      66    # Install Licence File
    
      67    install -D -m644 ${pkgdir}/opt/${pkgname}/License.txt \
    
      68        ${pkgdir}/usr/share/licenses/${pkgname}/License.txt
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2