re3-git

maintainer eugene · 9 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a git bundle from archive.org to restore the repository, which is a non-standard host, but this is a common practice for preserving git history; the source is used to build the project from its own code, and the realistic worst case of a swapped bundle is building modified source code, not remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a git bundle from archive.org to restore the repository, which is a non-standard host, but this is a common practice for preserving git history; the source is used to build the project from its own code, and the realistic worst case of a swapped bundle is building modified source code, not remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "re3.bundle::https://archive.org/download/github.com-GTAmodding-re3_-_2021-09-06_14-11-00/GTAmodding-re3_-_2021-09-06_14-11-00.bundle"

PKGBUILD

1 offending line(s) highlighted

      1_pkgbase=re3
    
      2pkgname=re3-git
    
      3pkgver=1.0.r294.g3233ffe
    
      4pkgrel=1
    
      5pkgdesc="Grand Theft Auto III reverse engineered"
    
      6arch=(x86_64 aarch64)
    
      7url="https://github.com/GTAmodding/re3"
    
      8license=(LicenseRef-None)
    
      9depends=(openal glfw mpg123 glibc gcc-libs sh zenity)
    
      10makedepends=(git premake glew)
    
      11provides=("$_pkgbase")
    
      12conflicts=("$_pkgbase")
    
      13source=(
    
      14    "re3.bundle::https://archive.org/download/github.com-GTAmodding-re3_-_2021-09-06_14-11-00/GTAmodding-re3_-_2021-09-06_14-11-00.bundle"
    
      15    "git+https://github.com/aap/librw.git"
    
      16    "git+https://github.com/xiph/ogg.git"
    
      17    "git+https://github.com/xiph/opus.git"
    
      18    "git+https://github.com/xiph/opusfile.git"
    
      19    'no_link_with_unnecessary_sndfile.patch'
    
      20    'disable_glfw_x11_detection.patch'
    
      21    're3-launcher'
    
      22    're3.desktop'
    
      23)
    
      24sha256sums=('035cb5f59811ae086510f02bd3817eaf43933c9723e52dba60807f48c4e9d9c3'
    
      25            'SKIP'
    
      26            'SKIP'
    
      27            'SKIP'
    
      28            'SKIP'
    
      29            '1d079928163893daa219a14cd3fa50de86b916ecbbeccb9587173d4b35d8e532'
    
      30            '57b827c1e908bec267e69e13dacb1d3f6e2d9737f08f44df752cd6f0c7f1eddc'
    
      31            '850d6e3ff7b92fcaadfcb52a3a8bd384122bcc1a2ee9e917f2b64991dd37ee3c'
    
      32            '7d19322282de244decac39a1b3aa54196b5f9ba3e3762dbde931c75710bf9931')
    
      33
    
      34pkgver() {
    
      35  cd "$srcdir/$_pkgbase"
    
      36  git describe --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      37}
    
      38
    
      39prepare() {
    
      40  # restore repo from bundle
    
      41  rm -fr "$srcdir/$_pkgbase"
    
      42  git clone re3.bundle "$srcdir/$_pkgbase"
    
      43
    
      44  cd "$srcdir/$_pkgbase"
    
      45  # restore missing tag
    
      46  git tag --force 1.0 e35c56ceb3eea3c3ccda1cc4e6645e901787d70a
    
      47
    
      48  git submodule init
    
      49  for submod in librw ogg opus opusfile
    
      50  do
    
      51    git config "submodule.vendor/$submod.url" "../$submod"
    
      52  done
    
      53  git -c protocol.file.allow=always submodule update
    
      54
    
      55  patch -uNp1 -i ../no_link_with_unnecessary_sndfile.patch
    
      56  # X11 detection is not possible anymore with combined glfw package
    
      57  patch -uNp1 -i ../disable_glfw_x11_detection.patch
    
      58}
    
      59
    
      60build() {
    
      61  cd "$srcdir/$_pkgbase"
    
      62  premake5 --with-librw gmake2
    
      63  ./printHash.sh src/extras/GitSHA1.cpp
    
      64  make -C build config=release_linux-amd64-librw_gl3_glfw-oal
    
      65  # Build LICENSE
    
      66  grep -A100 License README.md > LICENSE
    
      67}
    
      68
    
      69package() {
    
      70  cd "$srcdir/$_pkgbase"
    
      71  # Install binary
    
      72  install -Dm755 -t "$pkgdir/usr/bin" \
    
      73    "bin/linux-amd64-librw_gl3_glfw-oal/Release/re3" \
    
      74    ../re3-launcher
    
      75
    
      76  # Install application menu entry
    
      77  install -Dm644 ../re3.desktop "$pkgdir/usr/share/applications/re3.desktop"
    
      78  install -Dm644 res/images/logo.svg "$pkgdir/usr/share/pixmaps/re3.svg"
    
      79
    
      80  # Install gamefiles
    
      81  mkdir -p "$pkgdir/usr/share/games/re3"
    
      82  cp -a gamefiles "$pkgdir/usr/share/games/re3/"
    
      83  chmod og=rX -R "$pkgdir/usr/share/games/re3"
    
      84
    
      85  # Install LICENSE
    
      86  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/None"
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2