render96ex-git

maintainer lod · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads project-specific assets and levels from non-whitelisted hosts, but these are non-executable data files for a game mod; the main code is built from a public Git repository, and the only local file used (baserom.us.z64) is a user-provided ROM with a proper checksum, posing no remote code execution or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads project-specific assets and levels from non-whitelisted hosts, but these are non-executable data files for a game mod; the main code is built from a public Git repository, and the only local file used (baserom.us.z64) is a user-provided ROM with a proper checksum, posing no remote code execution or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 https://sm64pc.info/downloads/levels/Render96_Bob_omb_Battlefield_v4.7z

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lod (aur@cyber-anlage.de)
    
      2
    
      3# Please put a legally purchased ROM of Super Mario 64 into the same directory with the name 'baserom.us.z64'.
    
      4# The ROM is checksummed to ensure that it is the correct version.
    
      5
    
      6pkgname=render96ex-git
    
      7pkgver=3.25.r849.61480c4e
    
      8pkgrel=2
    
      9pkgdesc='Super Mario 64 PC Port (sm64ex) fork including Render96 Textures, Models and Levels'
    
      10arch=('x86_64')
    
      11url='https://github.com/Render96/Render96ex'
    
      12license=('Unlicense')
    
      13makedepends=('git' 'python' 'audiofile' 'glu')
    
      14depends=('bash' 'gcc-libs' 'glibc' 'hicolor-icon-theme' 'libglvnd' 'sdl2' )
    
      15provides=(render96ex)
    
      16options=('!debug')
    
      17source=(git+https://github.com/Render96/Render96ex.git#branch=tester
    
      18		git+https://github.com/pokeheadroom/RENDER96-HD-TEXTURE-PACK.git
    
      19		git+https://github.com/Render96/ModelPack.git#branch=models_vanilla
    
      20		https://github.com/Render96/ModelPack/releases/download/${pkgver%%.r*}/Render96_DynOs_v${pkgver%%.r*}.7z
    
      21		https://sm64pc.info/downloads/levels/Render96_Bob_omb_Battlefield_v4.7z
    
      22		https://sm64pc.info/downloads/levels/Render96_Bowser_1_v3.7z
    
      23		https://sm64pc.info/downloads/levels/Render96_Bowser_2_v3.7z
    
      24		https://sm64pc.info/downloads/levels/Render96_Cool_Cool_Mountain_v3.7z
    
      25		https://sm64pc.info/downloads/levels/Render96_Jolly_Roger_Bay_v3.7z
    
      26		https://sm64pc.info/downloads/levels/Render96_Whomps_Fortress_v3.7z
    
      27		render96ex.sh
    
      28		render96ex.desktop
    
      29		render96ex.png
    
      30		file://baserom.us.z64)
    
      31		
    
      32b2sums=('SKIP'
    
      33        'SKIP'
    
      34        'SKIP'
    
      35        'ff0d769182e9ac82462f20e184683b3baefdbe1d45e2eeab98b865fc2d5c4e2b8c110542029053da64bb758edeab3d4a2a87a74829dc7c440ca3da1653e39e68'
    
      36        'b090ee9179141ff44cf5a39b6630db6666b0ea7a76836eb5f3dd1fcce568c4cec8a3b92185791330155f73fc4db5a9729a097f87e9097396236aa36da26c54f7'
    
      37        'd1a1ce2274b3e09e74c86c68b695d8075222346b2b5ebecfd1f4d793b190b94bd46494573b38392cd4d6c6ccbcd92c7970811a61a4ffe8d56077c32c8457081b'
    
      38        'f17dd5d3733b64288fd6e8b4606fcf635e30aee49a3761db10f006876a8a25278dc165b5632328c90953bd8438f69a405f6ee6b293f7e3f5ac3f152d847730da'
    
      39        'fb8d3d45d1204ab3579c6653ddf250cb0acfdba222fd760396c968a05ec54f55bd3172ea26ecd0d00810952aab02133ca20a9626360e5c3e2e6fdf9a11500c23'
    
      40        'a1808ddd9c2068f3809ba2db5aa5f78e36a4865a15804eaca1264481f2ceab2140e806b2e06d418420d655e146de4d1421d0c5d2e94309310dcdffb8ee6a86d2'
    
      41        '0cb89452a0972101b0b37ec0ce0da8a0a17c57fa99a90de59f099f04639ab37cedf179ec914a27b3b2ab3c925a6fe66ed647471b2a506c774e5c92690eccd989'
    
      42        '94568ad233c0e2f9901f088b0192e1f956b3cf39119598444970fe9d8125f2dbe5503cfb67287bdd2f0d67492ccb22e3cfede6206c930b33bcc7806a74e3cf0d'
    
      43        'b258240144334a2a3106a43897ada67acfcd4f0f494fc9b1fa094abb6af6d5a0c4919e2a98c5f310a403a450fc60b3504d2ee9a4f30725840639b25fe5203989'
    
      44        'c86b1aca74da0a1108bf1e3801ad6bd99ddd3ca46a1edce55f7549b1f06ffaf1c996058eaca21d806a618c0e739e2d1995bf22bb6b0d14cb9683180cfc25e213'
    
      45        'db73672334acf22d2ea182ebd8bffd472b9478dd2f4b117b178d8543ef61435386df5ff285d2f086d1f79fdf4dd7e19c78046376f791616627d4d50d40a874f9')
    
      46        
    
      47
    
      48pkgver() {
    
      49	cd "$srcdir/Render96ex"
    
      50	printf "${pkgver%%.r*}.r%s.%s" $(git rev-list --count HEAD) $(git rev-parse --short HEAD)
    
      51}
    
      52
    
      53prepare() {
    
      54	cd "$srcdir"
    
      55	cp baserom.us.z64 Render96ex/
    
      56
    
      57	cp -r ModelPack/Render96/* Render96ex/actors/
    
      58
    
      59	cp -r levels/* Render96ex/levels/
    
      60
    
      61	mkdir -p Render96ex/build/us_pc/dynos/packs/
    
      62	cp -r Render96_DynOS_v${pkgver%%.r*}	Render96ex/build/us_pc/dynos/packs/
    
      63	cp -r Render96\ Luigi\ v${pkgver%%.r*}	Render96ex/build/us_pc/dynos/packs/
    
      64	cp -r Render96\ Wario\ v${pkgver%%.r*}	Render96ex/build/us_pc/dynos/packs/
    
      65	cp -r Render96\ Mario\ v${pkgver%%.r*}	Render96ex/build/us_pc/dynos/packs/
    
      66	
    
      67	# add #include <stdio.h> to these files so it can build with SDL2-compat
    
      68	sed -i '/#include <SDL2\/SDL.h>/a #include <stdio.h>' Render96ex/src/pc/audio/audio_sdl.c Render96ex/src/pc/gfx/gfx_opengl.c
    
      69}
    
      70
    
      71build() {
    
      72	cd "$srcdir/Render96ex"
    
      73
    
      74	make VERSION=us EXTERNAL_DATA=1 TEXTURE_FIX=1 $MAKEFLAGS
    
      75}
    
      76
    
      77package() {
    
      78	cd "$srcdir"
    
      79	install -Dm755 render96ex.sh "$pkgdir/usr/bin/render96ex"
    
      80	install -Dm644 render96ex.desktop "$pkgdir/usr/share/applications/render96ex.desktop"
    
      81	install -Dm644 render96ex.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/render96ex.png"
    
      82	install -Dm755 Render96ex/build/us_pc/sm64.us.* "$pkgdir/usr/share/render96ex/render96ex"
    
      83
    
      84	cp -r --no-preserve=mode,ownership Render96ex/build/us_pc/res "$pkgdir/usr/share/render96ex/"
    
      85	cp -r --no-preserve=mode,ownership Render96ex/build/us_pc/dynos "$pkgdir/usr/share/render96ex/"
    
      86	cp -r --no-preserve=mode,ownership RENDER96-HD-TEXTURE-PACK/gfx/ "$pkgdir/usr/share/render96ex/res"
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2