riven-original-data

maintainer dreieck · 0 votes · base riven-original · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the original game ISO and strategy guide from archive.org and a community site, which are non-whitelisted but plausible archival sources; however, these are data files, not executable code, and the build process only converts media, posing minimal security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the original game ISO and strategy guide from archive.org and a community site, which are non-whitelisted but plausible archival sources; however, these are data files, not executable code, and the build process only converts media, posing minimal security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 'riven.dvd.iso::https://archive.org/download/riven_202001/Riven.iso'
PKGBUILD:33 'riven-strategy-guide.pdf::https://www.allthingsuru.com/AllThingsUru/pdf/Riven%20The%20Sequel%20to%20Myst%20Prima%20Official%20eGuide.pdf'

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3_pkgbase="riven-original"
    
      4pkgbase="${_pkgbase}"
    
      5pkgname=(
    
      6  "riven-original"
    
      7  "riven-original-data"
    
      8  "riven-original-strategyguide"
    
      9  "riven-original-makingof"
    
      10)
    
      11pkgdesc="'Riven: The Sequel to Myst' is a 1997 point-and-click puzzle adventure game with superb landscape immersion. This is the original game, not the remake."
    
      12groups=(
    
      13  'myst'
    
      14  'riven'
    
      15)
    
      16arch=('any')
    
      17url='https://cyan.com/games/riven/'
    
      18epoch="0"
    
      19pkgver='1.2_20030721_dvd' # Obtained from the file 'Read Instructions First'.
    
      20pkgrel=6
    
      21_newestoriginalver='1.2_20231231_dvd' # Assumed highest possible version number of 'riven' that is for the original game.
    
      22makedepends=(
    
      23  'dos2unix'    # To convert text files with Mac and DOS new line standard to Unix new line standard.
    
      24  'ffmpeg'      # To convert the Making Of-movie to smaller filesize.
    
      25  'imagemagick' # To convert .ico to .png.
    
      26  'zopfli'      # To size-optimise PNG files.
    
      27  # 'littleutils' # For 'lowercase'.
    
      28)
    
      29options+=('emptydirs')
    
      30
    
      31source=(
    
      32  'riven.dvd.iso::https://archive.org/download/riven_202001/Riven.iso'
    
      33  'riven-strategy-guide.pdf::https://www.allthingsuru.com/AllThingsUru/pdf/Riven%20The%20Sequel%20to%20Myst%20Prima%20Official%20eGuide.pdf' # http://web.archive.org/web/20231001122618/https://www.allthingsuru.com/AllThingsUru/pdf/Riven%20The%20Sequel%20to%20Myst%20Prima%20Official%20eGuide.pdf
    
      34  'riven.sh'
    
      35  'riven.desktop'
    
      36  'license-strategy-guide.txt'
    
      37  'license-note.txt'
    
      38)
    
      39
    
      40sha256sums=(
    
      41  '90f4e43a4fcb6cddc50497eccd235b79590beaa4bf8e432ddb87755b8fbab0fe'  # riven.dvd.iso
    
      42  '523a9f5c9d29d05a9eb90339ac676f4b2f352e0317f399cc5ed71f7d6bfe731e'  # riven-strategy-guide.pdf
    
      43  'ee6a4ba3dbd61e7d0fb14476b64df0aced66a5486f4cfee3c9f09eb944e7852b'  # riven.sh
    
      44  '7b4d5fb2f60281cbd4c031f99923f8122ff7dd5996ce395cba99e498309dc270'  # riven.desktop
    
      45  'bb8aa13d8598a8c2e8466183481cd5b849afec44ce54ff68327a7650c8bdc99a'  # license-strategy-guide.txt
    
      46  'f92e92e57ae86a3d490c81d965e5d51779afef61c869ed4c9d9e0b6411c1789c'  # license-note.txt
    
      47)
    
      48
    
      49prepare() {
    
      50  cd "${srcdir}"
    
      51
    
      52  ## If 'riven-data' is not yet installed, then ask for confirmation:
    
      53  if ! (pacman -Qqi 'riven-original-data' > /dev/null 2>&1 || pacman -Qqi "riven-data<=${_newestoriginalver}" > /dev/null 2>&1); then
    
      54    ## Check if the user has a legal copy (by trusting the user).  
    
      55    #  Ideally, we want to have it before downloading stuff, but if we put it in the general part if the `PKGBUILD` then it is executed each time the `PKGBUILD` is parsed, so also at the creation of `.SRCINFO`.
    
      56    local _legalcopy
    
      57    msg2 "Please make sure you have obtained a legal copy of the game before continuing!"
    
      58    read -e -p "Enter 'i have a legal copy of riven original' (without quotes) to continue, anything else to abort and DELETE DOWNLOADED DATA: " _legalcopy
    
      59    if [ "${_legalcopy}x" != "i have a legal copy of riven original"x ]; then
    
      60      rm -fv "${SRCDEST}/${source[0]%%::*}"
    
      61      rm -Rfv "${srcdir}"/*
    
      62      error "No legal copy, aborting."
    
      63      return 22
    
      64    fi
    
      65  fi
    
      66
    
      67  mkdir -p build
    
      68}
    
      69
    
      70build() {
    
      71  cd "${srcdir}"
    
      72
    
      73  mac2unix -n 'Read EULA First' 'build/Riven_license.txt'
    
      74  mac2unix -n 'Read Instructions First' 'build/Riven_Instructions.txt'
    
      75  dos2unix -n 'English/movie.txt' 'build/movie.txt'
    
      76
    
      77  printf '%s\n' "Converting 'English/Icon.ICO' to 'riven.png' ..."
    
      78  convert 'English/Icon.ICO' 'build/riven.png'
    
      79  zopflipng -m -y 'build/riven.png' 'build/riven.png'
    
      80
    
      81  printf '%s\n' "Converting 'The Making of Riven/Makingof.mov' to AV1 + OPUS codec ..."
    
      82  ffmpeg \
    
      83    -i "The Making of Riven/Makingof.mov" \
    
      84    -c:v libsvtav1 -crf 26 -preset 3 -g 300 \
    
      85    -c:a libopus -b:a 98304 -vbr on -compression_level 10 -frame_duration 60 -application audio \
    
      86    -y "build/Makingof.mkv"
    
      87}
    
      88
    
      89package_riven-original() {
    
      90  pkgdesc="'Riven: The Sequel to Myst' is a 1997 point-and-click puzzle adventure game with superb landscape immersion. This is the original game, not the remake."
    
      91  # url='https://wiki.scummvm.org/index.php/Riven:_The_Sequel_to_Myst'
    
      92  url='https://cyan.com/games/riven/'
    
      93  license=('GPL-3.0-or-later')
    
      94  depends=(
    
      95    'riven-data'
    
      96    'scummvm'
    
      97  )
    
      98  optdepends=(
    
      99    "riven-makingof: Movie 'The Making of Riven'."
    
      100    "riven-soundtrack: Soundtrack of Riven."
    
      101  )
    
      102  provides=("riven=${pkgver}")
    
      103  conflicts=("riven<=${_newestoriginalver}")
    
      104  replaces=("riven<=${_newestoriginalver}")
    
      105
    
      106  cd "${srcdir}"
    
      107
    
      108  install -D -v -m755 "${srcdir}/riven.sh" "${pkgdir}/usr/bin/riven"
    
      109  install -D -v -m644 "${srcdir}/riven.desktop" "${pkgdir}/usr/share/applications/riven.desktop"
    
      110  install -D -v -m644 "${srcdir}/build/riven.png" "${pkgdir}/usr/share/pixmaps/riven.png"
    
      111
    
      112  install -d -v -m755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      113  cd "${pkgdir}/usr/share/licenses/${pkgname}"
    
      114  ln -sv "../spdx/GPL-3.0-or-later.txt" "Myst4-startscript-license.txt"
    
      115}
    
      116
    
      117package_riven-original-data() {
    
      118  pkgdesc="Data files for the point-and-click adventure/ puzzle game 'Riven: The Sequel to Myst'. Can be directly used with ScummVM. This is the game data of the original game, not the remake."
    
      119  url='https://archive.org/details/riven_202001'
    
      120  license=('LicenseRef-proprietary:Cyan Worlds')
    
      121  optdepends=(
    
      122    "riven-original: To actually launch the game just by executing '/usr/bin/riven'."
    
      123    "riven-original-strategyguide: For help when you are stuck."
    
      124    "scummvm: To play the game by manually launching ScummVM and adding the game to ScummVM."
    
      125  )
    
      126  provides=("riven-data=${pkgver}")
    
      127  conflicts=("riven-data<=${_newestoriginalver}")
    
      128  replaces=("riven-data<=${_newestoriginalver}")
    
      129
    
      130
    
      131  cd "${srcdir}"
    
      132
    
      133  local _mhk
    
      134  install -v -d -m755 "${pkgdir}/usr/lib/riven"
    
      135  for _mhk in Data/*.[mM][hH][kK]; do
    
      136    install -v -D -m644 "${_mhk}" "${pkgdir}/usr/lib/riven/$(basename "${_mhk}")"
    
      137  done
    
      138  for _mhk in ASSETS1/*.[mM][hH][kK]; do # Files in ASSETS1 might have better quality, so use them over the ones from Data1.
    
      139    install -v -D -m644 "${_mhk}" "${pkgdir}/usr/lib/riven/$(basename "${_mhk}")"
    
      140  done
    
      141  # lowercase "${pkgdir}/usr/lib/riven"/*
    
      142
    
      143  # One of the following three may be used interchangeably for playing Riven with ScummVM:
    
      144  install -v -D -m755 "program/arcriven.z" "${pkgdir}/usr/lib/riven/arcriven.z"
    
      145  #install -v -D -m755 "English/Riven"     "${pkgdir}/usr/lib/riven/Riven"
    
      146  #install -v -D -m755 "English/Riven.exe" "${pkgdir}/usr/lib/riven/Riven.exe"
    
      147
    
      148  install -v -D -m644 "${srcdir}/build/Riven_Instructions.txt" "${pkgdir}/usr/share/doc/${_pkgbase}/Riven_Instructions.txt"
    
      149  install -v -D -m644 "${srcdir}/English/Manual.pdf" "${pkgdir}/usr/share/doc/${_pkgbase}/Manual.pdf"
    
      150
    
      151  install -v -D -m644 "${srcdir}/license-note.txt" "${pkgdir}/usr/share/licenses/${pkgname}/license-note.txt"
    
      152  install -v -D -m644 "${srcdir}/build/Riven_license.txt" "${pkgdir}/usr/share/licenses/${pkgname}/Riven_license.txt"
    
      153
    
      154  ln -sv "/usr/share/licenses/${pkgname}/Riven_license.txt" "${pkgdir}/usr/share/doc/${_pkgbase}/Riven_license.txt"
    
      155}
    
      156
    
      157package_riven-original-strategyguide() {
    
      158  pkgdesc="Help guide for the point-and-click adventure/ puzzle game 'Riven: The Sequel to Myst'. This is the strategy guide for the original game, not the remake."
    
      159  url='https://www.allthingsuru.com/AllThingsUru/pdf/Riven%20The%20Sequel%20to%20Myst%20Prima%20Official%20eGuide.pdf'
    
      160  license=('LicenseRef-proprietary:Prima Games')
    
      161  optdepends=(
    
      162    "riven-original: To actually launch the game just by executing '/usr/bin/riven'."
    
      163    "riven-original-data: The game data files, to be played with ScummVM."
    
      164  )
    
      165  provides=("riven-strategyguide=${pkgver}")
    
      166  conflicts=("riven-strategyguide<=${_newestoriginalver}")
    
      167  replaces=("riven-strategyguide<=${_newestoriginalver}")
    
      168
    
      169  install -Dvm644 -t "${pkgdir}/usr/share/doc/${_pkgbase}" "${srcdir}/riven-strategy-guide.pdf"
    
      170  install -Dvm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" "${srcdir}/license-strategy-guide.txt"
    
      171  ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/license-strategy-guide.txt" "${pkgdir}/usr/share/doc/${_pkgbase}/license-strategy-guide.txt"
    
      172}
    
      173
    
      174package_riven-original-makingof() {
    
      175  pkgdesc="Movie 'The Making of Riven', a point-and-click immersive puzzle adventure game. This is for the original game, not the remake."
    
      176  url='https://archive.org/details/riven_202001'
    
      177  license=('LicenseRef-proprietary')
    
      178  optdepends=(
    
      179    'riven-original: To play the game.'
    
      180    "riven-original-soundtrack: Soundtrack of the original game of Riven."
    
      181  )
    
      182  provides=("riven-makingof=${pkgver}")
    
      183  conflicts=("riven-makingof<=${_newestoriginalver}")
    
      184  replaces=("riven-makingof<=${_newestoriginalver}")
    
      185
    
      186
    
      187  cd "${srcdir}"
    
      188
    
      189  # install -v -D -m644 "${srcdir}/The Making of Riven/Makingof.mov" "${pkgdir}/usr/share/doc/${_pkgbase}/The_Making_of_Riven/Makingof.mov"
    
      190  install -v -D -m644 "${srcdir}/build/Makingof.mkv" "${pkgdir}/usr/share/doc/${_pkgbase}/The_Making_of_Riven/Makingof.mkv"
    
      191  install -v -D -m644 "${srcdir}/build/movie.txt" "${pkgdir}/usr/share/doc/${_pkgbase}/The_Making_of_Riven/movie.txt"
    
      192
    
      193  install -v -D -m644 "${srcdir}/build/movie.txt" "${pkgdir}/usr/share/licenses/${pkgname}/The_Making_of_Riven.license.txt"
    
      194}
    
      195

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2