savage2

maintainer Slash · 65 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (.run file) from masterserver1.talesofnewerth.com and executes it during the build process. 'Tales of Newerth' is the company behind Savage 2 (S2 Games), so this is the official upstream distribution host for this game, not a random personal server. The game went free-to-play in 2008 and this is a legitimate distribution mechanism. However, the host is not a well-known canonical domain (like github.com or a major CDN), the sha512sums are present and pin the binary, and the installer is executed with --mode unattended. The checksums mitigate silent substitution risk significantly. The pattern of executing a downloaded .run installer is inherently a supply-chain concern (medium by policy), but the checksums and the fact that this is the official game server reduce the practical risk. Rating remains medium due to executed binary from a non-mainstream host, mitigated but not eliminated by the sha512 pinning.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://masterserver1.talesofnewerth.com/downloads/Savage2-${pkgver}-linux-x64-installer.run" \

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.run file) from masterserver1.talesofnewerth.com and executes it during the build process. 'Tales of Newerth' is the company behind Savage 2 (S2 Games), so this is the official upstream distribution host for this game, not a random personal server. The game went free-to-play in 2008 and this is a legitimate distribution mechanism. However, the host is not a well-known canonical domain (like github.com or a major CDN), the sha512sums are present and pin the binary, and the installer is executed with --mode unattended. The checksums mitigate silent substitution risk significantly. The pattern of executing a downloaded .run installer is inherently a supply-chain concern (medium by policy), but the checksums and the fact that this is the official game server reduce the practical risk. Rating remains medium due to executed binary from a non-mainstream host, mitigated but not eliminated by the sha512 pinning.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Slash <demodevil5 [at] yahoo [dot] com>
    
      2# Contributor: Ali H. Caliskan <ali.h.caliskan@gmail.com>
    
      3# Contributor: Xavier <shiningxc[at]gmail[dot]com>
    
      4
    
      5pkgname=savage2
    
      6pkgver=2.1.1.1
    
      7pkgrel=2
    
      8pkgdesc="Savage 2: A Tortured Soul is an fantasy themed online multiplayer team-based FPS/RTS/RPG hybrid. Completely free as of December 2008."
    
      9arch=('x86_64')
    
      10url='https://savage2.com/'
    
      11license=('custom: "Savage 2"')
    
      12depends=('mesa' 'libxml2' 'glu' 'ncurses5-compat-libs')
    
      13makedepends=('unzip')
    
      14install=savage2.install
    
      15source=("https://masterserver1.talesofnewerth.com/downloads/Savage2-${pkgver}-linux-x64-installer.run" \
    
      16'savage2.launcher' 'savage2.desktop' 's2editor.desktop' 's2mviewer.desktop' 'savage2.sh')
    
      17sha512sums=('9a568b5886ac0c86cd5132ab04d35ed8715f029a00a072eed5916e75153fcd0fe6b25b75995f44aa0585569358442f1a592f6637dff6280d5519e8a7b354f8f7'
    
      18            '5beba717e612dba323bacedb73f2cddd3844f51fc5d1f93f490b3d8e1597e6f3f9e1606e22a6e2dc9d3555cbc85c09cc762f9a2a4036e9f9f245e11c937f5453'
    
      19            '4f4fc1ec350f6ce4ddcc9f32ae251e151f315df3a8964ec1a900fbbf22376a488e8bd4bd87e86889c93127919c9298362a1f979418a15653925766a6dc6b96c7'
    
      20            'e5b7353fdf13bcb8bb5cb0a77757ed35bf19375c0ae5fd6341c65a28d3282eeeb60ff6471f6b9da5923c20d850bfcd20967f2636f1b100b427f2c087ee580553'
    
      21            'e17db181b90d8fb30c106f3b745d0251dccfea04c3c67d7aa4e247eb069ca7acc71471a46581f50ced812bcf6ccbc72f8e3f109d170d4d7f44f369abe684470a'
    
      22            'cd64032cb56bac763cb7f19112b8f86f1e0a7439797f1e955f73b96ce2f9b874cfc68b4e3f7bcf06f8dddd9481a65cc7699627fd3014984702d129e9b017b314')
    
      23PKGEXT='.pkg.tar'
    
      24
    
      25package() {
    
      26    cd "${srcdir}"
    
      27
    
      28    # Installer name
    
      29    _installer_name="Savage2-${pkgver}-linux-x64-installer.run"
    
      30
    
      31    # Create Destination Directory
    
      32    install -d "${pkgdir}/opt/savage2"
    
      33
    
      34    # Make Installer Executable
    
      35    chmod +x "${srcdir}/${_installer_name}"
    
      36
    
      37    # Run Installer
    
      38    "${srcdir}/${_installer_name}" --mode unattended --prefix "${pkgdir}/opt/savage2/"
    
      39
    
      40    # Remove old libraries
    
      41    rm "${pkgdir}/opt/savage2/libs/libstdc++.so.6"
    
      42
    
      43    # Install Game Script missing from 2.1.0.7
    
      44    install -D -m 755 "${srcdir}/savage2.sh" \
    
      45        "${pkgdir}/opt/savage2/savage2.sh"
    
      46
    
      47    # Install Game Launcher
    
      48    install -D -m 755 "${srcdir}/savage2.launcher" \
    
      49        "${pkgdir}/usr/bin/savage2"
    
      50
    
      51    # Install Desktop File (Game Client)
    
      52    install -D -m 644 "${srcdir}/savage2.desktop" \
    
      53        "${pkgdir}/usr/share/applications/savage2.desktop"
    
      54
    
      55    # Install Desktop File (Map Editor)
    
      56    install -D -m 644 "${srcdir}/s2editor.desktop" \
    
      57        "${pkgdir}/usr/share/applications/s2editor.desktop"
    
      58
    
      59    # Install Desktop File (Model Viewer)
    
      60    install -D -m 644 "${srcdir}/s2mviewer.desktop" \
    
      61        "${pkgdir}/usr/share/applications/s2mviewer.desktop"
    
      62
    
      63    # Install Icon
    
      64    install -D -m 644 "${pkgdir}/opt/savage2/s2icon.png" \
    
      65        "${pkgdir}/usr/share/pixmaps/savage2.png"
    
      66
    
      67    # Install License
    
      68    install -D -m 644 "${pkgdir}/opt/savage2/license.txt" \
    
      69        "${pkgdir}/usr/share/licenses/${pkgname}/license.txt"
    
      70}
    
      71
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2