serioussam2-steam

maintainer jmsq · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a tarball from flibitijibibo.com (a personal/unofficial host run by Ethan Lee, a known Linux porter) and executes its install.sh script directly via `yes | ./install.sh`. While flibitijibibo.com is a real developer's site (Ethan Lee has done many Linux ports), this is still an unofficial binary/installer being fetched and executed. The md5sum is present (not SKIP), which provides some integrity guarantee, but MD5 is weak. The main concern is that the install.sh from this unofficial tarball is executed without inspection, and the tarball contains compiled binaries (a Linux port of Serious Sam 2). This is a genuine supply-chain concern: if flibitijibibo.com is compromised or the file is swapped, arbitrary code runs during package build. The steamcmd usage to fetch game data is legitimate (requires user credentials interactively). Overall this is a real medium-risk pattern — executed binaries/installer from a personal host — not a false positive, but also not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("flibitSam2_2070b.tar.gz::http://www.flibitijibibo.com/fedora/installers/flibitSam2_2070b.tar.gz" "serioussam2.desktop")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a tarball from flibitijibibo.com (a personal/unofficial host run by Ethan Lee, a known Linux porter) and executes its install.sh script directly via `yes | ./install.sh`. While flibitijibibo.com is a real developer's site (Ethan Lee has done many Linux ports), this is still an unofficial binary/installer being fetched and executed. The md5sum is present (not SKIP), which provides some integrity guarantee, but MD5 is weak. The main concern is that the install.sh from this unofficial tarball is executed without inspection, and the tarball contains compiled binaries (a Linux port of Serious Sam 2). This is a genuine supply-chain concern: if flibitijibibo.com is compromised or the file is swapped, arbitrary code runs during package build. The steamcmd usage to fetch game data is legitimate (requires user credentials interactively). Overall this is a real medium-risk pattern — executed binaries/installer from a personal host — not a false positive, but also not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: John-Michael Mulesa <jmulesa@gmail.com>
    
      2#
    
      3
    
      4pkgname=serioussam2-steam
    
      5pkgver=2.07
    
      6pkgrel=1
    
      7arch=('i686' 'x86_64')
    
      8makedepends=('steamcmd' 'xf86miscproto')
    
      9depends=('lib32-openal' 'lib32-libxxf86misc')
    
      10pkgdesc="Serious Sam 2 Linux using Steam game data"
    
      11source=("flibitSam2_2070b.tar.gz::http://www.flibitijibibo.com/fedora/installers/flibitSam2_2070b.tar.gz" "serioussam2.desktop")
    
      12license=('custom')
    
      13url='https://store.steampowered.com/app/204340/Serious_Sam_2/'
    
      14md5sums=('4ce30037da426e61465b667f75189cd0'
    
      15         'db1a519bd95d85014f72f98bfc505f7e')
    
      16
    
      17package() {
    
      18    mkdir -p $pkgdir/opt/serioussam2
    
      19    mkdir -p $srcdir/ss2
    
      20    cd $pkgdir/opt/serioussam2
    
      21    export DESTDIR=`pwd`
    
      22    sed -i 's/STEAMDIR="$HOME\/.wine\/drive_c\/Program Files\/Steam\/steamapps\/common\/serious sam 2"/STEAMDIR="$DESTDIR"/' $srcdir/Install/install.sh
    
      23    # Use steamcmd to get data.
    
      24    printf "Enter your Steam username:"
    
      25    read steam_username
    
      26    steamcmd +@sSteamCmdForcePlatformType windows +@ShutdownOnFailedCommand 1 +force_install_dir $srcdir/ss2 +login $steam_username "+app_update 204340 validate" +quit
    
      27
    
      28    cp -r $srcdir/Install $pkgdir/opt/serioussam2/
    
      29    # Move required files to pkgdir
    
      30    mkdir -p $pkgdir/opt/serioussam2
    
      31    cp -r $srcdir/ss2/* $pkgdir/opt/serioussam2/
    
      32    cd $pkgdir/opt/serioussam2/Install
    
      33    yes | ./install.sh
    
      34    chmod +x $pkgdir/opt/serioussam2/serioussam2*
    
      35    rm -rf $pkgdir/opt/serioussam2/steamapps
    
      36    ln -s /usr/lib32/libopenal.so.1 $pkgdir/opt/serioussam2/libopenal.so.0
    
      37    mkdir -p $pkgdir/usr/bin
    
      38    ln -s /opt/serioussam2/serioussam2 $pkgdir/usr/bin/serioussam2
    
      39    install -Dm644 "${srcdir}/serioussam2.desktop" \
    
      40      "${pkgdir}/usr/share/applications/serioussam2.desktop"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2