sm64ex-redrawn-git

maintainer prurigro · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host 'localhost' in source is likely a placeholder for a user-provided ROM file, not an executable download; the package builds from legitimate git sources and bundles only data (textures, ROM) with no remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host 'localhost' in source is likely a placeholder for a user-provided ROM file, not an executable download; the package builds from legitimate git sources and bundles only data (textures, ROM) with no remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "http://localhost/baserom.$_region.z64"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kevin MacMartin <prurigro@gmail.com>
    
      2# Contributor: Hekuran https://github.com/narukeh
    
      3# Contributor: selurvedu
    
      4
    
      5# A legally obtained copy of the Super Mario 64 ROM should be included
    
      6# The US version should have a sha1sum of 9bef1128717f958171a4afac3ed78ee2bb4e86ce
    
      7
    
      8_region=us
    
      9_pkgname=sm64ex
    
      10pkgname=$_pkgname-redrawn-git
    
      11pkgver=r646.58
    
      12pkgrel=3
    
      13pkgdesc='Super Mario 64 PC port (sm64ex fork) with the redrawn texture pack and HD Mario'
    
      14arch=('i686' 'x86_64' 'armv7h' 'aarch64')
    
      15url='https://github.com/sm64pc/sm64ex'
    
      16license=('reverse-engineered and unlicensed')
    
      17depends=('sdl2')
    
      18makedepends=('audiofile' 'git' 'python' 'unrar')
    
      19provides=($_pkgname)
    
      20conflicts=($_pkgname)
    
      21
    
      22source=(
    
      23  'git+https://github.com/sm64pc/sm64ex.git'
    
      24  'git+https://github.com/TechieAndroid/sm64redrawn'
    
      25  'hd-mario.rar' # HD Mario
    
      26  "$_pkgname.desktop"
    
      27  "$_pkgname.svg"
    
      28  "$_pkgname.sh"
    
      29  "http://localhost/baserom.$_region.z64"
    
      30)
    
      31
    
      32sha512sums=(
    
      33  'SKIP'
    
      34  'SKIP'
    
      35  '1fbe98f4ea4439b5fb5eff5d985df5815cf4b30333004cb64133b6fb6bb2b6afd8b3154c6df79d73ce07eb573779bcdb3e282ebda3f356f6cc347206da816f7d'
    
      36  '2e8979c01b314d7acce55f246390ff6667700b97da1831c058b16551e7c506886e4c87397266be5f53848016567eb1743cd4b14ff7d186fa2544e3a76d735755'
    
      37  'af383cb853eb13376bc9697986756b29c15c3c22f8e7da2fec0516f26e12613e209af6f0470eab483bbcf462778af7f01d412c67f5277691e9823dc5bd885a80'
    
      38  '7e6cbbac98800a714fc2074027b54aacdbd4bd2ea4f01f09b0fd764b775c2feef6021c1d36ce88703ca1b750cfd381695e7eaafa90d15f5d60b7bfbdfd21fe69'
    
      39  'SKIP'
    
      40)
    
      41
    
      42pkgver() {
    
      43  cd sm64redrawn
    
      44  redrawn_version=$(git rev-list --count HEAD)
    
      45  cd ../$_pkgname
    
      46  printf "r%s.%s" "$(git rev-list --count HEAD)" "$redrawn_version"
    
      47}
    
      48
    
      49prepare() {
    
      50  find actors -type f -exec cp '{}' $_pkgname/'{}' \; # HD Mario
    
      51  cd $_pkgname
    
      52  cp ../baserom.$_region.z64 . # Copy the ROM
    
      53}
    
      54
    
      55build() {
    
      56  cd $_pkgname
    
      57  make VERSION=$_region BETTERCAMERA=1 NODRAWINGDISTANCE=1 TEXTURE_FIX=1 EXTERNAL_DATA=1 ${MAKEFLAGS:--j$(nproc)}
    
      58}
    
      59
    
      60package() {
    
      61  install -Dm644 $_pkgname.desktop "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      62  install -Dm644 $_pkgname.svg "$pkgdir/usr/share/pixmaps/$_pkgname.svg"
    
      63  install -Dm755 $_pkgname.sh "$pkgdir/usr/bin/$_pkgname"
    
      64  install -Dm755 $_pkgname/build/${_region}_pc/sm64.${_region}.* "$pkgdir/usr/share/$_pkgname/$_pkgname"
    
      65  install -Dm644 $_pkgname/build/${_region}_pc/res/base.zip "$pkgdir/usr/share/$_pkgname/res/base.zip"
    
      66  cp -r --no-preserve=owner sm64redrawn/gfx "$pkgdir/usr/share/$_pkgname/res/" # sm64redrawn
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2