sm64ex-redrawn-git

LOW

maintainer prurigro 4 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The non-standard host 'localhost' in source is likely a placeholder for a user-provided ROM file, not an executable download; the package builds from legitimate git sources and bundles only data (textures, ROM) with no remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host 'localhost' in source is likely a placeholder for a user-provided ROM file, not an executable download; the package builds from legitimate git sources and bundles only data (textures, ROM) with no remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "http://localhost/baserom.$_region.z64"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kevin MacMartin <prurigro@gmail.com>
    
      2# Contributor: Hekuran https://github.com/narukeh
    
      3# Contributor: selurvedu
    
      4
    
      5# A legally obtained copy of the Super Mario 64 ROM should be included
    
      6# The US version should have a sha1sum of 9bef1128717f958171a4afac3ed78ee2bb4e86ce
    
      7
    
      8_region=us
    
      9_pkgname=sm64ex
    
      10pkgname=$_pkgname-redrawn-git
    
      11pkgver=r646.58
    
      12pkgrel=3
    
      13pkgdesc='Super Mario 64 PC port (sm64ex fork) with the redrawn texture pack and HD Mario'
    
      14arch=('i686' 'x86_64' 'armv7h' 'aarch64')
    
      15url='https://github.com/sm64pc/sm64ex'
    
      16license=('reverse-engineered and unlicensed')
    
      17depends=('sdl2')
    
      18makedepends=('audiofile' 'git' 'python' 'unrar')
    
      19provides=($_pkgname)
    
      20conflicts=($_pkgname)
    
      21
    
      22source=(
    
      23  'git+https://github.com/sm64pc/sm64ex.git'
    
      24  'git+https://github.com/TechieAndroid/sm64redrawn'
    
      25  'hd-mario.rar' # HD Mario
    
      26  "$_pkgname.desktop"
    
      27  "$_pkgname.svg"
    
      28  "$_pkgname.sh"
    
      29  "http://localhost/baserom.$_region.z64"
    
      30)
    
      31
    
      32sha512sums=(
    
      33  'SKIP'
    
      34  'SKIP'
    
      35  '1fbe98f4ea4439b5fb5eff5d985df5815cf4b30333004cb64133b6fb6bb2b6afd8b3154c6df79d73ce07eb573779bcdb3e282ebda3f356f6cc347206da816f7d'
    
      36  '2e8979c01b314d7acce55f246390ff6667700b97da1831c058b16551e7c506886e4c87397266be5f53848016567eb1743cd4b14ff7d186fa2544e3a76d735755'
    
      37  'af383cb853eb13376bc9697986756b29c15c3c22f8e7da2fec0516f26e12613e209af6f0470eab483bbcf462778af7f01d412c67f5277691e9823dc5bd885a80'
    
      38  '7e6cbbac98800a714fc2074027b54aacdbd4bd2ea4f01f09b0fd764b775c2feef6021c1d36ce88703ca1b750cfd381695e7eaafa90d15f5d60b7bfbdfd21fe69'
    
      39  'SKIP'
    
      40)
    
      41
    
      42pkgver() {
    
      43  cd sm64redrawn
    
      44  redrawn_version=$(git rev-list --count HEAD)
    
      45  cd ../$_pkgname
    
      46  printf "r%s.%s" "$(git rev-list --count HEAD)" "$redrawn_version"
    
      47}
    
      48
    
      49prepare() {
    
      50  find actors -type f -exec cp '{}' $_pkgname/'{}' \; # HD Mario
    
      51  cd $_pkgname
    
      52  cp ../baserom.$_region.z64 . # Copy the ROM
    
      53}
    
      54
    
      55build() {
    
      56  cd $_pkgname
    
      57  make VERSION=$_region BETTERCAMERA=1 NODRAWINGDISTANCE=1 TEXTURE_FIX=1 EXTERNAL_DATA=1 ${MAKEFLAGS:--j$(nproc)}
    
      58}
    
      59
    
      60package() {
    
      61  install -Dm644 $_pkgname.desktop "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      62  install -Dm644 $_pkgname.svg "$pkgdir/usr/share/pixmaps/$_pkgname.svg"
    
      63  install -Dm755 $_pkgname.sh "$pkgdir/usr/bin/$_pkgname"
    
      64  install -Dm755 $_pkgname/build/${_region}_pc/sm64.${_region}.* "$pkgdir/usr/share/$_pkgname/$_pkgname"
    
      65  install -Dm644 $_pkgname/build/${_region}_pc/res/base.zip "$pkgdir/usr/share/$_pkgname/res/base.zip"
    
      66  cp -r --no-preserve=owner sm64redrawn/gfx "$pkgdir/usr/share/$_pkgname/res/" # sm64redrawn
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2