sonicthehedgehog2

maintainer gameslayer · 2 votes · scanned 2026-08-03 00:08:14.047287

HIGH

piracy

Why flagged This PKGBUILD downloads 'Data.rsdk' from archive.org during the package() phase without including it in source=() and without any checksum verification. The file is the proprietary game data for Sonic the Hedgehog 2 (a commercial Sega title), making this a piracy concern — the game data is being redistributed/fetched from an unofficial archive without authorization. Beyond piracy, the unverified runtime download of an executed/loaded game asset from an uncontrolled third-party host (archive.org item 'data_20231229') is a supply-chain risk: the file could be replaced or tampered with and would be installed silently. The combination of piracy (distributing commercial game data) and unverified external binary asset download warrants both the piracy flag and medium severity.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:30 wget "https://archive.org/download/data_20231229/Data.rsdk"

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 85%): This PKGBUILD downloads 'Data.rsdk' from archive.org during the package() phase without including it in source=() and without any checksum verification. The file is the proprietary game data for Sonic the Hedgehog 2 (a commercial Sega title), making this a piracy concern — the game data is being redistributed/fetched from an unofficial archive without authorization. Beyond piracy, the unverified runtime download of an executed/loaded game asset from an uncontrolled third-party host (archive.org item 'data_20231229') is a supply-chain risk: the file could be replaced or tampered with and would be installed silently. The combination of piracy (distributing commercial game data) and unverified external binary asset download warrants both the piracy flag and medium severity.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=sonicthehedgehog2
    
      2_pkgname=SonicTheHedgehog2
    
      3pkgver=1.0.3
    
      4pkgrel=1
    
      5pkgdesc="Sonic the Hedgehog 2 game powered by the rsdkv4 engine."
    
      6arch=('x86_64' 'aarch64' 'i686')
    
      7url="https://gitlab.com/linuxbombay/sonicthehedgehog2"
    
      8license=('GPL')
    
      9depends=('rsdkv4-bin' 'libogg' 'libvorbis' 'wget' 'sdl2' 'unzip' 'yad')
    
      10makedepends=('unzip')
    
      11source=("https://gitlab.com/linuxbombay/sonicthehedgehog2/-/archive/$pkgver/sonicthehedgehog2-$pkgver.tar.bz2")
    
      12sha256sums=('2918db8ac15f8c42d82dcc08336018a8fcba1671785f1cd95da3f7b0b0987166')
    
      13
    
      14package() {
    
      15    install -dm755 "$pkgdir/usr/bin"
    
      16    install -dm775 "$pkgdir/usr/share/games/$_pkgname"
    
      17    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      18
    
      19    # Packaging files
    
      20    
    
      21    # Check if Data.rsdk exists so it doesn't redownload the file when it doesn't need to.
    
      22    FILE="/usr/share/games/$_pkgname/Data.rsdk"
    
      23     if test -f "$FILE"
    
      24    then
    
      25        echo "$FILE exists skipping download."
    
      26        cp -r "/usr/share/games/$_pkgname/Data.rsdk" "$pkgdir/usr/share/games/$_pkgname"
    
      27    else
    
      28        echo "$FILE does not exist, Starting download.."
    
      29        cd $srcdir/sonicthehedgehog2-$pkgver
    
      30        wget "https://archive.org/download/data_20231229/Data.rsdk"
    
      31    fi
    
      32    cd $srcdir/sonicthehedgehog2-$pkgver
    
      33    cp "$srcdir/sonicthehedgehog2-$pkgver/sonic2.sh" "$pkgdir/usr/bin/sonic2"
    
      34    cp -r ./ "$pkgdir/usr/share/games/$_pkgname"
    
      35    cp sonic2.png "$pkgdir/usr/share/pixmaps"
    
      36
    
      37    # Desktop Entry
    
      38    install -Dm644 "$srcdir/sonicthehedgehog2-$pkgver/$_pkgname.desktop" \
    
      39    "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      40    sed -i s%/usr/share%/opt% "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2