spacecadetpinball-bin

maintainer gameslayer · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads 3DPinball.zip from archive.org at package() time using wget, outside of the source=() array, with no checksum verification. This is a genuine supply-chain concern: the file is fetched at build/install time without integrity checking, meaning a compromised or substituted archive.org item would go undetected. Additionally, the package has 'wget' and 'yad' as runtime depends (not makedepends), suggesting the download may also happen at runtime via a wrapper script, further bypassing makepkg's integrity checks. The binary itself is pulled from a personal GitLab namespace ('linuxbombay') rather than an official upstream release host, which is another mild concern. The 3DPinball.zip contains game asset data (not executed code directly), but it is placed into the game's data directory and consumed by the executed binary, so a tampered zip could potentially exploit the game engine. Overall this is a real but non-malicious supply-chain sloppiness that warrants MEDIUM.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:48 wget "https://archive.org/download/3DPinball/3DPinball.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads 3DPinball.zip from archive.org at package() time using wget, outside of the source=() array, with no checksum verification. This is a genuine supply-chain concern: the file is fetched at build/install time without integrity checking, meaning a compromised or substituted archive.org item would go undetected. Additionally, the package has 'wget' and 'yad' as runtime depends (not makedepends), suggesting the download may also happen at runtime via a wrapper script, further bypassing makepkg's integrity checks. The binary itself is pulled from a personal GitLab namespace ('linuxbombay') rather than an official upstream release host, which is another mild concern. The 3DPinball.zip contains game asset data (not executed code directly), but it is placed into the game's data directory and consumed by the executed binary, so a tampered zip could potentially exploit the game engine. Overall this is a real but non-malicious supply-chain sloppiness that warrants MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=spacecadetpinball-bin
    
      2_pkgname=SpaceCadetPinball-bin
    
      3rpkgname=spacecadetpinball
    
      4_rpkgname=SpaceCadetPinball
    
      5pkgver=2.1.0
    
      6pkgrel=2
    
      7scriptver=1.0.0
    
      8_pkgrel_x86_64=1
    
      9_pkgrel_i386=1
    
      10_pkgrel_i686=1
    
      11_pkgrel_aarch64=1
    
      12pkgdesc='Reverse engineered port of "3D Pinball for Windows – Space Cadet" to Linux'
    
      13arch=('pentium4' 'i386' 'i686' 'x86_64' 'aarch64')
    
      14url="https://gitlab.com/linuxbombay/spacecadetpinball"
    
      15license=('GPL')
    
      16depends=('sdl2' 'sdl2_mixer' 'wget' 'unzip' 'yad')
    
      17makedepends=('unzip')
    
      18sha256sums_i386=('22691f50626242e88f2a7c7165774271b3fa96cdfa39bc9edaa1cd615eb3b411'
    
      19                 'c8942dc85637f4a1b3a5bda00be247dbcb6f7047487649f9f532079bf6e0952d')
    
      20sha256sums_i686=('22691f50626242e88f2a7c7165774271b3fa96cdfa39bc9edaa1cd615eb3b411'
    
      21                 'c8942dc85637f4a1b3a5bda00be247dbcb6f7047487649f9f532079bf6e0952d')
    
      22sha256sums_x86_64=('22691f50626242e88f2a7c7165774271b3fa96cdfa39bc9edaa1cd615eb3b411'
    
      23                   '6ee764f7d51a7d7d32bdb8463feb78fd1447a821a46e2a6e70a2dec5e2d2d54f')
    
      24sha256sums_aarch64=('22691f50626242e88f2a7c7165774271b3fa96cdfa39bc9edaa1cd615eb3b411'
    
      25                    '127ea73d8ac6651792ba6707efb65b2204e9f4b55fa59ca5f61ee80568cb071e')
    
      26source_x86_64=("$url/spacecadetpinball/-/archive/$scriptver/spacecadetpinball-$scriptver.tar.bz2" "$url/binaries/$pkgver/-/raw/main/SpaceCadetPinball-Linux-x64.tar.xz")
    
      27source_i386=("$url/spacecadetpinball/-/archive/$scriptver/spacecadetpinball-$scriptver.tar.bz2" "$url/binaries/$pkgver/-/raw/main/SpaceCadetPinball-Linux-i686.tar.xz")
    
      28source_i686=("$url/spacecadetpinball/-/archive/$scriptver/spacecadetpinball-$scriptver.tar.bz2" "$url/binaries/$pkgver/-/raw/main/SpaceCadetPinball-Linux-i686.tar.xz")
    
      29source_aarch64=("$url/spacecadetpinball/-/archive/$scriptver/spacecadetpinball-$scriptver.tar.bz2" "$url/binaries/$pkgver/-/raw/main/SpaceCadetPinball-Linux-arm64.tar.xz")
    
      30
    
      31
    
      32package() {
    
      33    install -dm755 "$pkgdir/usr/bin"
    
      34    install -dm775 "$pkgdir/usr/share/games/$_rpkgname"
    
      35    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      36
    
      37    # Packaging files
    
      38    for dir in $rpkgname-$scriptver/ ; do mv "${dir}" "$rpkgname" ;done
    
      39    # Check if SpaceCadetPinball Assets zip exists so it doesn't redownload the file when it doesn't need to.
    
      40    FILE="/usr/share/games/$_rpkgname/3DPinball.zip"
    
      41     if test -f "$FILE"
    
      42    then
    
      43        echo "$FILE exists skipping download."
    
      44        cp -r /usr/share/games/SpaceCadetPinball/3DPinball.zip $pkgdir/usr/share/games/$_rpkgname
    
      45    else
    
      46        echo "$FILE does not exist, Starting download.."
    
      47        cd $srcdir/$rpkgname
    
      48        wget "https://archive.org/download/3DPinball/3DPinball.zip"
    
      49    fi
    
      50    install -Dm755 "$srcdir/$_rpkgname" "$pkgdir/usr/bin"
    
      51    cd $srcdir/$rpkgname
    
      52    cp "$srcdir/$rpkgname/$rpkgname" "$pkgdir/usr/bin"
    
      53    cp -r ./ "$pkgdir/usr/share/games/$_rpkgname"
    
      54    cp $rpkgname.png "$pkgdir/usr/share/pixmaps"
    
      55
    
      56    # Desktop Entry
    
      57    install -Dm644 "$srcdir/$rpkgname/$rpkgname.desktop" \
    
      58    "$pkgdir/usr/share/applications/$rpkgname.desktop"
    
      59    sed -i s%/usr/share%/opt% "$pkgdir/usr/share/applications/$rpkgname.desktop"
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2