spacecadetpinball-git

maintainer nulldev · 24 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads original game assets from archive.org, which are non-executable data files required for the game to function; building the project from its own source code is standard practice and the data files, while hosted on a non-whitelisted domain, are not executable and do not introduce remote code execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads original game assets from archive.org, which are non-executable data files required for the game to function; building the project from its own source code is standard practice and the data files, while hosted on a non-whitelisted domain, are not executable and do not introduce remote code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 'https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andy Bao <contact at andybao dot me>
    
      2_pkgname=spacecadetpinball
    
      3pkgname=$_pkgname-git
    
      4pkgdesc='Reverse engineered port of "3D Pinball for Windows – Space Cadet" to Linux'
    
      5pkgver=2.0.1.r27.g8017734
    
      6pkgrel=1
    
      7arch=('x86_64' 'i686' 'pentium4' 'aarch64' 'armv7h' 'armv6h')
    
      8depends=('sdl2' 'sdl2_mixer')
    
      9makedepends=('p7zip' 'cmake' 'git')
    
      10optdepends=('freepats-general-midi: Soundfont for playing background music')
    
      11provides=("$_pkgname")
    
      12conflicts=("$_pkgname")
    
      13license=('MIT' 'proprietary')
    
      14noextract=('Space_Cadet.rar' 'Full%20tilt%20pinball.iso')
    
      15url="https://github.com/k4zmu2a/SpaceCadetPinball"
    
      16source=(
    
      17  'https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar'
    
      18  'https://archive.org/download/win311_ftiltpball/FULLTILT.ZIP'
    
      19  "$pkgname::git+$url"
    
      20  'spacecadetpinball.desktop'
    
      21)
    
      22sha256sums=('3cc5dfd914c2ac41b03f006c7ccbb59d6f9e4c32ecfd1906e718c8e47f130f4a'
    
      23            '183a2219865b3f2199403928b817b7c967837ea6298de14fb8a379944c7b4599'
    
      24            'SKIP'
    
      25            'SKIP')
    
      26
    
      27_FT_BASEDIR="CADET"
    
      28prepare() {
    
      29  7z x -y Space_Cadet.rar -oSpace_Cadet/
    
      30  7z x -y 'FULLTILT.ZIP' -oFullTilt/ "$_FT_BASEDIR/CADET.DAT" "$_FT_BASEDIR/SOUND/*"
    
      31}
    
      32
    
      33pkgver() {
    
      34  cd "$pkgname"
    
      35  # cutting off 'Release_' prefix that presents in the git tag
    
      36  git describe --long | sed 's/^Release_//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      37}
    
      38
    
      39build() {
    
      40  # -DNDEBUG is required, otherwise you get: "Package contains reference to $srcdir"
    
      41  # You can also change -DCMAKE_BUILD_TYPE to "Release" however this goes against Arch packaging guidelines
    
      42  LDFLAGS="$LDFLAGS -DNDEBUG" CXXFLAGS="$CXXFLAGS -DNDEBUG" cmake -B "$pkgname/build" -S "$pkgname" \
    
      43      -Wno-dev \
    
      44      -DCMAKE_BUILD_TYPE=None \
    
      45      -DCMAKE_INSTALL_PREFIX=/usr
    
      46  make -C "$pkgname/build"
    
      47}
    
      48
    
      49package() {
    
      50  # Install binary
    
      51  install -Dm0755 "$pkgname/bin/SpaceCadetPinball" "$pkgdir/usr/lib/$_pkgname/$_pkgname"
    
      52  # Install wrapper script
    
      53  install -Dm0755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" <<END
    
      54#!/bin/sh
    
      55
    
      56# Configure soundfonts if not already configured
    
      57if [ -z "\$SDL_SOUNDFONTS" ]; then
    
      58  DEFAULT_SOUNDFONT="/usr/share/soundfonts/default.sf2"
    
      59  if [ -f "\$DEFAULT_SOUNDFONT" ]; then
    
      60    # Use default soundfont since it exists
    
      61    export SDL_SOUNDFONTS="\$DEFAULT_SOUNDFONT"
    
      62  else
    
      63    # Use first available soundfont
    
      64    export SDL_SOUNDFONTS="\$(find /usr/share/soundfonts -type f,l -print -quit 2> /dev/null)"
    
      65  fi
    
      66fi
    
      67
    
      68# Run program in correct directory so it can find it's resources
    
      69cd /usr/lib/$_pkgname
    
      70exec ./$_pkgname "\$@"
    
      71END
    
      72
    
      73  # Install original game files
    
      74  cd Space_Cadet
    
      75  # Install resources
    
      76  install -m0644 PINBALL.DAT *.MID Sounds/*.WAV -t "$pkgdir/usr/lib/$_pkgname"
    
      77  # Install documentation
    
      78  install -Dm0644 PINBALL.DOC TABLE.BMP -t "$pkgdir/usr/share/doc/$_pkgname"
    
      79  cd ..
    
      80
    
      81  # Install full tilt game files
    
      82  cd "FullTilt/$_FT_BASEDIR"
    
      83  install -m0644 CADET.DAT -t "$pkgdir/usr/lib/$_pkgname"
    
      84  install -Dm0644 SOUND/* -t "$pkgdir/usr/lib/$_pkgname/SOUND"
    
      85  cd "$srcdir"
    
      86
    
      87  # Install icon
    
      88  install -Dm0644 "$pkgname/SpaceCadetPinball/Icon_1.ico" "$pkgdir/usr/lib/$_pkgname/icon.ico"
    
      89  # Install desktop launcher
    
      90  install -Dm644 spacecadetpinball.desktop -t "$pkgdir/usr/share/applications"
    
      91}
    
      92

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2