srb2-retro-data
LOW
maintainer PASRC
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads data files (not executables) from a project-associated host (alam.srb2.org) for a specific game version; worst case is tampering with game resources, not code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads data files (not executables) from a project-associated host (alam.srb2.org) for a specific game version; worst case is tampering with game resources, not code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
source=("https://alam.srb2.org/SRB2/$pkgver-Final/Resources/drill.dta"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: PASRC <pasrc at proton dot me>
2
# Contributor: carstene1ns <arch carsten-teibes de> - http://git.io/ctPKG
3
# Contributor: DeedleFake <yisszev at beckforce dot com>
4
5
pkgname=srb2-retro-data
6
pkgver=2.0.6
7
pkgrel=1
8
pkgdesc="Data files for Sonic Robo Blast 2 2.0 (srb2-retro specific install directory)"
9
arch=('any')
10
license=('custom')
11
url='https://www.srb2.org'
12
source=("https://alam.srb2.org/SRB2/$pkgver-Final/Resources/drill.dta"
13
"https://alam.srb2.org/SRB2/$pkgver-Final/Resources/knux.plr"
14
"https://alam.srb2.org/SRB2/$pkgver-Final/Resources/music.dta"
15
"https://alam.srb2.org/SRB2/$pkgver-Final/Resources/rings.wpn"
16
"https://alam.srb2.org/SRB2/$pkgver-Final/Resources/soar.dta"
17
"https://alam.srb2.org/SRB2/$pkgver-Final/Resources/sonic.plr"
18
"https://alam.srb2.org/SRB2/$pkgver-Final/Resources/srb2.wad"
19
"https://alam.srb2.org/SRB2/$pkgver-Final/Resources/tails.plr"
20
"https://alam.srb2.org/SRB2/$pkgver-Final/Resources/zones.dta")
21
sha256sums=('8ee1a16ca4ab544a81b240a72f87c344a3697ce58f632b33e52157f95c15176f'
22
'd24f0f15de6f402065636ce93f7389a78a44f4c9071c512f6d4ab5ba1a995941'
23
'495dcbe35f79990a0601dcc6d1d828706a66a10f65586ebdba98f2c66768163a'
24
'f156f040814441def7336981e9d432ad1bfd44e5c8b4c0346e43f9d289abe31e'
25
'87fcfd1c159f47dc16093fdefe6e647ceaa909a574f2db2c44450e8b15b45dbe'
26
'36650190dea27322ea5728abcb2f3184aaf66b9d21791349ed8050fc3f061335'
27
'e71309d088be3ebd55ece802f560ef8f23d6e7ee854b052c0a62dfbd0336156b'
28
'1cfc070a474be46fdcfbf4e6ac09f95ddc5b6bca8d0a654f9b53f1760d360452'
29
'730283649acbf033cd19f8d9149b746aae261c89572748e9872261ac946aa9e2')
30
31
package() {
32
install -d "$pkgdir"/usr/share/games/srb2-retro
33
install -m644 {drill,music,soar,zones}.dta {knux,sonic,tails}.plr rings.wpn \
34
srb2.wad "$pkgdir"/usr/share/games/srb2-retro
35
}
36
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |