terasology-latest-bin

maintainer soloturn · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary archive (TerasologyOmega.zip) from jenkins.terasology.io with a SKIP'd checksum. While jenkins.terasology.io appears to be the official Terasology project CI server (the game's own Jenkins instance), using 'lastSuccessfulBuild' as the artifact URL means the exact artifact is not pinned — it will silently change on every new successful build, making reproducibility impossible and creating a supply-chain risk if the CI server is compromised or the artifact is swapped. The SKIP checksum for the zip means there is no integrity verification at all. The zip contains native shared libraries (libbullet-linux-amd64.so) that are executed/loaded at runtime. Additionally, the 'terasology' launcher script itself has SKIP'd checksum. The combination of unverified executed binaries/native libs from a CI artifact URL (even an official-looking one) with no integrity check is a genuine medium-severity supply-chain concern. The 'chmod a+w $srcdir' and 'cp -ra $srcdir' pattern is also sloppy but not a security escalation beyond the above.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "terasology-omega-${pkgver}.zip::https://jenkins.terasology.io/job/Terasology/job/Omega/job/develop/lastSuccessfulBuild/artifact/distros/omega/build/distributions/TerasologyOmega.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary archive (TerasologyOmega.zip) from jenkins.terasology.io with a SKIP'd checksum. While jenkins.terasology.io appears to be the official Terasology project CI server (the game's own Jenkins instance), using 'lastSuccessfulBuild' as the artifact URL means the exact artifact is not pinned — it will silently change on every new successful build, making reproducibility impossible and creating a supply-chain risk if the CI server is compromised or the artifact is swapped. The SKIP checksum for the zip means there is no integrity verification at all. The zip contains native shared libraries (libbullet-linux-amd64.so) that are executed/loaded at runtime. Additionally, the 'terasology' launcher script itself has SKIP'd checksum. The combination of unverified executed binaries/native libs from a CI artifact URL (even an official-looking one) with no integrity check is a genuine medium-severity supply-chain concern. The 'chmod a+w $srcdir' and 'cp -ra $srcdir' pattern is also sloppy but not a security escalation beyond the above.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: soloturn@gmail.com
    
      2# Contributor: Allison Smith <alyway@protonmail.com>
    
      3# Contributor: Anthony Wang <ta180m@gmail.com>
    
      4# Contributor: Felix Golatofski <contact@xdfr.de>
    
      5# Contributor: Max Bruckner <max@maxbruckner.de>
    
      6
    
      7pkgname=terasology-latest-bin
    
      8pkgver=5.4.0
    
      9pkgrel=1
    
      10pkgdesc="Yet another high resolution game with blocks like Minecraft!"
    
      11arch=('x86_64')
    
      12license=('Apache-2.0')
    
      13url="https://terasology.org"
    
      14options=('!strip')
    
      15depends=(zlib java-runtime-openjdk)
    
      16makedepends=('unzip')
    
      17source=(
    
      18    "terasology"
    
      19    "terasology.desktop"
    
      20    "terasology-omega-${pkgver}.zip::https://jenkins.terasology.io/job/Terasology/job/Omega/job/develop/lastSuccessfulBuild/artifact/distros/omega/build/distributions/TerasologyOmega.zip"
    
      21)
    
      22sha512sums=(
    
      23  'SKIP'
    
      24  '737953ab10027100b6bd03ca60a3f1cd4fff503c4c5a1689b3e12ef8df66a3e3347c99d498e48dccc3be8d00e9e37fcab56d5c97bbb81dd310ce757979aa0276'
    
      25  'SKIP'
    
      26  )
    
      27
    
      28package() {
    
      29    install -Dm 755 "${srcdir}/terasology" "$pkgdir/usr/bin/terasology"
    
      30    install -Dm 644 "${srcdir}/terasology.desktop" "${pkgdir}/usr/share/applications/terasology.desktop"
    
      31
    
      32    #cleanup
    
      33    rm "${srcdir}/terasology" "${srcdir}/terasology.desktop" "${srcdir}/terasology-omega-${pkgver}.zip"
    
      34
    
      35    #extract and install icons
    
      36    unzip -u libs/engine-${pkgver}-SNAPSHOT.jar "org/terasology/engine/icons/*"
    
      37    pushd org/terasology/engine/icons
    
      38    for icon in *
    
      39    do
    
      40        size=${icon##*_}        #gooey_sweet_XX.png -> XX.png
    
      41        size=${size/.png/}      #XX.png -> XX
    
      42        install -Dm 644 "$icon" "${pkgdir}/usr/share/icons/${size}x${size}/apps/terasology.png"
    
      43    done
    
      44    install -Dm 644 "${pkgdir}/usr/share/icons/64x64/apps/terasology.png" "${pkgdir}/usr/share/pixmaps/terasology.png"
    
      45    popd
    
      46    rm -r org
    
      47
    
      48    #remove files/dirs for other operating systems and native libraries
    
      49    #rm run_macosx.command Terasology.{x86,x64}.exe
    
      50    rm Terasology.bat
    
      51    rm -r natives/macosx
    
      52    rm -r natives/windows
    
      53    strip -s natives/linux/libbullet-linux-amd64.so
    
      54    
    
      55    chmod a+w "$srcdir" # Terrible permissions hack to get the game to start
    
      56    cp -ra "$srcdir" "${pkgdir}/usr/share/terasology"
    
      57    
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2