terrafire

maintainer kleintux · 6 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a Windows installer (tf_full.exe) from the official vendor's own domain (ortsoftware.com) using curl with a spoofed user-agent to work around a 406 error, but critically this download is NOT listed in source=() and has no checksum verification. The binary is extracted with innoextract and the resulting Windows executable is run under dosbox (not natively), so there is no direct host-code-execution risk. However, the lack of integrity verification (no sha256sum for tf_full.exe) means the binary could be silently swapped or tampered with in transit without detection. The vendor host appears to be the legitimate upstream (ortsoftware.com matches the url= field), which reduces the supply-chain concern somewhat, but the missing checksum is a genuine security gap. This is a real medium-severity concern: an unverified executable from an external host installed into /opt, even if run under an emulator.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:18 curl --user-agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" 'https://www.ortsoftware.com/exe/tf_full.exe' -o tf_full.exe

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a Windows installer (tf_full.exe) from the official vendor's own domain (ortsoftware.com) using curl with a spoofed user-agent to work around a 406 error, but critically this download is NOT listed in source=() and has no checksum verification. The binary is extracted with innoextract and the resulting Windows executable is run under dosbox (not natively), so there is no direct host-code-execution risk. However, the lack of integrity verification (no sha256sum for tf_full.exe) means the binary could be silently swapped or tampered with in transit without detection. The vendor host appears to be the legitimate upstream (ortsoftware.com matches the url= field), which reduces the supply-chain concern somewhat, but the missing checksum is a genuine security gap. This is a real medium-severity concern: an unverified executable from an external host installed into /opt, even if run under an emulator.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: <reg-archlinux AT klein DOT tuxli DOT ch> 
    
      2pkgname=terrafire
    
      3pkgver=2.0.5
    
      4pkgrel=1
    
      5pkgdesc="Award-winning arcade game featuring rendered 3D graphics, realistic gravitational physics and 360 degree parallax scrolling from ORT Software."
    
      6arch=('i686' 'x86_64')
    
      7url="https://www.ortsoftware.com/tf.html"
    
      8license=('freeware')
    
      9provides=('terrafire')
    
      10source=('terrafire.desktop')
    
      11depends=('dosbox')
    
      12makedepends=('innoextract' 'imagemagick')
    
      13sha256sums=('f7489700fe3a3795a599b1bedeef3eb279b9949ae7725ec8d924312419113b71')
    
      14
    
      15prepare() {
    
      16	#workaround for curl http 406 error
    
      17  cd "${srcdir}"
    
      18  curl --user-agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" 'https://www.ortsoftware.com/exe/tf_full.exe' -o tf_full.exe
    
      19}
    
      20
    
      21build() {
    
      22	cd "${srcdir}"
    
      23	innoextract "tf_full.exe" || return 1
    
      24	convert "app/tf.ico" "terrafire.png" || return 1
    
      25}
    
      26
    
      27package() {
    
      28	install -Dm644 ${srcdir}/terrafire.desktop ${pkgdir}/usr/share/applications/terrafire.desktop
    
      29	install -Dm644 ${srcdir}/terrafire.png ${pkgdir}/usr/share/pixmaps/terrafire.png
    
      30
    
      31	cd "${srcdir}/app"
    
      32	mkdir -p "${pkgdir}/opt/terrafire"
    
      33	mkdir -p "${pkgdir}/usr/bin/"
    
      34
    
      35	cp -ar * "${pkgdir}/opt/terrafire"
    
      36
    
      37	cat << EOF > "${pkgdir}/usr/bin/terrafire"
    
      38#!/bin/bash
    
      39# Let us create a hidden folder in the home
    
      40mkdir -p "\$HOME/.terrafire"
    
      41if [ ! -f "\$HOME/.terrafire/settings.cfg" ]; then
    
      42	cp "/opt/terrafire/settings.cfg" "\$HOME/.terrafire/"
    
      43fi
    
      44FILES=\$(ls /opt/terrafire)
    
      45
    
      46# Checking/preparing environment
    
      47for f in \$FILES; do
    
      48	if [ ! -e "\$HOME/.terrafire/\$f" ]; then
    
      49		ln -s "/opt/terrafire/\$f" "\$HOME/.terrafire/"
    
      50	fi
    
      51done
    
      52
    
      53dosbox -exit "\$HOME/.terrafire/tf.exe"
    
      54EOF
    
      55chmod +x "${pkgdir}/usr/bin/terrafire"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2