terrafire

MEDIUM

maintainer kleintux 6 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a Windows installer (tf_full.exe) from the official vendor's own domain (ortsoftware.com) using curl with a spoofed user-agent to work around a 406 error, but critically this download is NOT listed in source=() and has no checksum verification. The binary is extracted with innoextract and the resulting Windows executable is run under dosbox (not natively), so there is no direct host-code-execution risk. However, the lack of integrity verification (no sha256sum for tf_full.exe) means the binary could be silently swapped or tampered with in transit without detection. The vendor host appears to be the legitimate upstream (ortsoftware.com matches the url= field), which reduces the supply-chain concern somewhat, but the missing checksum is a genuine security gap. This is a real medium-severity concern: an unverified executable from an external host installed into /opt, even if run under an emulator.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:18 curl --user-agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" 'https://www.ortsoftware.com/exe/tf_full.exe' -o tf_full.exe

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a Windows installer (tf_full.exe) from the official vendor's own domain (ortsoftware.com) using curl with a spoofed user-agent to work around a 406 error, but critically this download is NOT listed in source=() and has no checksum verification. The binary is extracted with innoextract and the resulting Windows executable is run under dosbox (not natively), so there is no direct host-code-execution risk. However, the lack of integrity verification (no sha256sum for tf_full.exe) means the binary could be silently swapped or tampered with in transit without detection. The vendor host appears to be the legitimate upstream (ortsoftware.com matches the url= field), which reduces the supply-chain concern somewhat, but the missing checksum is a genuine security gap. This is a real medium-severity concern: an unverified executable from an external host installed into /opt, even if run under an emulator.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: <reg-archlinux AT klein DOT tuxli DOT ch> 
    
      2pkgname=terrafire
    
      3pkgver=2.0.5
    
      4pkgrel=1
    
      5pkgdesc="Award-winning arcade game featuring rendered 3D graphics, realistic gravitational physics and 360 degree parallax scrolling from ORT Software."
    
      6arch=('i686' 'x86_64')
    
      7url="https://www.ortsoftware.com/tf.html"
    
      8license=('freeware')
    
      9provides=('terrafire')
    
      10source=('terrafire.desktop')
    
      11depends=('dosbox')
    
      12makedepends=('innoextract' 'imagemagick')
    
      13sha256sums=('f7489700fe3a3795a599b1bedeef3eb279b9949ae7725ec8d924312419113b71')
    
      14
    
      15prepare() {
    
      16	#workaround for curl http 406 error
    
      17  cd "${srcdir}"
    
      18  curl --user-agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" 'https://www.ortsoftware.com/exe/tf_full.exe' -o tf_full.exe
    
      19}
    
      20
    
      21build() {
    
      22	cd "${srcdir}"
    
      23	innoextract "tf_full.exe" || return 1
    
      24	convert "app/tf.ico" "terrafire.png" || return 1
    
      25}
    
      26
    
      27package() {
    
      28	install -Dm644 ${srcdir}/terrafire.desktop ${pkgdir}/usr/share/applications/terrafire.desktop
    
      29	install -Dm644 ${srcdir}/terrafire.png ${pkgdir}/usr/share/pixmaps/terrafire.png
    
      30
    
      31	cd "${srcdir}/app"
    
      32	mkdir -p "${pkgdir}/opt/terrafire"
    
      33	mkdir -p "${pkgdir}/usr/bin/"
    
      34
    
      35	cp -ar * "${pkgdir}/opt/terrafire"
    
      36
    
      37	cat << EOF > "${pkgdir}/usr/bin/terrafire"
    
      38#!/bin/bash
    
      39# Let us create a hidden folder in the home
    
      40mkdir -p "\$HOME/.terrafire"
    
      41if [ ! -f "\$HOME/.terrafire/settings.cfg" ]; then
    
      42	cp "/opt/terrafire/settings.cfg" "\$HOME/.terrafire/"
    
      43fi
    
      44FILES=\$(ls /opt/terrafire)
    
      45
    
      46# Checking/preparing environment
    
      47for f in \$FILES; do
    
      48	if [ ! -e "\$HOME/.terrafire/\$f" ]; then
    
      49		ln -s "/opt/terrafire/\$f" "\$HOME/.terrafire/"
    
      50	fi
    
      51done
    
      52
    
      53dosbox -exit "\$HOME/.terrafire/tf.exe"
    
      54EOF
    
      55chmod +x "${pkgdir}/usr/bin/terrafire"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2