terraria-server

maintainer ilmikko · 14 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the official Terraria server binary from the project's own API endpoint (terraria.org) and two .dll files from GitHub (mono project), all of which are legitimate build dependencies; the non-standard host is the project's official domain, and no untrusted or swappable sources are used for executables.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official Terraria server binary from the project's own API endpoint (terraria.org) and two .dll files from GitHub (mono project), all of which are legitimate build dependencies; the non-standard host is the project's official domain, and no untrusted or swappable sources are used for executables.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://terraria.org/api/download/pc-dedicated-server/terraria-server-${_pkgver}.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainers: Mike Cooper <mythmon at elem.us>, Mikko <mikko at 5x.fi>
    
      2
    
      3pkgname=terraria-server
    
      4pkgver=1.4.5.6
    
      5pkgrel=48
    
      6pkgdesc="Official dedicated server for Terraria"
    
      7arch=('x86_64' 'x86')
    
      8license=('unknown')
    
      9url="https://terraria.org/"
    
      10depends=('mono' 'screen')
    
      11makedepends=('unzip')
    
      12install='terraria-server.install'
    
      13
    
      14_pkgver=$(echo $pkgver | sed 's/\.//g')
    
      15
    
      16# Traditional server zip URL:
    
      17# "http://terraria.org/server/${pkgname}-${_pkgver}.zip"
    
      18
    
      19# https://terraria.org/server/ links after 1402 give a 404, so we use the archive link instead.
    
      20source=("https://terraria.org/api/download/pc-dedicated-server/terraria-server-${_pkgver}.zip"
    
      21        "https://github.com/mono/reference-assemblies/raw/main/v4.8/System.dll"
    
      22        "https://github.com/mono/reference-assemblies/raw/main/v4.8/System.Core.dll"
    
      23        'terraria-server'
    
      24        'config.txt'
    
      25        'terraria-server@.service')
    
      26
    
      27sha256sums=('d75c455ac217fd3434448c8f8251c1347f0875a85c438589dc71b557777e9155'
    
      28            '6906a72d0c320697cac46820740fd67976e0b270378a772ea42968c463a2b8e5'
    
      29            'b06c0c07ffd912013cc35987d05ce9e6415cc04882b4b9b5c8ebf8a65fbea556'
    
      30            'fba253786b8668dabd18b03514b24b3aac9b24ed9a74dfdacee35f41659c30c9'
    
      31            '6a87f9f758811528913fa4828667b200ab7dcb6623734475ecbd8f8dab337b2f'
    
      32            'b2cfeb15b6e5bf97d1b7a0b0bdbec9289a842d37c52414c5b57aadda66b1b6a6')
    
      33
    
      34package() {
    
      35    unzip -o "${pkgname}-${_pkgver}.zip"
    
      36
    
      37    # Copy the updated dlls to /Linux so that they work with Mono 5.x
    
      38    cp -rv "System.dll" "${_pkgver}/Linux/System.dll";
    
      39    cp -rv "System.Core.dll" "${_pkgver}/Linux/System.Core.dll";
    
      40
    
      41    cd "${_pkgver}/Linux"
    
      42    dest="${pkgdir}/opt/terraria-server"
    
      43    install -o 697 -g 697  -d "${dest}"
    
      44
    
      45    install -m644 FNA.dll "${dest}/"
    
      46    install -m644 FNA.dll.config "${dest}/"
    
      47
    
      48    install -m644 Mono.Posix.dll "${dest}/"
    
      49    install -m644 Mono.Security.dll "${dest}/"
    
      50
    
      51    install -m644 monoconfig "${dest}/"
    
      52    install -m644 monomachineconfig "${dest}/"
    
      53    install -m644 mscorlib.dll "${dest}/"
    
      54    install -m644 open-folder "${dest}/"
    
      55
    
      56    install -m644 System.Configuration.dll "${dest}/"
    
      57    install -m644 System.Core.dll "${dest}/"
    
      58    install -m644 System.Data.dll "${dest}/"
    
      59    install -m644 System.dll "${dest}/"
    
      60    install -m644 System.Drawing.dll "${dest}/"
    
      61    install -m644 System.Numerics.dll "${dest}/"
    
      62    install -m644 System.Runtime.Serialization.dll "${dest}/"
    
      63    install -m644 System.Security.dll "${dest}/"
    
      64    install -m644 System.Windows.Forms.dll "${dest}/"
    
      65    install -m644 System.Windows.Forms.dll.config "${dest}/"
    
      66    install -m644 System.Xml.dll "${dest}/"
    
      67    install -m644 System.Xml.Linq.dll "${dest}/"
    
      68
    
      69    install -m644 TerrariaServer.exe "${dest}/"
    
      70    install -m755 TerrariaServer.bin.${CARCH} "${dest}/"
    
      71
    
      72    install -m644 WindowsBase.dll "${dest}/"
    
      73
    
      74    cd "${srcdir}"
    
      75    install -d "${pkgdir}/usr/bin/"
    
      76    install -m755 terraria-server "${pkgdir}/usr/bin/"
    
      77    install -d "${pkgdir}/usr/lib/systemd/system/"
    
      78    install -m644 terraria-server@.service "${pkgdir}/usr/lib/systemd/system/"
    
      79    install -m755 config.txt "${dest}/"
    
      80
    
      81    install -o 697 -g 697 -d "${pkgdir}/srv/terraria"
    
      82
    
      83    install -d "${pkgdir}/usr/lib/"
    
      84    ln -s "/usr/lib/libmonosgen-2.0.so.1.0.0" "${pkgdir}/usr/lib/libmonosgen-2.0.so.0"
    
      85}
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2