ultima-ratio-regum

LOW

maintainer friedev 1 votes scanned 2026-10-18 00:06:55.117981

View on AUR

Why flagged

Downloads a prebuilt Windows executable (.exe) from the project's own official domain (markrjohnsongames.com), runs it under Wine; the source host is the game developer's own site with a proper sha256 checksum, so this is a legitimate prebuilt-from-vendor scenario rather than an unverifiable third-party host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt Windows executable (.exe) from the project's own official domain (markrjohnsongames.com), runs it under Wine; the source host is the game developer's own site with a proper sha256 checksum, so this is a legitimate prebuilt-from-vendor scenario rather than an unverifiable third-party host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("$pkgname-$pkgver.zip::https://www.markrjohnsongames.com/wp-content/uploads/2026/01/URR0104d.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aaron Friesen <aaron@frie.dev>
    
      2# shellcheck shell=bash disable=SC2034,SC2154,SC2164
    
      3
    
      4pkgname=ultima-ratio-regum
    
      5pkgver=0.10.4d
    
      6pkgrel=1
    
      7pkgdesc='A roguelike with procedurally generated civilizations, cultures, and religions'
    
      8arch=(x86_64)
    
      9url='https://www.markrjohnsongames.com/games/ultima-ratio-regum/'
    
      10license=(LicenseRef-ultima-ratio-regum)
    
      11depends=(wine)
    
      12source=("$pkgname-$pkgver.zip::https://www.markrjohnsongames.com/wp-content/uploads/2026/01/URR0104d.zip")
    
      13sha256sums=('c24e86b2d8b6b27a33f53a085d0378112aab6954871608b76ac04cbf95125934')
    
      14
    
      15package() {
    
      16	# Installed unmodified, as the upstream license requires.
    
      17	install -dm755 "$pkgdir/usr/share/$pkgname"
    
      18	find . -mindepth 1 -maxdepth 1 ! -name "$pkgname-$pkgver.zip" -exec cp -r --no-preserve=ownership -t "$pkgdir/usr/share/$pkgname/" {} +
    
      19	# Normalize permissions.
    
      20	find "$pkgdir/usr/share/$pkgname" -type f -exec chmod 644 {} +
    
      21	find "$pkgdir/usr/share/$pkgname" -type d -exec chmod 755 {} +
    
      22	# Readme.txt must accompany redistributions.
    
      23	install -Dm644 Readme.txt "$pkgdir/usr/share/licenses/$pkgname/Readme.txt"
    
      24
    
      25	# The game reads its tilesets and writes its saves (World*D/World.dat,
    
      26	# Prefs.dat) relative to the working directory, which must be writable, so
    
      27	# run it from a per-user directory that links to the installed files.
    
      28	install -dm755 "$pkgdir/usr/bin"
    
      29	cat >"$pkgdir/usr/bin/$pkgname" <<'EOF'
    
      30#!/bin/sh
    
      31install_dir=/usr/share/ultima-ratio-regum
    
      32data_dir="${XDG_DATA_HOME:-$HOME/.local/share}/ultima-ratio-regum"
    
      33
    
      34mkdir -p "$data_dir"
    
      35for file in "$install_dir"/*; do
    
      36	link="$data_dir/${file##*/}"
    
      37	[ -e "$link" ] || ln -s "$file" "$link"
    
      38done
    
      39
    
      40# Suppress .NET/browser prompts and Wine debug spam.
    
      41export WINEDLLOVERRIDES=mscoree,mshtml=
    
      42export WINEDEBUG=-all
    
      43cd "$data_dir" || exit 1
    
      44exec wine "$install_dir/URR0104d.exe" "$@"
    
      45EOF
    
      46	chmod 755 "$pkgdir/usr/bin/$pkgname"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 00:06:55	Low	3
2026-10-17 23:21:47	Low	3
2026-10-17 23:20:05	Medium	2