ut2004-data-archiveorg

maintainer jmsq · 2 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads a known game ISO from a community-maintained archive site for data extraction; the source is non-whitelisted but the content is non-executable game data, and the build process only extracts and organizes files without executing remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a known game ISO from a community-maintained archive site for data extraction; the source is non-whitelisted but the content is non-executable game data, and the build process only extracts and organizes files without executing remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:14 source=("UT2004.ISO::https://files.oldunreal.net/UT2004.ISO")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: John-Michael Mulesa <jmulesa [at] gmail [dot] com>
2
3pkgname=ut2004-data-archiveorg
4pkgver=3369
5pkgrel=3
6pkgdesc="Unreal Tournament 2004 ECE data from OldUnreal/Archive.org ISO"
7arch=('any')
8url="https://www.oldunreal.com/downloads/unreal-tournament-2004/full-game-installers/"
9license=('custom')
10depends=()
11makedepends=('p7zip' 'unshield')
12provides=('ut2004-data')
13conflicts=('ut2004-data' 'ut2004-steam' 'ut2004-gog')
14source=("UT2004.ISO::https://files.oldunreal.net/UT2004.ISO")
15md5sums=('4ad34b16d757e0752809eb9bf5fb1fba')
16
17package() {
18 install -d "$pkgdir/opt/ut2004"
19
20 msg2 "Extracting ISO..."
21 mkdir -p "$srcdir/iso_extract"
22 7z -y x "$srcdir/UT2004.ISO" -o"$srcdir/iso_extract"
23
24 msg2 "Preparing Cabinet files..."
25 mkdir -p "$srcdir/cab_files"
26 find "$srcdir/iso_extract" -name "data*.cab" -exec ln -sf {} "$srcdir/cab_files/" \;
27 find "$srcdir/iso_extract" -name "data*.hdr" -exec ln -sf {} "$srcdir/cab_files/" \; 2>/dev/null || true
28
29 msg2 "Extracting Cabinet files..."
30 mkdir -p "$srcdir/cab_extract"
31 if [ -f "$srcdir/cab_files/data1.cab" ]; then
32 unshield -d "$srcdir/cab_extract" x "$srcdir/cab_files/data1.cab"
33 else
34 error "data1.cab not found!"
35 return 1
36 fi
37
38 msg2 "Organizing extracted files..."
39 cd "$srcdir/cab_extract"
40
41 # Iterate through extracted groups (e.g., All_Maps, All_System, etc.)
42 for group_dir in *; do
43 if [ -d "$group_dir" ]; then
44 # Determine target subdirectory name in /opt/ut2004
45 target_name=""
46
47 # Helper logic to strip "All_" prefix or map specific names
48 # Many folders are named like "All_Maps", "All_System"
49 if [[ "$group_dir" == All_* ]]; then
50 target_name="${group_dir#All_}"
51 fi
52
53 # Specific Overrides/Mappings
54 case "$group_dir" in
55 "All_UT2004.EXE") target_name="System" ;;
56 *"_Sounds_Speech_System_Help")
57 # Extract language prefix
58 lang="${group_dir%%_*}"
59 if [ "$lang" == "English" ]; then
60 target_name="."
61 else
62 # For other languages, we need to handle subdirectories specially
63 # We can't just set target_name, we need a custom handling block
64 msg2 "Processing $lang assets..."
65 for sub in "$group_dir"/*; do
66 if [ -d "$sub" ]; then
67 subname=$(basename "$sub")
68 # Map subfolder to subfolder_Lang
69 dest="$pkgdir/opt/ut2004/${subname}_${lang}"
70 install -d "$dest"
71 cp -r "$sub"/* "$dest/"
72 fi
73 done
74 continue # Skip standard copy logic
75 fi
76 ;;
77 *"_Manual")
78 # Extract language prefix
79 lang="${group_dir%%_*}"
80 if [ "$lang" == "English" ]; then
81 target_name="Manual"
82 else
83 target_name="Manual_$lang"
84 fi
85 ;;
86 "US_License.int") target_name="System" ;;
87 esac
88
89 # If we have a valid target name (standard copy logic)
90 if [ -n "$target_name" ]; then
91 # Handle "." mapping (copy contents to root)
92 if [ "$target_name" == "." ]; then
93 dest="$pkgdir/opt/ut2004"
94 install -d "$dest"
95 msg2 "Moving contents of $group_dir to $dest..."
96 # Use cp -rT or simply cp -r * to merge
97 cp -r "$group_dir"/* "$dest/"
98 else
99 dest="$pkgdir/opt/ut2004/$target_name"
100 install -d "$dest"
101 msg2 "Moving contents of $group_dir to $dest..."
102 cp -r "$group_dir"/* "$dest/"
103 fi
104 else
105 msg2 "Skipping unknown group directory: $group_dir"
106 fi
107 fi
108 done
109
110 msg2 "Creating User folder from System defaults..."
111 install -d "$pkgdir/opt/ut2004/User"
112 for f in CacheRecords.ucl DefUnrealEd.ini DefUser.ini Default.ini User.ini; do
113 if [ -f "$pkgdir/opt/ut2004/System/$f" ]; then
114 mv "$pkgdir/opt/ut2004/System/$f" "$pkgdir/opt/ut2004/User/"
115 fi
116 done
117
118 msg2 "Removing conflicting binaries and code from System folder..."
119 find "$pkgdir/opt/ut2004/System" -type f \( -name "*.bin" -o -name "*.so" -o -name "*.exe" -o -name "*.dll" -o -name "*.u" -o -name "*.upl" -o -name "*.md5" -o -executable \) -delete
120 rm -f "$pkgdir/opt/ut2004/System/Build.ini"
121
122 msg2 "Removing conflicting Web directory..."
123 rm -rf "$pkgdir/opt/ut2004/Web"
124
125 msg2 "Removing conflicting Help files..."
126 rm -f "$pkgdir/opt/ut2004/Help/DebuggerLogo.bmp"
127 rm -f "$pkgdir/opt/ut2004/Help/InstallerLogo.bmp"
128
129 msg2 "Fixing permissions..."
130 find "$pkgdir/opt/ut2004" -type d -exec chmod 755 {} +
131 find "$pkgdir/opt/ut2004" -type f -exec chmod 644 {} +
132}
133

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion