vkdoom-git

maintainer MaddieMewmews · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a git repository from a plausible project host not on the whitelist, but it is the project's own upstream source being built from scratch, which is normal for AUR packages; no unverifiable prebuilt binaries or malicious payloads are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from a plausible project host not on the whitelist, but it is the project's own upstream source being built from scratch, which is normal for AUR packages; no unverifiable prebuilt binaries or malicious payloads are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 source=('vkdoom::git+https://git.sayachan.org/OrdinaryMagician/vkdoom_m.git'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Maddie Mewmews <maddie at mewmews gay>
    
      2# Contributor: Jan Cholasta <grubber at grubber cz>
    
      3
    
      4pkgname=vkdoom-git
    
      5pkgver=v25.6.0+585+g20997f7a1
    
      6pkgrel=2
    
      7pkgdesc='Feature centric port for all Doom engine games, with a focus on Vulkan and modern computers (git version)'
    
      8arch=('x86_64' 'aarch64') #Ok so aarch64 works i guess
    
      9url='https://git.sayachan.org/OrdinaryMagician/vkdoom_m'
    
      10license=('BSD' 'GPL3' 'LGPL3')
    
      11depends=('bzip2'
    
      12         'gtk3'
    
      13         'hicolor-icon-theme'
    
      14         'libgl'
    
      15         'libvpx>=1.14'
    
      16         'openal'
    
      17         'sdl2'
    
      18         'vulkan-driver'
    
      19         'vulkan-icd-loader')
    
      20makedepends=('cmake' 'desktop-file-utils' 'git' 'ninja')
    
      21optdepends=('blasphemer-wad: Blasphemer (free Heretic) game data'
    
      22            'clang: Clang build option support'
    
      23            'chexquest3-wad: Chex Quest 3 game data'
    
      24            'doom1-wad: Doom shareware game data'
    
      25            'freedm: FreeDM game data'
    
      26            'freedoom: Freedoom game data'
    
      27            'gxmessage: crash dialog (GNOME)'
    
      28            'hacx-wad: HacX game data'
    
      29            'harmony-wad: Harmony game data'
    
      30            'heretic1-wad: Heretic shareware game data'
    
      31            'hexen1-wad: Hexen demo game data'
    
      32            'kdialog: crash dialog (KDE)'
    
      33            'lld: Clang build option dependency'
    
      34            'strife0-wad: Strife shareware game data'
    
      35            'square1-wad: The Adventures of Square, Episode 1 game data'
    
      36            'urbanbrawl-wad: Urban Brawl: Action Doom 2 game data'
    
      37            'xorg-xmessage: crash dialog (other)'
    
      38            'zmusic-git: System-level ZMusic instead of static compile (requires cmake option change)')
    
      39provides=('vkdoom' 'vkdoom-bin-nightly')
    
      40conflicts=('vkdoom' 'vkdoom-bin-nightly')
    
      41#disable LTO due to instability
    
      42options=(!debug !lto)
    
      43source=('vkdoom::git+https://git.sayachan.org/OrdinaryMagician/vkdoom_m.git'
    
      44        'org.vkdoom.vkdoom.desktop'
    
      45        '0001-Enforce-file-paths.patch')
    
      46        
    
      47sha256sums=('SKIP'
    
      48            'e1ff11673e11df9b752a30f16d573bf7b555f12048dbb5ec364cf8f81ef47daf'
    
      49            'f9b5de60b4636b7de6a4c5434e4a320e145de9fb18e4d5d41334d575cf375811')
    
      50
    
      51_enforce_clang=${_enforce_clang-}
    
      52
    
      53if [ -n "$_enforce_clang" ]; then
    
      54    makedepends+=(clang llvm lld)
    
      55fi
    
      56
    
      57pkgver() {
    
      58    cd vkdoom
    
      59    git describe --tags --match '[Vv]*' | sed -r 's/^[Gg]//;s/-/+/g'
    
      60}
    
      61
    
      62## the "upstream broke again section" quick fix area!
    
      63
    
      64## Force format-security errors to be bypassed.
    
      65# CFLAGS+=" -Wno-error=format-security"
    
      66# CXXFLAGS+=" -Wno-error=format-security"
    
      67
    
      68prepare() {
    
      69    cd vkdoom
    
      70    patch -i "$srcdir"/0001-Enforce-file-paths.patch -p 1
    
      71}
    
      72
    
      73build() {
    
      74    cd vkdoom
    
      75    mkdir -p build
    
      76    if [ -n "$_enforce_clang" ]; then
    
      77        echo "Building VkDoom with Clang..."
    
      78        cmake -B build \
    
      79            -D CMAKE_BUILD_TYPE=Release \
    
      80            -D CMAKE_CXX_FLAGS="$CXXFLAGS -ffile-prefix-map=\"$PWD\"=. -DSHARE_DIR=\\\"/usr/share/vkdoom\\\"" \
    
      81            -D CMAKE_INSTALL_PREFIX=/usr \
    
      82            -D SYSTEMINSTALL=ON \
    
      83            -D INSTALL_PK3_PATH=share/vkdoom \
    
      84            -D INSTALL_SOUNDFONT_PATH=share/vkdoom \
    
      85            -D INSTALL_RPATH=/usr/lib \
    
      86            -D DYN_GTK=OFF \
    
      87            -D DYN_OPENAL=OFF \
    
      88            -D FORCE_INTERNAL_ZMUSIC=ON \
    
      89            -D BUILD_SHARED_LIBS=OFF \
    
      90            -D CMAKE_C_COMPILER="/usr/bin/clang" \
    
      91            -D CMAKE_CXX_COMPILER="/usr/bin/clang++" \
    
      92            -G Ninja
    
      93    else
    
      94        echo "Building VkDoom with System Compiler..."
    
      95        cmake -B build \
    
      96            -D CMAKE_BUILD_TYPE=Release \
    
      97            -D CMAKE_CXX_FLAGS="$CXXFLAGS -ffile-prefix-map=\"$PWD\"=. -DSHARE_DIR=\\\"/usr/share/vkdoom\\\"" \
    
      98            -D CMAKE_INSTALL_PREFIX=/usr \
    
      99            -D SYSTEMINSTALL=ON \
    
      100            -D INSTALL_PK3_PATH=share/vkdoom \
    
      101            -D INSTALL_SOUNDFONT_PATH=share/vkdoom \
    
      102            -D INSTALL_RPATH=/usr/lib \
    
      103            -D DYN_GTK=OFF \
    
      104            -D DYN_OPENAL=OFF \
    
      105            -D FORCE_INTERNAL_ZMUSIC=ON \
    
      106            -D BUILD_SHARED_LIBS=OFF \
    
      107            -G Ninja
    
      108    fi
    
      109    ninja -C build
    
      110}
    
      111
    
      112package() {
    
      113    cd vkdoom
    
      114    DESTDIR="$pkgdir" ninja -C build install
    
      115    install -d "$pkgdir"/usr/share/licenses
    
      116    mv "$pkgdir"/usr/share/doc/vkdoom/licenses "$pkgdir"/usr/share/licenses/vkdoom
    
      117    desktop-file-install "$srcdir"/org.vkdoom.vkdoom.desktop --dir="$pkgdir"/usr/share/applications
    
      118    install src/posix/zdoom.xpm -D -m 644 "$pkgdir"/usr/share/icons/hicolor/256x256/apps/vkdoom.xpm
    
      119    install src/posix/unix/org.vkdoom.vkdoom.svg -D -m 644 "$pkgdir"/usr/share/pixmaps/org.vkdoom.vkdoom.svg
    
      120    install src/posix/unix/org.vkdoom.vkdoom.metainfo.xml -D -m 644 "$pkgdir"/usr/share/metainfo/org.vkdoom.vkdoom.metainfo.xml
    
      121    ## workaround number 2, nuke CPPDAP system install because upstream CMAKE is broken
    
      122    rm -rf "$pkgdir"/usr/include
    
      123    rm -rf "$pkgdir"/usr/lib
    
      124    #remove GZDoom freedesktop files that are still in here for some reason
    
      125    rm -f "$pkgdir"/usr/share/applications/org.zdoom.GZDoom.desktop
    
      126    rm -f "$pkgdir"/usr/share/icons/hicolor/scalable/apps/org.zdoom.GZDoom.svg
    
      127    rm -f "$pkgdir"/usr/share/metainfo/org.zdoom.GZDoom.metainfo.xml
    
      128    rm -f "$pkgdir"/usr/share/mime/packages/org.zdoom.GZDoom-mime.xml
    
      129
    
      130}
    
      131

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2