vkquake3-git

maintainer jorgicio · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The .run file downloaded from ftp.gwdg.de is the official Quake 3 1.32b point release patch from id Software — ftp.gwdg.de/pub/misc/ftp.idsoftware.com is a well-known mirror of the old id Software FTP archive, and this specific file (linuxq3apoint-1.32b-3.x86.run) is the canonical Linux patch installer that has been referenced by Quake 3 packaging across many distributions for over a decade. It is verified by an md5sum (c71fdddccb20e8fc393d846e9c61d685). The file is executed only to extract its embedded tar archive (--tar xf), not to run an arbitrary installer script with elevated privileges. The extracted content (pk3 game data files) is pure game data, not executed code. While using a mirror rather than a canonical upstream URL is non-ideal, and md5 is a weak checksum, this is a well-established packaging pattern for Quake 3 on Linux. The risk is low rather than medium because the file is a known artifact with a matching checksum, the host is a reputable German university mirror of id Software content, and the execution mode extracts data rather than running an install script.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The .run file downloaded from ftp.gwdg.de is the official Quake 3 1.32b point release patch from id Software — ftp.gwdg.de/pub/misc/ftp.idsoftware.com is a well-known mirror of the old id Software FTP archive, and this specific file (linuxq3apoint-1.32b-3.x86.run) is the canonical Linux patch installer that has been referenced by Quake 3 packaging across many distributions for over a decade. It is verified by an md5sum (c71fdddccb20e8fc393d846e9c61d685). The file is executed only to extract its embedded tar archive (--tar xf), not to run an arbitrary installer script with elevated privileges. The extracted content (pk3 game data files) is pure game data, not executed code. While using a mirror rather than a canonical upstream URL is non-ideal, and md5 is a weak checksum, this is a well-established packaging pattern for Quake 3 on Linux. The risk is low rather than medium because the file is a known artifact with a matching checksum, the host is a reputable German university mirror of id Software content, and the execution mode extracts data rather than running an install script.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "http://ftp.gwdg.de/pub/misc/ftp.idsoftware.com/idstuff/quake3/linux/linuxq3apoint-1.32b-3.x86.run"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jorge Pizarro-Callejas <jpizarrocallejas@gmail.com>
    
      2pkgname=vkquake3-git
    
      3_pkgname=${pkgname%-git}
    
      4pkgver=0.01.r50.gec8089b0
    
      5pkgrel=1
    
      6pkgdesc="A Quake 3 engine based on ioquake3 but with additional Vulkan API support"
    
      7arch=('i686' 'x86_64' 'aarch64')
    
      8url="https://github.com/suijingfeng/vkQuake3"
    
      9license=('GPL')
    
      10depends=('curl' 'libjpeg' 'libvorbis' 'openal' 'opus' 'opusfile' 'sdl2' 'vulkan-icd-loader' 'vulkan-validation-layers' 'zlib')
    
      11makedepends=('git' 'vulkan-headers')
    
      12optdepends=('mumble: Mumble VoIP support')
    
      13provides=('vkquake3' 'quake3')
    
      14conflicts=('quake3' 'quake3-icculus-svn' 'quake3-svn' 'ioquake3-svn' 'ioquake3-git')
    
      15replaces=('quake3-icculus-svn' 'ioquake3-svn' 'ioquake3-git')
    
      16install=quake3.install
    
      17source=("quake3.desktop" "quake3.png"
    
      18        "${_pkgname}-add-copy-vulkan-libs.patch"
    
      19        "http://ftp.gwdg.de/pub/misc/ftp.idsoftware.com/idstuff/quake3/linux/linuxq3apoint-1.32b-3.x86.run"
    
      20        "${_pkgname}::git+https://github.com/suijingfeng/vkQuake3.git")
    
      21md5sums=('798fa080743cd95e7935c15b4973a0fb'
    
      22         '286d89ab18f164e919c409698bfed4f1'
    
      23         'ed867c57b6c819329279214b22be5040'
    
      24         'c71fdddccb20e8fc393d846e9c61d685'
    
      25         'SKIP')
    
      26
    
      27pkgver() {
    
      28	cd "${srcdir}/${_pkgname}"
    
      29	git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      30}
    
      31
    
      32prepare() {
    
      33	cd "${srcdir}"
    
      34    # Extract patch files
    
      35    chmod +x "${srcdir}/linuxq3apoint-1.32b-3.x86.run"
    
      36    "${srcdir}/linuxq3apoint-1.32b-3.x86.run" --tar xf
    
      37    cd "${srcdir}/${_pkgname}"
    
      38    patch -p1 < ../"${_pkgname}-add-copy-vulkan-libs.patch"
    
      39}
    
      40
    
      41q3make() {
    
      42    # NOTE: Freetype support is kinda broken.
    
      43    export CFLAGS+=" ${CPPFLAGS}"
    
      44
    
      45    make $@ \
    
      46        BUILD_CLIENT=1 \
    
      47        BUILD_SERVER=1 \
    
      48        BUILD_BASEGAME=0 \
    
      49        BUILD_MISSIONPACK=0 \
    
      50        BUILD_GAME_SO=0 \
    
      51        BUILD_GAME_QVM=0 \
    
      52        BUILD_RENDERER_OPENGL2=1 \
    
      53        DEFAULT_BASEDIR="/opt/quake3" \
    
      54        FULLBINEXT='' \
    
      55        GENERATE_DEPENDENCIES=0 \
    
      56        OPTIMIZE='' \
    
      57        USE_OPENAL=1 \
    
      58        USE_OPENAL_DLOPEN=0 \
    
      59        USE_CURL=1 \
    
      60        USE_CURL_DLOPEN=0 \
    
      61        USE_CODEC_VORBIS=1 \
    
      62        USE_CODEC_OPUS=1 \
    
      63        USE_FREETYPE=0 \
    
      64        USE_MUMBLE=1 \
    
      65        USE_VOIP=1 \
    
      66        USE_INTERNAL_LIBS=0
    
      67}
    
      68
    
      69build() {
    
      70	cd "${srcdir}/${_pkgname}"
    
      71	q3make
    
      72}
    
      73
    
      74package() {
    
      75    cd "${srcdir}/${_pkgname}"
    
      76
    
      77    # Create Destination Directories
    
      78    install -d "${pkgdir}"/{usr/bin,/opt/quake3/{baseq3,missionpack,demoq3}}
    
      79
    
      80    # Install Files
    
      81    q3make COPYDIR="${pkgdir}/opt/quake3" copyfiles
    
      82
    
      83    # Install Quake 3 Patch Files
    
      84    install -m 644 "${srcdir}"/baseq3/*.pk3 \
    
      85        "${pkgdir}/opt/quake3/baseq3/"
    
      86
    
      87    # Install Quake 3 Expansion Pack Patch Files
    
      88    install -m 644 "${srcdir}"/missionpack/*.pk3 \
    
      89        "${pkgdir}/opt/quake3/missionpack/"
    
      90
    
      91    # Link pk3 files to demoq3
    
      92    ln -sf /opt/quake3/baseq3/pak{1..8}.pk3 "${pkgdir}/opt/quake3/demoq3/"
    
      93
    
      94    # Link Executables in /usr/bin
    
      95    ln -sf "/opt/quake3/ioquake3" "${pkgdir}/usr/bin/quake3"
    
      96    ln -sf "/opt/quake3/ioq3ded" "${pkgdir}/usr/bin/q3ded"
    
      97
    
      98    # Install systemd service file
    
      99    install -D -m 644 "${srcdir}/${_pkgname}/misc/linux/q3a.service" \
    
      100        "${pkgdir}/usr/lib/systemd/system/q3a.service"
    
      101
    
      102    # Patch systemd service file
    
      103    sed -i -e "s@/usr/local/games/quake3/ioq3ded.x86_64@/opt/quake3/q3ded@" \
    
      104        "${pkgdir}/usr/lib/systemd/system/q3a.service"
    
      105
    
      106    # Install Desktop File
    
      107    install -D -m 644 "${srcdir}/quake3.desktop" \
    
      108        "${pkgdir}/usr/share/applications/quake3.desktop"
    
      109
    
      110    # Install Icon File
    
      111    install -D -m 644 "${srcdir}/quake3.png" \
    
      112        "${pkgdir}/usr/share/pixmaps/quake3.png"
    
      113}
    
      114

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2