wanderer

maintainer catskillmarina · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the maintainer's personal host, but it is a standard source code package for a known game, built locally with transparent patches; the worst case of a swapped source is limited to code execution during build, which is within expected AUR risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the maintainer's personal host, but it is a standard source code package for a known game, built locally with transparent patches; the worst case of a swapped source is limited to code execution during build, which is within expected AUR risk.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("http://e271.net/~marina/$pkgname-$pkgver.tar.gz"

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:57 chmod g+s "$pkgdir/usr/bin/wanderer"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer : catskillmarina <catskillmarina @ gmail.com>
    
      2
    
      3pkgname=wanderer
    
      4pkgver=3.2
    
      5pkgrel=1.1
    
      6pkgdesc='Wanderer is a game like Boulderdash, Repton, XOR. (wanderer)'
    
      7arch=('any')
    
      8url="http://e271.net/~marina/wanderer"
    
      9license=('GPL')
    
      10depends=('ncurses' 'gzip')
    
      11source=("http://e271.net/~marina/$pkgname-$pkgver.tar.gz"
    
      12        'patch-edit_c'
    
      13        'patch-m_c'
    
      14        'patch-wanderer_6'
    
      15       )
    
      16md5sums=('83ca326c57a43c4d6cb3f7c7ef4008a1'
    
      17         '8825bce23b746231cdfc5d05d1b331bc'
    
      18         'e80004f41532fefc039aed0f76bcd176'
    
      19         '239aa9ce75296e8de220664b8f1d9cbb'
    
      20)
    
      21
    
      22prepare() {
    
      23  cd "$pkgname-$pkgver"
    
      24  pwd
    
      25  sed -e "s|/usr/local/share/wanderer/screens|/usr/share/wanderer/screens|" \
    
      26      -e "s|/* #define NO_ENCRYPTION |#define NO_ENCRYPTION |" -i $srcdir/$pkgname-$pkgver/wand_head.h
    
      27  sed -e 's|char \*malloc();|\/\* char \*malloc(); \*\/|' -i $srcdir/$pkgname-$pkgver/monsters.c
    
      28  sed -e 's|char \*malloc();|\/\* char \*malloc(); \*\/|' -i $srcdir/$pkgname-$pkgver/convert.c
    
      29  patch -p0 < $srcdir/patch-edit_c
    
      30  patch -p0 < $srcdir/patch-m_c
    
      31  patch -p0 < $srcdir/patch-wanderer_6
    
      32  # remove spurious binary #
    
      33  rm wanderer
    
      34}
    
      35
    
      36build(){
    
      37  cd "$pkgname-$pkgver"
    
      38  make
    
      39  pwd
    
      40}
    
      41  
    
      42package() {
    
      43  cd "$pkgname-$pkgver"
    
      44  pwd
    
      45  install -m 0755 -d -o root -g games "$pkgdir/usr/share/wanderer"
    
      46  install -m 0755 -d -o root -g games "$pkgdir/usr/share/wanderer/screens"
    
      47  install -m 0644 -o root -g games screens/* "$pkgdir/usr/share/wanderer/screens/"
    
      48
    
      49  install -dm775 $pkgdir/var/games/
    
      50  # FS#43414: /var/games should be owned by root:games.
    
      51  # copied from nethack
    
      52  chown -R root:games $pkgdir/var/games/
    
      53
    
      54  install -Dm2755 wanderer "$pkgdir/usr/bin/wanderer"
    
      55  # install -Dm655 wandererscores "$pkgdir/var/games/wandererscores
    
      56  chown root:games "$pkgdir/usr/bin/wanderer"
    
      57  chmod g+s "$pkgdir/usr/bin/wanderer"
    
      58  install -Dm644 wanderer.6 "$pkgdir/usr/share/man/man6/wanderer.6"
    
      59}
    
      60
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3