wolf-data-steam

MEDIUM

maintainer demon012 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt self-extracting binary installer (wolf-linux-1.41b.x86.run) from a personal Dropbox account and executes it during the build phase (`./wolf-linux-${pkgver}.x86.run --target files --noexec`). While an md5sum is provided, MD5 is cryptographically broken and provides weak integrity assurance. The host (dl.dropboxusercontent.com with a personal share key) is not an official vendor distribution channel — the official Linux installer for RtCW was distributed by id Software/Activision, not via a personal Dropbox. The Dropbox link could be replaced at any time by the account owner or compromised. Executing an arbitrary binary from a personal file-sharing host is a genuine supply-chain concern. The package also interactively prompts for Steam credentials during the build, which is unusual but not inherently malicious (steamcmd handles the login). Overall this is a real medium-severity supply-chain risk due to the executed binary from an unofficial personal host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://dl.dropboxusercontent.com/s/97qyelre9iryv37/wolf-linux-${pkgver}.x86.run")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt self-extracting binary installer (wolf-linux-1.41b.x86.run) from a personal Dropbox account and executes it during the build phase (`./wolf-linux-${pkgver}.x86.run --target files --noexec`). While an md5sum is provided, MD5 is cryptographically broken and provides weak integrity assurance. The host (dl.dropboxusercontent.com with a personal share key) is not an official vendor distribution channel — the official Linux installer for RtCW was distributed by id Software/Activision, not via a personal Dropbox. The Dropbox link could be replaced at any time by the account owner or compromised. Executing an arbitrary binary from a personal file-sharing host is a genuine supply-chain concern. The package also interactively prompts for Steam credentials during the build, which is unusual but not inherently malicious (steamcmd handles the login). Overall this is a real medium-severity supply-chain risk due to the executed binary from an unofficial personal host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alan Jenkins <alan.james.jenkins [at] gmail.com>
    
      2# Original wolf-data package by M0Rf30
    
      3pkgname=wolf-data-steam
    
      4pkgver=1.41b
    
      5pkgrel=3
    
      6pkgdesc="Return to Castle Wolfenstein native Linux Single Player data via Steam"
    
      7arch=('any')
    
      8conflicts=('wolf-data')
    
      9provides=('wolf-data')
    
      10depends=('steamcmd')
    
      11url="ftp://ftp.internat.freebsd.org/pub/FreeBSD/distfiles/"
    
      12license=('GPL')
    
      13install='wolf-data-steam.install'
    
      14source=("https://dl.dropboxusercontent.com/s/97qyelre9iryv37/wolf-linux-${pkgver}.x86.run")
    
      15md5sums=('2aa37968aff19d665ed6c001773b2de3')
    
      16
    
      17package() {
    
      18    # Set Install Files to Executable
    
      19    cd $srcdir
    
      20    chmod +x wolf-linux-${pkgver}.x86.run
    
      21
    
      22    # Extract Linux Game Files
    
      23    ./wolf-linux-${pkgver}.x86.run --target files --noexec
    
      24    cd files
    
      25    # Remove Unneeded Files and Directories
    
      26    cd main
    
      27    rm *.so
    
      28
    
      29    # Move Data to Package Directory
    
      30    mkdir -p $pkgdir/opt/wolf-data
    
      31    cp -r * $pkgdir/opt/wolf-data/
    
      32
    
      33    # Use steamcmd to get the rest of the data required.
    
      34    mkdir -p $srcdir/wolf-data-steam
    
      35    printf "Enter your Steam username:"
    
      36    read steam_username
    
      37    steamcmd +@sSteamCmdForcePlatformType windows +@ShutdownOnFailedCommand 1 +force_install_dir $srcdir/wolf-data-steam +login $steam_username "+app_update 9010 validate" +quit
    
      38
    
      39    # Move required files to pkgdir
    
      40    install -D -m 644 $srcdir/files/main/mp_bin.pk3 $pkgdir/opt/wolf-data/mp_bin.pk3
    
      41    install -D -m 644 $srcdir/wolf-data-steam/Main/mp_pak0.pk3 $pkgdir/opt/wolf-data/mp_pak0.pk3
    
      42    install -D -m 644 $srcdir/files/main/mp_pak1.pk3 $pkgdir/opt/wolf-data/mp_pak1.pk3
    
      43    install -D -m 644 $srcdir/files/main/mp_pak2.pk3 $pkgdir/opt/wolf-data/mp_pak2.pk3
    
      44    install -D -m 644 $srcdir/files/main/mp_pak3.pk3 $pkgdir/opt/wolf-data/mp_pak3.pk3
    
      45    install -D -m 644 $srcdir/files/main/mp_pak4.pk3 $pkgdir/opt/wolf-data/mp_pak4.pk3
    
      46    install -D -m 644 $srcdir/files/main/mp_pak5.pk3 $pkgdir/opt/wolf-data/mp_pak5.pk3
    
      47    install -D -m 644 $srcdir/files/main/mp_pakmaps0.pk3 $pkgdir/opt/wolf-data/mp_pakmaps0.pk3
    
      48    install -D -m 644 $srcdir/files/main/mp_pakmaps1.pk3 $pkgdir/opt/wolf-data/mp_pakmaps1.pk3
    
      49    install -D -m 644 $srcdir/files/main/mp_pakmaps2.pk3 $pkgdir/opt/wolf-data/mp_pakmaps2.pk3
    
      50    install -D -m 644 $srcdir/files/main/mp_pakmaps3.pk3 $pkgdir/opt/wolf-data/mp_pakmaps3.pk3
    
      51    install -D -m 644 $srcdir/files/main/mp_pakmaps4.pk3 $pkgdir/opt/wolf-data/mp_pakmaps4.pk3
    
      52    install -D -m 644 $srcdir/files/main/mp_pakmaps5.pk3 $pkgdir/opt/wolf-data/mp_pakmaps5.pk3
    
      53    install -D -m 644 $srcdir/files/main/mp_pakmaps6.pk3 $pkgdir/opt/wolf-data/mp_pakmaps6.pk3
    
      54    install -D -m 644 $srcdir/wolf-data-steam/Main/pak0.pk3 $pkgdir/opt/wolf-data/pak0.pk3
    
      55    install -D -m 644 $srcdir/wolf-data-steam/Main/sp_pak1.pk3 $pkgdir/opt/wolf-data/sp_pak1.pk3
    
      56    install -D -m 644 $srcdir/files/main/sp_pak2.pk3 $pkgdir/opt/wolf-data/sp_pak2.pk3
    
      57    install -D -m 644 $srcdir/files/main/sp_pak3.pk3 $pkgdir/opt/wolf-data/sp_pak3.pk3
    
      58    install -D -m 644 $srcdir/wolf-data-steam/Main/sp_pak4.pk3 $pkgdir/opt/wolf-data/sp_pak4.pk3
    
      59}
    
      60
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2