wolf-data-steam

maintainer demon012 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt self-extracting binary installer (wolf-linux-1.41b.x86.run) from a personal Dropbox account and executes it during the build phase (`./wolf-linux-${pkgver}.x86.run --target files --noexec`). While an md5sum is provided, MD5 is cryptographically broken and provides weak integrity assurance. The host (dl.dropboxusercontent.com with a personal share key) is not an official vendor distribution channel — the official Linux installer for RtCW was distributed by id Software/Activision, not via a personal Dropbox. The Dropbox link could be replaced at any time by the account owner or compromised. Executing an arbitrary binary from a personal file-sharing host is a genuine supply-chain concern. The package also interactively prompts for Steam credentials during the build, which is unusual but not inherently malicious (steamcmd handles the login). Overall this is a real medium-severity supply-chain risk due to the executed binary from an unofficial personal host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://dl.dropboxusercontent.com/s/97qyelre9iryv37/wolf-linux-${pkgver}.x86.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt self-extracting binary installer (wolf-linux-1.41b.x86.run) from a personal Dropbox account and executes it during the build phase (`./wolf-linux-${pkgver}.x86.run --target files --noexec`). While an md5sum is provided, MD5 is cryptographically broken and provides weak integrity assurance. The host (dl.dropboxusercontent.com with a personal share key) is not an official vendor distribution channel — the official Linux installer for RtCW was distributed by id Software/Activision, not via a personal Dropbox. The Dropbox link could be replaced at any time by the account owner or compromised. Executing an arbitrary binary from a personal file-sharing host is a genuine supply-chain concern. The package also interactively prompts for Steam credentials during the build, which is unusual but not inherently malicious (steamcmd handles the login). Overall this is a real medium-severity supply-chain risk due to the executed binary from an unofficial personal host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alan Jenkins <alan.james.jenkins [at] gmail.com>
    
      2# Original wolf-data package by M0Rf30
    
      3pkgname=wolf-data-steam
    
      4pkgver=1.41b
    
      5pkgrel=3
    
      6pkgdesc="Return to Castle Wolfenstein native Linux Single Player data via Steam"
    
      7arch=('any')
    
      8conflicts=('wolf-data')
    
      9provides=('wolf-data')
    
      10depends=('steamcmd')
    
      11url="ftp://ftp.internat.freebsd.org/pub/FreeBSD/distfiles/"
    
      12license=('GPL')
    
      13install='wolf-data-steam.install'
    
      14source=("https://dl.dropboxusercontent.com/s/97qyelre9iryv37/wolf-linux-${pkgver}.x86.run")
    
      15md5sums=('2aa37968aff19d665ed6c001773b2de3')
    
      16
    
      17package() {
    
      18    # Set Install Files to Executable
    
      19    cd $srcdir
    
      20    chmod +x wolf-linux-${pkgver}.x86.run
    
      21
    
      22    # Extract Linux Game Files
    
      23    ./wolf-linux-${pkgver}.x86.run --target files --noexec
    
      24    cd files
    
      25    # Remove Unneeded Files and Directories
    
      26    cd main
    
      27    rm *.so
    
      28
    
      29    # Move Data to Package Directory
    
      30    mkdir -p $pkgdir/opt/wolf-data
    
      31    cp -r * $pkgdir/opt/wolf-data/
    
      32
    
      33    # Use steamcmd to get the rest of the data required.
    
      34    mkdir -p $srcdir/wolf-data-steam
    
      35    printf "Enter your Steam username:"
    
      36    read steam_username
    
      37    steamcmd +@sSteamCmdForcePlatformType windows +@ShutdownOnFailedCommand 1 +force_install_dir $srcdir/wolf-data-steam +login $steam_username "+app_update 9010 validate" +quit
    
      38
    
      39    # Move required files to pkgdir
    
      40    install -D -m 644 $srcdir/files/main/mp_bin.pk3 $pkgdir/opt/wolf-data/mp_bin.pk3
    
      41    install -D -m 644 $srcdir/wolf-data-steam/Main/mp_pak0.pk3 $pkgdir/opt/wolf-data/mp_pak0.pk3
    
      42    install -D -m 644 $srcdir/files/main/mp_pak1.pk3 $pkgdir/opt/wolf-data/mp_pak1.pk3
    
      43    install -D -m 644 $srcdir/files/main/mp_pak2.pk3 $pkgdir/opt/wolf-data/mp_pak2.pk3
    
      44    install -D -m 644 $srcdir/files/main/mp_pak3.pk3 $pkgdir/opt/wolf-data/mp_pak3.pk3
    
      45    install -D -m 644 $srcdir/files/main/mp_pak4.pk3 $pkgdir/opt/wolf-data/mp_pak4.pk3
    
      46    install -D -m 644 $srcdir/files/main/mp_pak5.pk3 $pkgdir/opt/wolf-data/mp_pak5.pk3
    
      47    install -D -m 644 $srcdir/files/main/mp_pakmaps0.pk3 $pkgdir/opt/wolf-data/mp_pakmaps0.pk3
    
      48    install -D -m 644 $srcdir/files/main/mp_pakmaps1.pk3 $pkgdir/opt/wolf-data/mp_pakmaps1.pk3
    
      49    install -D -m 644 $srcdir/files/main/mp_pakmaps2.pk3 $pkgdir/opt/wolf-data/mp_pakmaps2.pk3
    
      50    install -D -m 644 $srcdir/files/main/mp_pakmaps3.pk3 $pkgdir/opt/wolf-data/mp_pakmaps3.pk3
    
      51    install -D -m 644 $srcdir/files/main/mp_pakmaps4.pk3 $pkgdir/opt/wolf-data/mp_pakmaps4.pk3
    
      52    install -D -m 644 $srcdir/files/main/mp_pakmaps5.pk3 $pkgdir/opt/wolf-data/mp_pakmaps5.pk3
    
      53    install -D -m 644 $srcdir/files/main/mp_pakmaps6.pk3 $pkgdir/opt/wolf-data/mp_pakmaps6.pk3
    
      54    install -D -m 644 $srcdir/wolf-data-steam/Main/pak0.pk3 $pkgdir/opt/wolf-data/pak0.pk3
    
      55    install -D -m 644 $srcdir/wolf-data-steam/Main/sp_pak1.pk3 $pkgdir/opt/wolf-data/sp_pak1.pk3
    
      56    install -D -m 644 $srcdir/files/main/sp_pak2.pk3 $pkgdir/opt/wolf-data/sp_pak2.pk3
    
      57    install -D -m 644 $srcdir/files/main/sp_pak3.pk3 $pkgdir/opt/wolf-data/sp_pak3.pk3
    
      58    install -D -m 644 $srcdir/wolf-data-steam/Main/sp_pak4.pk3 $pkgdir/opt/wolf-data/sp_pak4.pk3
    
      59}
    
      60
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2