wolf3d

maintainer gameslayer · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads game data files at package() time from archive.org without including them in source=() and without any checksum verification. While archive.org is a legitimate public archive, the absence of integrity verification (no sha256/md5 check) means a compromised or substituted archive could deliver arbitrary data that gets installed into /usr/share/games. The game data files (.wl6) are not executed directly, but the package also copies a binary named 'wolf3d' from the source tarball (which itself uses sha256sums=SKIP) into /usr/bin — this is the more significant concern. The source tarball from a personal GitLab repo has SKIP checksums, meaning the compiled binary installed to /usr/bin has no integrity guarantee. The combination of an unverified binary in /usr/bin plus unverified runtime data download constitutes a real supply-chain concern, keeping this at MEDIUM.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:30 wget "https://archive.org/download/wolf3d-datafiles/wolf3d-datafiles.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads game data files at package() time from archive.org without including them in source=() and without any checksum verification. While archive.org is a legitimate public archive, the absence of integrity verification (no sha256/md5 check) means a compromised or substituted archive could deliver arbitrary data that gets installed into /usr/share/games. The game data files (.wl6) are not executed directly, but the package also copies a binary named 'wolf3d' from the source tarball (which itself uses sha256sums=SKIP) into /usr/bin — this is the more significant concern. The source tarball from a personal GitLab repo has SKIP checksums, meaning the compiled binary installed to /usr/bin has no integrity guarantee. The combination of an unverified binary in /usr/bin plus unverified runtime data download constitutes a real supply-chain concern, keeping this at MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=wolf3d
    
      2_pkgname=Wolf3D
    
      3pkgver=1.0.0
    
      4pkgrel=2
    
      5pkgdesc="Wolfenstein3D game powered by the wolf4sdl."
    
      6arch=('pentium4' 'i386' 'i686' 'x86_64' 'aarch64')
    
      7url="https://gitlab.com/linuxbombay/wolfenstein3d"
    
      8license=('GPL')
    
      9depends=('wolf4sdl-bin' 'wget' 'unzip' 'yad')
    
      10makedepends=('unzip')
    
      11source=("$url/-/archive/$pkgver-$pkgrel/wolfenstein3d-$pkgver-$pkgrel.tar.bz2")
    
      12sha256sums=("SKIP")
    
      13
    
      14package() {
    
      15    install -dm755 "$pkgdir/usr/bin"
    
      16    install -dm775 "$pkgdir/usr/share/games/$_pkgname"
    
      17    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      18
    
      19    # Packaging files
    
      20    #for dir in $_pkgname-$pkgver-$pkgrel-*/ ; do mv "${dir}" "$pkgname-$pkgver-$pkgrel" ;done
    
      21    # Check if config.wl6 exists so it doesn't redownload the file when it doesn't need to.
    
      22    FILE="/usr/share/games/$_pkgname/config.wl6"
    
      23     if test -f "$FILE"
    
      24    then
    
      25        echo "$FILE exists skipping download."
    
      26        cp '/usr/share/games/Wolf3D/'*.wl6 "$pkgdir/usr/share/games/$_pkgname"
    
      27    else
    
      28        echo "$FILE does not exist, Starting download.."
    
      29        cd $srcdir
    
      30        wget "https://archive.org/download/wolf3d-datafiles/wolf3d-datafiles.zip"
    
      31        unzip wolf3d-datafiles.zip -d "$pkgdir/usr/share/games/$_pkgname"
    
      32    fi
    
      33    cd $srcdir/wolfenstein3d-$pkgver-$pkgrel
    
      34    cp "$srcdir/wolfenstein3d-$pkgver-$pkgrel/$pkgname" "$pkgdir/usr/bin"
    
      35    cp -r ./ "$pkgdir/usr/share/games/$_pkgname"
    
      36    cp wolf3d.png "$pkgdir/usr/share/pixmaps"
    
      37
    
      38    # Desktop Entry
    
      39    install -Dm644 "$srcdir/wolfenstein3d-$pkgver-$pkgrel/$_pkgname.desktop" \
    
      40    "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      41    sed -i s%/usr/share%/opt% "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2