wolf3d

MEDIUM

maintainer gameslayer 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD downloads game data files at package() time from archive.org without including them in source=() and without any checksum verification. While archive.org is a legitimate public archive, the absence of integrity verification (no sha256/md5 check) means a compromised or substituted archive could deliver arbitrary data that gets installed into /usr/share/games. The game data files (.wl6) are not executed directly, but the package also copies a binary named 'wolf3d' from the source tarball (which itself uses sha256sums=SKIP) into /usr/bin — this is the more significant concern. The source tarball from a personal GitLab repo has SKIP checksums, meaning the compiled binary installed to /usr/bin has no integrity guarantee. The combination of an unverified binary in /usr/bin plus unverified runtime data download constitutes a real supply-chain concern, keeping this at MEDIUM.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:30 wget "https://archive.org/download/wolf3d-datafiles/wolf3d-datafiles.zip"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads game data files at package() time from archive.org without including them in source=() and without any checksum verification. While archive.org is a legitimate public archive, the absence of integrity verification (no sha256/md5 check) means a compromised or substituted archive could deliver arbitrary data that gets installed into /usr/share/games. The game data files (.wl6) are not executed directly, but the package also copies a binary named 'wolf3d' from the source tarball (which itself uses sha256sums=SKIP) into /usr/bin — this is the more significant concern. The source tarball from a personal GitLab repo has SKIP checksums, meaning the compiled binary installed to /usr/bin has no integrity guarantee. The combination of an unverified binary in /usr/bin plus unverified runtime data download constitutes a real supply-chain concern, keeping this at MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=wolf3d
    
      2_pkgname=Wolf3D
    
      3pkgver=1.0.0
    
      4pkgrel=2
    
      5pkgdesc="Wolfenstein3D game powered by the wolf4sdl."
    
      6arch=('pentium4' 'i386' 'i686' 'x86_64' 'aarch64')
    
      7url="https://gitlab.com/linuxbombay/wolfenstein3d"
    
      8license=('GPL')
    
      9depends=('wolf4sdl-bin' 'wget' 'unzip' 'yad')
    
      10makedepends=('unzip')
    
      11source=("$url/-/archive/$pkgver-$pkgrel/wolfenstein3d-$pkgver-$pkgrel.tar.bz2")
    
      12sha256sums=("SKIP")
    
      13
    
      14package() {
    
      15    install -dm755 "$pkgdir/usr/bin"
    
      16    install -dm775 "$pkgdir/usr/share/games/$_pkgname"
    
      17    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      18
    
      19    # Packaging files
    
      20    #for dir in $_pkgname-$pkgver-$pkgrel-*/ ; do mv "${dir}" "$pkgname-$pkgver-$pkgrel" ;done
    
      21    # Check if config.wl6 exists so it doesn't redownload the file when it doesn't need to.
    
      22    FILE="/usr/share/games/$_pkgname/config.wl6"
    
      23     if test -f "$FILE"
    
      24    then
    
      25        echo "$FILE exists skipping download."
    
      26        cp '/usr/share/games/Wolf3D/'*.wl6 "$pkgdir/usr/share/games/$_pkgname"
    
      27    else
    
      28        echo "$FILE does not exist, Starting download.."
    
      29        cd $srcdir
    
      30        wget "https://archive.org/download/wolf3d-datafiles/wolf3d-datafiles.zip"
    
      31        unzip wolf3d-datafiles.zip -d "$pkgdir/usr/share/games/$_pkgname"
    
      32    fi
    
      33    cd $srcdir/wolfenstein3d-$pkgver-$pkgrel
    
      34    cp "$srcdir/wolfenstein3d-$pkgver-$pkgrel/$pkgname" "$pkgdir/usr/bin"
    
      35    cp -r ./ "$pkgdir/usr/share/games/$_pkgname"
    
      36    cp wolf3d.png "$pkgdir/usr/share/pixmaps"
    
      37
    
      38    # Desktop Entry
    
      39    install -Dm644 "$srcdir/wolfenstein3d-$pkgver-$pkgrel/$_pkgname.desktop" \
    
      40    "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      41    sed -i s%/usr/share%/opt% "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2