wolf3d

MEDIUM

maintainer gameslayer 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads game data files at package() time from archive.org without including them in source=() and without any checksum verification. While archive.org is a legitimate public archive, the absence of integrity verification (no sha256/md5 check) means a compromised or substituted archive could deliver arbitrary data that gets installed into /usr/share/games. The game data files (.wl6) are not executed directly, but the package also copies a binary named 'wolf3d' from the source tarball (which itself uses sha256sums=SKIP) into /usr/bin — this is the more significant concern. The source tarball from a personal GitLab repo has SKIP checksums, meaning the compiled binary installed to /usr/bin has no integrity guarantee. The combination of an unverified binary in /usr/bin plus unverified runtime data download constitutes a real supply-chain concern, keeping this at MEDIUM.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:30 wget "https://archive.org/download/wolf3d-datafiles/wolf3d-datafiles.zip"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads game data files at package() time from archive.org without including them in source=() and without any checksum verification. While archive.org is a legitimate public archive, the absence of integrity verification (no sha256/md5 check) means a compromised or substituted archive could deliver arbitrary data that gets installed into /usr/share/games. The game data files (.wl6) are not executed directly, but the package also copies a binary named 'wolf3d' from the source tarball (which itself uses sha256sums=SKIP) into /usr/bin — this is the more significant concern. The source tarball from a personal GitLab repo has SKIP checksums, meaning the compiled binary installed to /usr/bin has no integrity guarantee. The combination of an unverified binary in /usr/bin plus unverified runtime data download constitutes a real supply-chain concern, keeping this at MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=wolf3d
    
      2_pkgname=Wolf3D
    
      3pkgver=1.0.0
    
      4pkgrel=2
    
      5pkgdesc="Wolfenstein3D game powered by the wolf4sdl."
    
      6arch=('pentium4' 'i386' 'i686' 'x86_64' 'aarch64')
    
      7url="https://gitlab.com/linuxbombay/wolfenstein3d"
    
      8license=('GPL')
    
      9depends=('wolf4sdl-bin' 'wget' 'unzip' 'yad')
    
      10makedepends=('unzip')
    
      11source=("$url/-/archive/$pkgver-$pkgrel/wolfenstein3d-$pkgver-$pkgrel.tar.bz2")
    
      12sha256sums=("SKIP")
    
      13
    
      14package() {
    
      15    install -dm755 "$pkgdir/usr/bin"
    
      16    install -dm775 "$pkgdir/usr/share/games/$_pkgname"
    
      17    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      18
    
      19    # Packaging files
    
      20    #for dir in $_pkgname-$pkgver-$pkgrel-*/ ; do mv "${dir}" "$pkgname-$pkgver-$pkgrel" ;done
    
      21    # Check if config.wl6 exists so it doesn't redownload the file when it doesn't need to.
    
      22    FILE="/usr/share/games/$_pkgname/config.wl6"
    
      23     if test -f "$FILE"
    
      24    then
    
      25        echo "$FILE exists skipping download."
    
      26        cp '/usr/share/games/Wolf3D/'*.wl6 "$pkgdir/usr/share/games/$_pkgname"
    
      27    else
    
      28        echo "$FILE does not exist, Starting download.."
    
      29        cd $srcdir
    
      30        wget "https://archive.org/download/wolf3d-datafiles/wolf3d-datafiles.zip"
    
      31        unzip wolf3d-datafiles.zip -d "$pkgdir/usr/share/games/$_pkgname"
    
      32    fi
    
      33    cd $srcdir/wolfenstein3d-$pkgver-$pkgrel
    
      34    cp "$srcdir/wolfenstein3d-$pkgver-$pkgrel/$pkgname" "$pkgdir/usr/bin"
    
      35    cp -r ./ "$pkgdir/usr/share/games/$_pkgname"
    
      36    cp wolf3d.png "$pkgdir/usr/share/pixmaps"
    
      37
    
      38    # Desktop Entry
    
      39    install -Dm644 "$srcdir/wolfenstein3d-$pkgver-$pkgrel/$_pkgname.desktop" \
    
      40    "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      41    sed -i s%/usr/share%/opt% "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2