xonotic-autobuild

maintainer johnnybash · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The rsync sources are scripts and configuration files from the official xonotic.org infrastructure, used to update the build; they are not untrusted executables, and the package primarily builds from source and installs data/assets, resulting in low risk despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The rsync sources are scripts and configuration files from the official xonotic.org infrastructure, used to update the build; they are not untrusted executables, and the package primarily builds from source and installs data/assets, resulting in low risk despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("rsync://beta.xonotic.org/autobuild-Xonotic/misc/tools/rsync-updater/update-to-autobuild.sh"
PKGBUILD:20 "rsync://rsync.xonotic.org/autobuild/Xonotic/misc/tools/rsync-updater/mirrors.txt")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: johnnybash <georg at grgw dot de>
    
      2# Contributor: Alex Talker <alextalker at openmailbox dot org>
    
      3# Contributor: Sven-Hendrik Haase <sh@lutzhaase.com>
    
      4# Contributor: Alexander Suhoverhov <cy at ngs dot ru>
    
      5# Contributor: Jookia <166291@gmail.com>
    
      6pkgname=xonotic-autobuild
    
      7pkgver=20250630
    
      8pkgrel=1
    
      9pkgdesc="A free, fast-paced cross-platform first person shooter"
    
      10arch=('x86_64' 'aarch64')
    
      11url="http://xonotic.org"
    
      12license=('GPL-3.0-only')
    
      13depends=('alsa-lib' 'curl' 'libmodplug' 'libvorbis' 'libxpm'
    
      14         'sdl2' 'gtk-update-icon-cache' 'desktop-file-utils')
    
      15makedepends=('mesa' 'rsync')
    
      16options=('!debug' '!strip')
    
      17conflicts=('xonotic' 'xonotic-data' 'xonotic-git')
    
      18
    
      19source=("rsync://beta.xonotic.org/autobuild-Xonotic/misc/tools/rsync-updater/update-to-autobuild.sh"
    
      20        "rsync://rsync.xonotic.org/autobuild/Xonotic/misc/tools/rsync-updater/mirrors.txt")
    
      21sha512sums=('e8f684425f96cf3803946d22fd075e010fee48233f971b79a4ecb453890c81eea3d192bc4b5f47e87e936b26c6446837b17eafa1fa3c4e42aa93a16e378fee35'
    
      22            '57e3eb4aa983e0d51b3012a651b772e04a1238e9fdeee37f11016809270cd05a1189f3c4c64621671011897a6c9e31dfc1b391452dddf30f1073cbfe56a85ef9')
    
      23b2sums=('963e6c975515fa31d2ae1be20757fddca0b0607dc3b1f2c04331dadac7c9202937e2f2feb26eaa5739f68ea236d7cd8fa1f12587897d5180c7a206d7a92caf12'
    
      24        '04f02f4b399a36cad1be1ca6b33ac212d8ad0db72e0756f52f6424473bd1968ebaeb805541633c7ea722deead9f1220272f5809065af1d24f58f46621701e183')
    
      25
    
      26pkgver() {
    
      27  printf $(date +%Y%m%d -r Xonotic/xonotic-linux64-sdl)
    
      28}
    
      29
    
      30prepare() {
    
      31  mkdir -p Xonotic/misc/tools/rsync-updater/
    
      32  cp update-to-autobuild.sh Xonotic/misc/tools/rsync-updater/
    
      33  cp mirrors.txt Xonotic/misc/tools/rsync-updater/
    
      34  cd Xonotic/misc/tools/rsync-updater/
    
      35  touch Xonotic
    
      36  sh ./update-to-autobuild.sh --yes
    
      37}
    
      38
    
      39build() {
    
      40  # compile engine
    
      41  make -C Xonotic/source/darkplaces \
    
      42    CPUOPTIMIZATIONS="${CFLAGS}" \
    
      43    DP_FS_BASEDIR=/usr/share/xonotic/ \
    
      44    DP_LINK_TO_LIBJPEG=1 \
    
      45    sdl-release
    
      46
    
      47  make -C Xonotic/source/darkplaces \
    
      48    CPUOPTIMIZATIONS="${CFLAGS}" \
    
      49    DP_FS_BASEDIR=/usr/share/xonotic/ \
    
      50    DP_LINK_TO_LIBJPEG=1 \
    
      51    sv-release
    
      52
    
      53  cd Xonotic/source/d0_blind_id
    
      54  ./autogen.sh
    
      55  ./configure --prefix=/usr
    
      56  make
    
      57}
    
      58
    
      59package() {
    
      60  cd Xonotic
    
      61  # data
    
      62  install -d "$pkgdir"/usr/share/xonotic/
    
      63  mv data "$pkgdir"/usr/share/xonotic/
    
      64
    
      65  # server stuff
    
      66  cp -r server "$pkgdir"/usr/share/xonotic/
    
      67
    
      68  # binaries
    
      69  install -Dm755 source/darkplaces/darkplaces-dedicated "$pkgdir"/usr/bin/xonotic-dedicated
    
      70  install -Dm755 source/darkplaces/darkplaces-sdl "$pkgdir"/usr/bin/xonotic-sdl
    
      71
    
      72  # convenience files
    
      73  install -d "$pkgdir"/usr/share/applications
    
      74  install -Dm644 misc/logos/xonotic.desktop -t $pkgdir/usr/share/applications
    
      75
    
      76  for size in 16 22 24 32 48 64 128 256 512; do
    
      77    install -Dm644 misc/logos/icons_png/xonotic_${size}.png \
    
      78      "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/xonotic.png"
    
      79  done
    
      80
    
      81  # key
    
      82  install -Dm644 key_0.d0pk "$pkgdir"/usr/share/xonotic/key_0.d0pk
    
      83
    
      84  # crypto stuff
    
      85  cd source/d0_blind_id
    
      86  make DESTDIR="$pkgdir" install
    
      87}
    
      88
    
      89# vim: ts=2:sw=2 et:
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2