zdoom

maintainer envolution · 49 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a versioned tarball from the official project domain zdoom.org, which is plausibly the project's own release infrastructure; building from official source is normal AUR practice, even if the host is not on a standard whitelist.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a versioned tarball from the official project domain zdoom.org, which is plausibly the project's own release infrastructure; building from official source is normal AUR practice, even if the host is not on a standard whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 source=("http://zdoom.org/files/zdoom/${pkgver%.${pkgver#*.*.}}/zdoom-${pkgver}-src.7z"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: envolution
    
      2# Contributor: Jan Cholasta <grubber at grubber cz>
    
      3# Contributor: Andrew Rabert <arabert@nullsum.net>
    
      4# shellcheck shell=bash disable=SC2034,SC2154
    
      5
    
      6pkgname=zdoom
    
      7pkgver=2.8.1
    
      8pkgrel=8
    
      9pkgdesc='Advanced Doom source port'
    
      10arch=('i686' 'x86_64')
    
      11url='http://www.zdoom.org/'
    
      12license=('BSD' 'custom:BUILD' 'custom:doom' 'custom:dumb' 'LGPL')
    
      13depends=('gtk2'
    
      14         'libgme'
    
      15         'libsndfile'
    
      16         'mpg123'
    
      17         'sdl2')
    
      18makedepends=('cmake'
    
      19             'desktop-file-utils'
    
      20             'fluidsynth'
    
      21             'imagemagick'
    
      22             'openal'
    
      23             'p7zip')
    
      24makedepends_i686=('nasm')
    
      25optdepends=('blasphemer-wad: Blasphemer (free Heretic) game data'
    
      26            'chexquest3-wad: Chex Quest 3 game data'
    
      27            'doom1-wad: Doom shareware game data'
    
      28            'fluidsynth: FluidSynth MIDI device'
    
      29            'freedm: FreeDM game data'
    
      30            'freedoom1: Freedoom: Phase 1 game data'
    
      31            'freedoom2: Freedoom: Phase 2 game data'
    
      32            'gxmessage: crash dialog (GNOME)'
    
      33            'hacx-wad: HacX game data'
    
      34            'harmony-wad: Harmony game data'
    
      35            'heretic1-wad: Heretic shareware game data'
    
      36            'hexen1-wad: Hexen demo game data'
    
      37            'kdialog: crash dialog (KDE)'
    
      38            'openal: in-game sound'
    
      39            'strife0-wad: Strife shareware game data'
    
      40            'square1-wad: The Adventures of Square, Episode 1 game data'
    
      41            'timidity++: Timidity MIDI device'
    
      42            'urbanbrawl-wad: Urban Brawl: Action Doom 2 game data'
    
      43            'xorg-xmessage: crash dialog (other)')
    
      44source=("http://zdoom.org/files/zdoom/${pkgver%.${pkgver#*.*.}}/zdoom-${pkgver}-src.7z"
    
      45        'zdoom.desktop'
    
      46        '0001-Fix-file-paths.patch'
    
      47        '0002-Improve-Mac-GCC-errors-fix-to-work-only-for-GCC.patch'
    
      48        '0003-modern-cmake.patch')
    
      49noextract=("${source[0]##*/}")
    
      50sha256sums=('782179d4667d2e56e26e21d7a0872523f8e4262ed176072fef00d0043376a310'
    
      51            'e8932a559baf30ecbfc062546ca014c6dfb70f76d1570549654209d39157e350'
    
      52            '2e9edd1f776a1e706f21e35b6f066fcd086dece2e9e4e0832ab9714658ff6b6b'
    
      53            '3de616393fa2eea8540c59c983a4394b29a0a0220095297a3f47e4f721b8d9fb'
    
      54            'd89cd17ef6f1fa380c18780472a3a5942eaabf6d5d7ab89820cb91f80968df9a')
    
      55
    
      56prepare() {
    
      57    7z x -ozdoom -y "${source[0]##*/}" >/dev/null
    
      58    cd zdoom
    
      59    patch -i "$srcdir"/0001-Fix-file-paths.patch -p 1
    
      60    patch -i "$srcdir"/0002-Improve-Mac-GCC-errors-fix-to-work-only-for-GCC.patch -p 1
    
      61    patch -i "$srcdir"/0003-modern-cmake.patch -p 1
    
      62}
    
      63
    
      64build() {
    
      65    cd zdoom
    
      66    mkdir -p build
    
      67    cmake -B build \
    
      68          -D CMAKE_BUILD_TYPE=Release \
    
      69          -D NO_FMOD=ON \
    
      70          -D GME_INCLUDE_DIR=/usr/include/gme \
    
      71          -D FORCE_INTERNAL_GME=OFF \
    
      72          -D CMAKE_C_FLAGS="-std=gnu89" \
    
      73          -D CMAKE_CXX_FLAGS="$CXXFLAGS \
    
      74            -ffile-prefix-map=\"$PWD\"=. \
    
      75            -DSHARE_DIR=\\\"/usr/share/zdoom\\\"" \
    
      76          -D CMAKE_EXE_LINKER_FLAGS="$LDFLAGS -Wl,-z,noexecstack" \
    
      77          -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
    
      78          -DCMAKE_CXX_STANDARD=17 \
    
      79          .
    
      80    make -C build
    
      81    sed -n '/\*\*-/,/\*\*-/p' src/version.h >bsd.txt
    
      82    magick 'src/win32/icon1.ico[2]' zdoom.xpm
    
      83}
    
      84
    
      85package() {
    
      86    cd zdoom
    
      87    install build/zdoom -D -t "$pkgdir"/usr/bin
    
      88    install build/zdoom.pk3 -D -m 644 -t "$pkgdir"/usr/share/zdoom
    
      89    install -d "$pkgdir"/usr/share/licenses/zdoom
    
      90    install bsd.txt -m 644 "$pkgdir"/usr/share/licenses/zdoom/bsd.txt
    
      91    install docs/BUILDLIC.TXT -m 644 "$pkgdir"/usr/share/licenses/zdoom/buildlic.txt
    
      92    install docs/doomlic.txt -m 644 "$pkgdir"/usr/share/licenses/zdoom/doomlic.txt
    
      93    install dumb/licence.txt -m 644 "$pkgdir"/usr/share/licenses/zdoom/dumb.txt
    
      94    desktop-file-install "$srcdir"/zdoom.desktop --dir="$pkgdir"/usr/share/applications
    
      95    install zdoom.xpm -D -m 644 "$pkgdir"/usr/share/icons/hicolor/48x48/apps/zdoom.xpm
    
      96}
    
      97
    
      98# vim:set ts=2 sw=2 et:
    
      99

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2