zelda-3t-fr

maintainer FoolEcho · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code from a non-whitelisted but project-related host (zeldaroth.fr) for a fan-made Zelda game, builds it locally, and installs data and binaries; the worst case of a swapped source is limited to code execution within the game's scope, but no remote code execution or exfiltration is evident.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from a non-whitelisted but project-related host (zeldaroth.fr) for a fan-made Zelda game, builds it locally, and installs data and binaries; the worst case of a swapped source is limited to code execution within the game's scope, but no remote code execution or exfiltration is evident.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "http://www.zeldaroth.fr/fichier/3T/linux/Zelda3T-src-linux.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: FoolEcho <foolecho at gmail dot com>
    
      2pkgname=zelda-3t-fr
    
      3_name=zelda-3t
    
      4pkgver=1.8
    
      5pkgrel=6
    
      6arch=('i686' 'x86_64')
    
      7pkgdesc="Zelda: Time To Triumph (french version)"
    
      8url="http://www.zeldaroth.fr/"
    
      9license=('Unknown')
    
      10depends=('sdl_gfx' 'sdl_mixer' 'sdl_image' 'xdg-utils' 'hicolor-icon-theme' 'timidity++')
    
      11makedepends=(imagemagick)
    
      12optdepends=('freepats-legacy: soundfont for timidity to be able to have music in game'
    
      13  'soundfont-fluid: another soundfont for timidity to be able to have music in game if you prefer')
    
      14install=${_name}.install
    
      15changelog=ChangeLog
    
      16source=(
    
      17  "http://www.zeldaroth.fr/fichier/3T/linux/Zelda3T-src-linux.zip" 
    
      18  zelda-3t.desktop)
    
      19md5sums=('f1d24ec72bff3413cfc1e835ef4703da'
    
      20         'ab544512c46a87f6ef62ae6cdea794fc')
    
      21
    
      22prepare () {
    
      23  cd $srcdir/Zelda3T-src-linux/
    
      24  
    
      25  # Fix the Game so that it reads save files from $HOME/.zelda-3t
    
      26  sed -i -e s~\"data/save/~string\(getenv\(\"HOME\"\)\)+\"/.$_name/~g Joueur.cpp
    
      27  #save/restore volume settings and ranks
    
      28  sed -i -e s#\"data/save/system.dat\"#\(string\(getenv\(\"HOME\"\)\)+\"/.$_name/system.dat\"\).c_str\(\)#g Keyboard.cpp
    
      29  #remove saves from menu
    
      30  sed -i -e s#\"data/save#string\(getenv\(\"HOME\"\)\)+\"/.$_name#g Keyboard.cpp
    
      31  #grab rank from Zelda Return of the Hylian
    
      32  sed -i -e s#Zelda\ Return\ of\ the\ Hylian/data/save#.zelda-roth#g Keyboard.cpp
    
      33  #grab rank from Zelda Oni Link Begins
    
      34  sed -i -e s#Zelda\ Oni\ Link\ Begins/data/save#.zelda-olb#g Keyboard.cpp
    
      35  
    
      36  #Make the game treat /usr/share/$pkgname as its data directory
    
      37  for i in *.cpp
    
      38  do
    
      39    sed -i -e s~data/~/usr/share/$pkgname/~g $i
    
      40  done
    
      41  
    
      42  # Create the directory $HOME/.zelda3t if it doesnt exist
    
      43  sed -i -e s~'(NULL));'~'&\n\tif (system(\"stat $HOME/.'$_name' \&> /dev/null")) system (\"mkdir $HOME/.'$_name'\");'~ main.cpp
    
      44  
    
      45  #Fix the preprocessor options (SDL.h not found)
    
      46  sed -i -e "s#CFLAGS  =#CFLAGS  += -I/usr/include/SDL#g" Makefile
    
      47  sed -i -e "s#LDFLAGS =#LDFLAGS +=#g" Makefile
    
      48}
    
      49
    
      50build () {
    
      51  cd $srcdir/Zelda3T-src-linux/
    
      52  make
    
      53}
    
      54
    
      55package () {
    
      56  
    
      57  install -Dm644 $_name.desktop $pkgdir/usr/share/applications/$_name.desktop
    
      58  cd $srcdir/Zelda3T-src-linux/
    
      59  
    
      60  install -Dm755 Zelda3T $pkgdir/usr/bin/$_name
    
      61  
    
      62  cd data
    
      63  for i in {map,music,sound}/*
    
      64  do
    
      65    install -Dm644 $i $pkgdir/usr/share/$pkgname/$i
    
      66  done
    
      67  
    
      68  cd images
    
      69  for i in */*
    
      70  do
    
      71    install -Dm644 $i $pkgdir/usr/share/$pkgname/images/$i
    
      72  done
    
      73  mkdir -p $pkgdir/usr/share/icons/hicolor/256x256/apps
    
      74  convert logos/fond.png -resize 256x256\! $pkgdir/usr/share/icons/hicolor/256x256/apps/$_name.png
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2