cudapm1

maintainer Dylan14 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD has two real supply-chain concerns: (1) During prepare(), it fetches 'https://github.com/BrianGladman/mpir/archive/master.zip' — a rolling HEAD snapshot of a GitHub repository — with no checksum validation whatsoever. This means any future push to that branch silently changes what gets compiled and linked into the final binary. (2) The primary source tarball comes from download.mersenne.ca (a project-specific but non-canonical host), though it does have both md5 and sha256 checksums so that part is adequately pinned. The unverified, mutable GitHub master.zip is the core issue: it is compiled C/C++ code that ends up linked into a CUDA binary installed to /usr/bin, so a compromised or tampered upstream commit would result in arbitrary code execution on the user's machine. The make.patch also has only an md5sum (sha256 is SKIP'd), which is a minor additional concern. This is a genuine medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=('https://download.mersenne.ca/CUDAPm1/CUDAPm1-0.22-src.tar.gz'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD has two real supply-chain concerns: (1) During prepare(), it fetches 'https://github.com/BrianGladman/mpir/archive/master.zip' — a rolling HEAD snapshot of a GitHub repository — with no checksum validation whatsoever. This means any future push to that branch silently changes what gets compiled and linked into the final binary. (2) The primary source tarball comes from download.mersenne.ca (a project-specific but non-canonical host), though it does have both md5 and sha256 checksums so that part is adequately pinned. The unverified, mutable GitHub master.zip is the core issue: it is compiled C/C++ code that ends up linked into a CUDA binary installed to /usr/bin, so a compromised or tampered upstream commit would result in arbitrary code execution on the user's machine. The make.patch also has only an md5sum (sha256 is SKIP'd), which is a minor additional concern. This is a genuine medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1#Maintainer: Dylan Delgado <dylan1496 at live dot com>
    
      2
    
      3pkgname=cudapm1
    
      4pkgver=0.22
    
      5pkgrel=5
    
      6pkgdesc="Program that implements the P-1 algorithm for factoring Mersenne numbers."
    
      7arch=('x86_64')
    
      8url=https://mersenneforum.org/showthread.php?t=17835
    
      9license=('GPL3')
    
      10depends=('nvidia')
    
      11makedepends=('cuda' 'yasm')
    
      12source=('https://download.mersenne.ca/CUDAPm1/CUDAPm1-0.22-src.tar.gz'
    
      13make.patch)
    
      14md5sums=('b7cf8f28438109edf3528d4d53802212'
    
      15'1996bf1d5510deb0456ad13c3a4d7834')
    
      16sha256sums=('c0a257bb4f92af64e73626cb36427ca5fe9c01e57f59b96c4970afe8f7ae64c2'
    
      17'SKIP')
    
      18
    
      19prepare () {
    
      20cd ${srcdir}/cuda-p1-${pkgver}/
    
      21patch -p1 < ../make.patch
    
      22cd src/
    
      23rm -rf mpir/
    
      24wget "https://github.com/BrianGladman/mpir/archive/master.zip"
    
      25unzip master.zip
    
      26mv mpir-master/ mpir/
    
      27}
    
      28
    
      29build () {
    
      30cd ${srcdir}/cuda-p1-${pkgver}/
    
      31make
    
      32}
    
      33
    
      34package() {
    
      35cd ${srcdir}/cuda-p1-${pkgver}/
    
      36install -Dm755 CUDAPm1 ${pkgdir}/usr/bin/cudapm1
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2