dieharder-bin

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt x86_64 RPM binaries (dieharder and libdieharder) from webhome.phy.duke.edu/~rgb/, which is the personal/home directory space of Robert G. Brown (rgb), the original author of dieharder at Duke University. This is actually the upstream author's own distribution host, not a random third-party mirror. However, it is still a personal university web directory (~rgb) rather than an official project release infrastructure, and the package installs prebuilt binaries directly onto the system. The b2sums are present and pin the specific files, which mitigates substitution risk somewhat. The concern is real but mild: if the university web server or the author's account were compromised, malicious binaries could be served. The binaries are executed code installed to /usr/bin and /usr/lib. This is a genuine medium-severity supply-chain concern — prebuilt binaries from a personal university hosting directory — but not an active attack. The checksums provide some protection. Rating remains medium.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("http://webhome.phy.duke.edu/~rgb/General/dieharder/${_bin_file}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt x86_64 RPM binaries (dieharder and libdieharder) from webhome.phy.duke.edu/~rgb/, which is the personal/home directory space of Robert G. Brown (rgb), the original author of dieharder at Duke University. This is actually the upstream author's own distribution host, not a random third-party mirror. However, it is still a personal university web directory (~rgb) rather than an official project release infrastructure, and the package installs prebuilt binaries directly onto the system. The b2sums are present and pin the specific files, which mitigates substitution risk somewhat. The concern is real but mild: if the university web server or the author's account were compromised, malicious binaries could be served. The binaries are executed code installed to /usr/bin and /usr/lib. This is a genuine medium-severity supply-chain concern — prebuilt binaries from a personal university hosting directory — but not an active attack. The checksums provide some protection. Rating remains medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Michael Duell <reg@akurei.me>
    
      2# Contributor: Fabian Köhler <fabian.koehler (AT) protonmail.ch>
    
      3
    
      4pkgname=dieharder-bin
    
      5pkgver=3.31.1
    
      6_pkgsubver="1"
    
      7_bin_file="dieharder-${pkgver}-${_pkgsubver}.x86_64.rpm"
    
      8pkgrel=1
    
      9pkgdesc="A Random Number Test Suite (Binary version)"
    
      10arch=('x86_64')
    
      11depends=('gsl')
    
      12builddepends=('rpmextract')
    
      13url="http://www.phy.duke.edu/~rgb/General/dieharder.php"
    
      14license=('GPL')
    
      15
    
      16source=("http://webhome.phy.duke.edu/~rgb/General/dieharder/${_bin_file}"
    
      17        "http://webhome.phy.duke.edu/~rgb/General/dieharder/lib${_bin_file}")
    
      18noextract=("${_bin_file}"
    
      19           "lib${_bin_file}")
    
      20provides=("dieharder=${pkgver}" "libdieharder=${pkgver}")
    
      21conflicts=('dieharder' 'libdieharder')
    
      22
    
      23prepare() {
    
      24  cd "${srcdir}"
    
      25  rpm2cpio "${_bin_file}" | bsdtar -xf -
    
      26  rpm2cpio "lib${_bin_file}" | bsdtar -xf -
    
      27  chmod +x usr/include/dieharder
    
      28}
    
      29
    
      30package() {
    
      31  cd "${srcdir}"
    
      32  install -D -m755 {,${pkgdir}/}usr/bin/dieharder
    
      33  
    
      34  install -d -m755 "${pkgdir}/usr/lib"
    
      35  ln -s /usr/lib/libgsl.so "${pkgdir}/usr/lib/libgsl.so.0"
    
      36  install -t "${pkgdir}/usr/lib" usr/lib64/*
    
      37
    
      38  install -d -m755 "${pkgdir}/usr/include/dieharder"
    
      39  install -t "${pkgdir}/usr/include/dieharder" usr/include/dieharder/*
    
      40
    
      41  install -D -m644 {,${pkgdir}/}usr/share/man/man1/dieharder.1.gz
    
      42  install -D -m644 {,${pkgdir}/}usr/share/man/man3/libdieharder.3.gz
    
      43
    
      44  install -d -m755 "${pkgdir}/usr/share/doc/dieharder-${pkgver}"
    
      45  install -t "${pkgdir}/usr/share/doc/dieharder-${pkgver}" usr/share/doc/dieharder-${pkgver}/*
    
      46  
    
      47  install -D -m644 "${pkgdir}/usr/share/doc/dieharder-${pkgver}/COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      48
    
      49
    
      50}
    
      51
    
      52# vim:set ts=2 sw=2 et:
    
      53b2sums=('06f124b4bdaea0e21ad43bd414c0d6f851ce78a63581f0a7cfdd6bffd0cd510be8fe9d670584fa0753feab5eefa9691dedc39de6bd865e8456eb65bb85999502'
    
      54        '31f4a252382b273e2d506e21c8f29cd495751e079615f3ce66daf55848db6bd1f6f34768b6ed27ca916a637b0135e4a60296e9963a73ddff8f81ee572b4e3687')
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2