gfxbench

MEDIUM

maintainer laetitiavermeil 13 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

This PKGBUILD downloads a prebuilt installer shell script from gfxbench.com (the official vendor site for the GFXBench benchmark tool by Kishonti) and executes it via 'sh' during the package() phase. The source is checksum-verified with SHA1. The host is the legitimate upstream vendor (gfxbench.com is Kishonti's official benchmark portal), not a personal or unofficial mirror. However, the pattern of downloading and executing a prebuilt binary installer script — even from the official vendor — is inherently a medium-risk supply-chain concern: the installer is a closed-source binary blob, SHA1 is a weak hash algorithm, and the package is quite old (v4.0.13, pkgrel=5). The PKGBUILD does take reasonable precautions (redirecting HOME, using --prefix for staged install, removing bundled libs). This is a standard pattern for proprietary software AUR packages and is not malicious, but the execution of a downloaded binary installer script from a non-open-source vendor with SHA1 checksums warrants a medium rating rather than clean.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_i686=( "${_basename}.sh::https://gfxbench.com/download/${_basename}_32bit.sh")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): This PKGBUILD downloads a prebuilt installer shell script from gfxbench.com (the official vendor site for the GFXBench benchmark tool by Kishonti) and executes it via 'sh' during the package() phase. The source is checksum-verified with SHA1. The host is the legitimate upstream vendor (gfxbench.com is Kishonti's official benchmark portal), not a personal or unofficial mirror. However, the pattern of downloading and executing a prebuilt binary installer script — even from the official vendor — is inherently a medium-risk supply-chain concern: the installer is a closed-source binary blob, SHA1 is a weak hash algorithm, and the package is quite old (v4.0.13, pkgrel=5). The PKGBUILD does take reasonable precautions (redirecting HOME, using --prefix for staged install, removing bundled libs). This is a standard pattern for proprietary software AUR packages and is not malicious, but the execution of a downloaded binary installer script from a non-open-source vendor with SHA1 checksums warrants a medium rating rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Eric Engestrom <aur [at] engestrom [dot] ch>
    
      2
    
      3pkgname=gfxbench
    
      4pkgver=4.0.13
    
      5pkgrel=5
    
      6pkgdesc="Unified graphics benchmark based on DXBenchmark (DirectX) and GLBenchmark (OpenGL ES)"
    
      7url='https://gfxbench.com/'
    
      8arch=('i686' 'x86_64')
    
      9license=('custom')
    
      10depends=('libpng12' 'qt5-base' 'icu')
    
      11_basename="gfxbench_gl-linux-qt-${pkgver}+community"
    
      12source_i686=(  "${_basename}.sh::https://gfxbench.com/download/${_basename}_32bit.sh")
    
      13source_x86_64=("${_basename}.sh::https://gfxbench.com/download/${_basename}_64bit.sh")
    
      14sha1sums_i686=(  'dfbcd1deeeb3a21cd79738c30d535f08ebfdac6c')
    
      15sha1sums_x86_64=('c5740e8a36169c2210fe94185d0b8db8cb757ffb')
    
      16
    
      17package() {
    
      18  cd "${srcdir}"
    
      19
    
      20  # Script modifies the running user's files; prevent that by redirecting $HOME
    
      21  export HOME=$PWD
    
      22
    
      23  install -dm755 "${pkgdir}"/opt/"${pkgname}"
    
      24  sh "${_basename}".sh \
    
      25    --skip-license \
    
      26    --prefix="${pkgdir}"/opt/"${pkgname}"
    
      27
    
      28  chown root: -R "${pkgdir}"/opt/"${pkgname}"/
    
      29
    
      30  install -dm755 "${pkgdir}"/usr/bin
    
      31  ln -s /opt/"${pkgname}"/gfxbench_gl "${pkgdir}"/usr/bin/"${pkgname}"
    
      32
    
      33  install -dm755 "${pkgdir}"/usr/share/licenses/"${pkgname}"
    
      34  mv "${pkgdir}"/opt/"${pkgname}"/copyright "${pkgdir}"/usr/share/licenses/"${pkgname}"
    
      35
    
      36  install -Dm644 -t "${pkgdir}"/usr/share/applications/ "${pkgdir}"/opt/"${pkgname}"/gfxbench_gl.desktop
    
      37  rm "${pkgdir}"/opt/"${pkgname}"/gfxbench_gl.desktop
    
      38
    
      39  install -Dm644 -t "${pkgdir}"/usr/share/icons/hicolor/128x128/apps/ "${pkgdir}"/opt/"${pkgname}"/gfxbench_gl.png
    
      40  rm "${pkgdir}"/opt/"${pkgname}"/gfxbench_gl.png
    
      41
    
      42  # Fix path
    
      43  sed -i "s#${pkgdir}##" "${pkgdir}"/usr/share/applications/gfxbench_gl.desktop
    
      44  sed -i 's#^Icon=.*$#Icon=/usr/share/icons/hicolor/128x128/apps/gfxbench_gl.png#' \
    
      45    "${pkgdir}"/usr/share/applications/gfxbench_gl.desktop
    
      46
    
      47  # Remove unnecessary local copies of libs
    
      48  rm "${pkgdir}"/opt/"${pkgname}"/libQt5*
    
      49  rm "${pkgdir}"/opt/"${pkgname}"/libicu*
    
      50  rm -r "${pkgdir}"/opt/"${pkgname}"/platforms/
    
      51  rm -r "${pkgdir}"/opt/"${pkgname}"/xcbglintegrations/
    
      52
    
      53  # Remove start script, since we're not using the local libs anymore
    
      54  rm "${pkgdir}"/opt/"${pkgname}"/start.sh
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2