gfxbench

maintainer laetitiavermeil · 13 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt installer shell script from gfxbench.com (the official vendor site for the GFXBench benchmark tool by Kishonti) and executes it via 'sh' during the package() phase. The source is checksum-verified with SHA1. The host is the legitimate upstream vendor (gfxbench.com is Kishonti's official benchmark portal), not a personal or unofficial mirror. However, the pattern of downloading and executing a prebuilt binary installer script — even from the official vendor — is inherently a medium-risk supply-chain concern: the installer is a closed-source binary blob, SHA1 is a weak hash algorithm, and the package is quite old (v4.0.13, pkgrel=5). The PKGBUILD does take reasonable precautions (redirecting HOME, using --prefix for staged install, removing bundled libs). This is a standard pattern for proprietary software AUR packages and is not malicious, but the execution of a downloaded binary installer script from a non-open-source vendor with SHA1 checksums warrants a medium rating rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_i686=( "${_basename}.sh::https://gfxbench.com/download/${_basename}_32bit.sh")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): This PKGBUILD downloads a prebuilt installer shell script from gfxbench.com (the official vendor site for the GFXBench benchmark tool by Kishonti) and executes it via 'sh' during the package() phase. The source is checksum-verified with SHA1. The host is the legitimate upstream vendor (gfxbench.com is Kishonti's official benchmark portal), not a personal or unofficial mirror. However, the pattern of downloading and executing a prebuilt binary installer script — even from the official vendor — is inherently a medium-risk supply-chain concern: the installer is a closed-source binary blob, SHA1 is a weak hash algorithm, and the package is quite old (v4.0.13, pkgrel=5). The PKGBUILD does take reasonable precautions (redirecting HOME, using --prefix for staged install, removing bundled libs). This is a standard pattern for proprietary software AUR packages and is not malicious, but the execution of a downloaded binary installer script from a non-open-source vendor with SHA1 checksums warrants a medium rating rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Eric Engestrom <aur [at] engestrom [dot] ch>
    
      2
    
      3pkgname=gfxbench
    
      4pkgver=4.0.13
    
      5pkgrel=5
    
      6pkgdesc="Unified graphics benchmark based on DXBenchmark (DirectX) and GLBenchmark (OpenGL ES)"
    
      7url='https://gfxbench.com/'
    
      8arch=('i686' 'x86_64')
    
      9license=('custom')
    
      10depends=('libpng12' 'qt5-base' 'icu')
    
      11_basename="gfxbench_gl-linux-qt-${pkgver}+community"
    
      12source_i686=(  "${_basename}.sh::https://gfxbench.com/download/${_basename}_32bit.sh")
    
      13source_x86_64=("${_basename}.sh::https://gfxbench.com/download/${_basename}_64bit.sh")
    
      14sha1sums_i686=(  'dfbcd1deeeb3a21cd79738c30d535f08ebfdac6c')
    
      15sha1sums_x86_64=('c5740e8a36169c2210fe94185d0b8db8cb757ffb')
    
      16
    
      17package() {
    
      18  cd "${srcdir}"
    
      19
    
      20  # Script modifies the running user's files; prevent that by redirecting $HOME
    
      21  export HOME=$PWD
    
      22
    
      23  install -dm755 "${pkgdir}"/opt/"${pkgname}"
    
      24  sh "${_basename}".sh \
    
      25    --skip-license \
    
      26    --prefix="${pkgdir}"/opt/"${pkgname}"
    
      27
    
      28  chown root: -R "${pkgdir}"/opt/"${pkgname}"/
    
      29
    
      30  install -dm755 "${pkgdir}"/usr/bin
    
      31  ln -s /opt/"${pkgname}"/gfxbench_gl "${pkgdir}"/usr/bin/"${pkgname}"
    
      32
    
      33  install -dm755 "${pkgdir}"/usr/share/licenses/"${pkgname}"
    
      34  mv "${pkgdir}"/opt/"${pkgname}"/copyright "${pkgdir}"/usr/share/licenses/"${pkgname}"
    
      35
    
      36  install -Dm644 -t "${pkgdir}"/usr/share/applications/ "${pkgdir}"/opt/"${pkgname}"/gfxbench_gl.desktop
    
      37  rm "${pkgdir}"/opt/"${pkgname}"/gfxbench_gl.desktop
    
      38
    
      39  install -Dm644 -t "${pkgdir}"/usr/share/icons/hicolor/128x128/apps/ "${pkgdir}"/opt/"${pkgname}"/gfxbench_gl.png
    
      40  rm "${pkgdir}"/opt/"${pkgname}"/gfxbench_gl.png
    
      41
    
      42  # Fix path
    
      43  sed -i "s#${pkgdir}##" "${pkgdir}"/usr/share/applications/gfxbench_gl.desktop
    
      44  sed -i 's#^Icon=.*$#Icon=/usr/share/icons/hicolor/128x128/apps/gfxbench_gl.png#' \
    
      45    "${pkgdir}"/usr/share/applications/gfxbench_gl.desktop
    
      46
    
      47  # Remove unnecessary local copies of libs
    
      48  rm "${pkgdir}"/opt/"${pkgname}"/libQt5*
    
      49  rm "${pkgdir}"/opt/"${pkgname}"/libicu*
    
      50  rm -r "${pkgdir}"/opt/"${pkgname}"/platforms/
    
      51  rm -r "${pkgdir}"/opt/"${pkgname}"/xcbglintegrations/
    
      52
    
      53  # Remove start script, since we're not using the local libs anymore
    
      54  rm "${pkgdir}"/opt/"${pkgname}"/start.sh
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2