◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

gpt4all-chat

maintainer ZhangHua · 7 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The flagged URL from gpt4all.io is for a model file (nomic-embed-text-v1.5.f16.gguf), which is non-executable data used by the application; hosting on a non-whitelisted domain is common for project-specific assets and does not constitute a supply-chain risk for code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged URL from gpt4all.io is for a model file (nomic-embed-text-v1.5.f16.gguf), which is non-executable data used by the application; hosting on a non-whitelisted domain is common for project-specific assets and does not constitute a supply-chain risk for code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:16 "https://gpt4all.io/models/gguf/nomic-embed-text-v1.5.f16.gguf"

PKGBUILD

1 offending line(s) highlighted
1pkgname=gpt4all-chat
2pkgver=3.10.0
3pkgrel=4
4pkgdesc="run open-source LLMs anywhere"
5arch=("x86_64")
6url="https://gpt4all.io"
7license=("MIT")
8depends=(
9 "gcc-libs" "glibc" "qt6-base" "qt6-httpserver" "qt6-5compat" "qt6-declarative"
10 "qt6-webengine")
11makedepends=(
12 "cmake" "shaderc" "vulkan-tools" "vulkan-headers" "qt6-shadertools" "qt6-svg"
13 "qt6-tools" "qt6-wayland" "fmt" "ninja")
14source=(
15 "$pkgname-$pkgver.tar.gz::https://github.com/nomic-ai/gpt4all/archive/refs/tags/v$pkgver.tar.gz"
16 "https://gpt4all.io/models/gguf/nomic-embed-text-v1.5.f16.gguf"
17 "001-change-binary-name.diff"
18 "002-install-and-load-localdocs-model-more-standardly.diff"
19)
20declare -rAg _modules_name_map=(
21 [gpt4all-backend/deps/llama.cpp-mainline]=https://github.com/nomic-ai/llama.cpp/archive/11f734c3b0334dbae4823b4a7467764e447fc6d6.tar.gz
22 [gpt4all-backend/deps/llama.cpp-mainline/ggml/src/kompute]=https://github.com/nomic-ai/kompute/archive/7c20efa30bb53d08bf04f84e510275766ebe9923.tar.gz
23 [gpt4all-chat/deps/usearch]=https://github.com/nomic-ai/usearch/archive/9e59f1036657303b29eaf709945f339e403e5f2f.tar.gz
24 [gpt4all-chat/deps/usearch/fp16]=https://github.com/Maratyszcza/FP16/archive/0a92994d729ff76a58f692d3028ca1b64b145d91.tar.gz
25 [gpt4all-chat/deps/usearch/simsimd]=https://github.com/ashvardanian/NumKong/archive/18d17686124ddebd9fe55eee56b2e0273a613d4b.tar.gz
26 [gpt4all-chat/deps/usearch/stringzilla]=https://github.com/ashvardanian/StringZilla/archive/91d0a1a02faae90a41c60a30855d5935eb3eaef1.tar.gz
27 [gpt4all-chat/deps/SingleApplication]=https://github.com/nomic-ai/SingleApplication/archive/21bdef01eddcbd78044eea1d50b9dee08d218ff2.tar.gz
28 [gpt4all-chat/deps/fmt]=https://github.com/fmtlib/fmt/archive/0c9fce2ffefecfdce794e1859584e25877b7b592.tar.gz
29 [gpt4all-chat/deps/DuckX]=https://github.com/nomic-ai/DuckX/archive/6e31dfb280e2107fbf4f6a15098c38b014f1bbcc.tar.gz
30 [gpt4all-chat/deps/QXlsx]=https://github.com/nomic-ai/QXlsx/archive/29e81b369128525749dcb6516195b6b062eda955.tar.gz
31 [gpt4all-chat/deps/minja]=https://github.com/nomic-ai/minja/archive/e97bb2442cd6ab3d5bb5f5a3e8a1f7d6081d613b.tar.gz
32 [gpt4all-chat/deps/json]=https://github.com/nlohmann/json/archive/606b6347edf0758c531abb6c36743e09a4c48a84.tar.gz
33)
34_get_source_name_string() {
35 local host filename name commit
36 host=$(echo "$1" | cut -d / -f 3)
37 name=$(echo "$1" | cut -d / -f 5)
38 filename=${1##*/}
39 commit=${filename%%.*}
40 case "$host" in
41 gitlab.com)
42 # It contains $name in $commit
43 echo "$commit"
44 ;;
45 *)
46 echo "$name-$commit"
47 ;;
48 esac
49}
50
51_fill_gitmodules_recursively() {
52 local gitmodule
53 find "${1:-.}" -type f -name .gitmodules | while read -r gitmodule
54 do
55 local prefix
56 prefix=$(dirname "$gitmodule")"/"
57 if [[ "$gitmodule" =~ ^\.\/ ]]
58 then
59 gitmodule=${gitmodule#*\.\/}
60 prefix=${prefix#*\.\/}
61 fi
62 echo "Parsing $gitmodule to fill submodules..."
63 local p
64 grep path "$gitmodule" | awk '{print $3}' | while read -r p
65 do
66 p=${p%$'\r'} # Remove control characters
67 if [[ -n "$p" ]]
68 then
69 local target url name commit fname
70 target="$prefix$p"
71 url="${_modules_name_map[$target]}"
72 fname=$(_get_source_name_string "$url")
73 echo "Filling $target with $srcdir/$fname..."
74 cp -r "$srcdir/$fname/." "$target"
75 _fill_gitmodules_recursively "$target"
76 fi
77 done
78 done
79}
80declare _source_str _uri
81for _uri in "${_modules_name_map[@]}"
82do
83 _source_str="$(_get_source_name_string "$_uri").tar.gz::$_uri"
84 if [[ "${source[*]/$_source_str/}" == "${source[*]}" ]]
85 then
86 source+=("$_source_str")
87 fi
88done
89unset _source_str _uri
90sha256sums=('14cfcf13de40e1bfb4df1096aac9d410bfa29d7b0c30a297bb2b3474a554f44e'
91 'f7af6f66802f4df86eda10fe9bbcfc75c39562bed48ef6ace719a251cf1c2fdb'
92 '828e04b4938eb192f20f87f94415252863b702bee1d9ab5f0a539a15de095350'
93 'b348d6b9228316e4611186df0558f032a25ffa20334e68a91a09e07ce84db77a'
94 'a91f4770ff9c39f4d72e339c379f566b3bbb359fa66122d85fc0bae3dde7abc7'
95 '5f151fe3d71bb7b719eb50ed4bdedfde9c92d9d21c7eea172eec177b9875eff5'
96 'fe9eca41677db9ec416fdae2fe7ba0bac82cecc692e6d9670e8e35baa461b528'
97 'cf51f45eaabd9b1fccc2c871ccdd7be81730bb0172538c9375c1e33bf5ac131c'
98 '78869fa23cec5faf7a6b157fbc6309202ad9c6b1f7c1392d3dc4894ffe93eb95'
99 '51c6e723437ddf1ba9b4bf9951ca93e975e21b7513e268ee6e7dfc40d4aee691'
100 'f94052c10b611fd374194ca6e0dc4d159459c0b370abfe9002c13058863b7039'
101 '95c080489c3170b7d7c76956fe4f224a2ef721907d7b62b508e3b72a7513afd1'
102 'eb366efe210279c4a34041834e2a8177e7f54a6dd3b0f258f558028325a252c4'
103 '49a6d9e340474152d68478a46051b39facc5060965edc95a4b08002cfbd5eedc'
104 'f5b0160e6d13a1d80f2024685e53ee6975d601f5367763a9ee1f8d45920d7816'
105 '3ab929011431db5d61d3153290135dd299244f407d767ba6b2c3a275213c20c8')
106
107prepare() {
108 cd "$srcdir/gpt4all-$pkgver"
109 _fill_gitmodules_recursively
110 patch -Np1 -i ../001-change-binary-name.diff
111 patch -Np1 -i ../002-install-and-load-localdocs-model-more-standardly.diff
112 sed -i "s|https://gpt4all.io/models/gguf|file://$srcdir|" gpt4all-chat/CMakeLists.txt
113 sed -i "s/vk::DynamicLoader/vk::detail::DynamicLoader/g" \
114 gpt4all-backend/deps/llama.cpp-mainline/ggml/src/kompute/src/include/kompute/Manager.hpp \
115 gpt4all-backend/deps/llama.cpp-mainline/ggml/src/kompute/src/Manager.cpp
116 sed -i "s/vk::DispatchLoaderDynamic/vk::detail::DispatchLoaderDynamic/" \
117 gpt4all-backend/deps/llama.cpp-mainline/ggml/src/kompute/src/include/kompute/Manager.hpp
118 # https://github.com/KomputeProject/kompute/issues/410
119 sed -i "/strtol()/ d;/ftell()/ d" \
120 gpt4all-backend/deps/llama.cpp-mainline/ggml/src/kompute/external/bin/xxd.c
121 # Qt 6.10 requires finding Qt::GuiPrivate explicitly
122 # https://doc-snapshots.qt.io/qt6-6.10/qtguiprivate-module.html#details
123 sed -i "s/Gui REQUIRED/Gui GuiPrivate REQUIRED/g" \
124 gpt4all-chat/deps/QXlsx/QXlsx/CMakeLists.txt
125}
126build() {
127 CFLAGS+=" -DNDEBUG"
128 CXXFLAGS+=" -DNDEBUG"
129 cmake -B build-chat -S "$srcdir/gpt4all-$pkgver/gpt4all-chat" -G Ninja -Wno-dev \
130 -DCMAKE_BUILD_TYPE=None \
131 -DCMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT=OFF \
132 -DCMAKE_INSTALL_PREFIX=/usr \
133 -DCMAKE_SKIP_INSTALL_RPATH=ON \
134 -DKOMPUTE_OPT_BUILD_SHADERS=ON \
135 -DKOMPUTE_OPT_DISABLE_VULKAN_VERSION_CHECK=ON \
136 -DKOMPUTE_OPT_USE_BUILT_IN_FMT=OFF \
137 -DKOMPUTE_OPT_USE_BUILT_IN_VULKAN_HEADER=OFF \
138 -DKOMPUTE_OPT_USE_BUILT_IN_SPDLOG=OFF \
139 -DLLMODEL_KOMPUTE=ON \
140 -DLLMODEL_VULKAN=OFF \
141 -DLLMODEL_CUDA=OFF \
142 -DLLMODEL_ROCM=OFF
143 cmake --build build-chat
144}
145package_gpt4all-chat() {
146 depends+=("hicolor-icon-theme")
147
148 DESTDIR="$pkgdir" cmake --install build-chat
149 install -Dm644 "$srcdir/gpt4all-$pkgver/gpt4all-chat/flatpak-manifest/io.gpt4all.gpt4all.desktop" \
150 "$pkgdir/usr/share/applications/io.gpt4all.gpt4all.desktop"
151 sed -i 's/Exec=chat/Exec=gpt4all-chat/' "$pkgdir/usr/share/applications/io.gpt4all.gpt4all.desktop"
152 install -Dm644 "$srcdir/gpt4all-$pkgver/gpt4all-chat/flatpak-manifest/io.gpt4all.gpt4all.appdata.xml" \
153 "$pkgdir/usr/share/metainfo/io.gpt4all.gpt4all.metainfo.xml"
154 for size in 32 48
155 do
156 install -Dm644 "$srcdir/gpt4all-$pkgver/gpt4all-chat/icons/gpt4all-$size.png" \
157 "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/io.gpt4all.gpt4all.png"
158 done
159 install -Dm644 "$srcdir/gpt4all-$pkgver/gpt4all-chat/icons/gpt4all.svg" \
160 "$pkgdir/usr/share/icons/hicolor/scalable/apps/io.gpt4all.gpt4all.svg"
161 install -Dm644 "$srcdir/gpt4all-$pkgver/LICENSE.txt" \
162 "$pkgdir/usr/share/licenses/gpt4all-chat/LICENSE.txt"
163 install -Dm644 "$srcdir/gpt4all-$pkgver/gpt4all-chat/LICENSE" \
164 "$pkgdir/usr/share/licenses/gpt4all-chat/LICENSE_chat.txt"
165 # Remove useless static linked libraries headers/archives
166 rm -rf "$pkgdir/usr/include" "$pkgdir/usr/lib/cmake" "$pkgdir/usr/lib/pkgconfig" "$pkgdir/usr/lib/"*.a \
167 "$pkgdir/usr/share/doc"
168}
169

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion