gpu-unlock-dkms

LOW

maintainer lapsus 0 votes base gpu-unlock scanned 2026-10-28 03:50:41.373439

View on AUR

Why flagged

All sources are from plausible official or project-owned hosts (GitHub project repo, download.nvidia.com); checksums are provided for all sources; the NVIDIA installer is used only to extract firmware assets, not executed as a privileged installer; no obfuscation, exfiltration, or suspicious runtime behaviour is present. The package is new with few votes but is otherwise clean.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): All sources are from plausible official or project-owned hosts (GitHub project repo, download.nvidia.com); checksums are provided for all sources; the NVIDIA installer is used only to extract firmware assets, not executed as a privileged installer; no obfuscation, exfiltration, or suspicious runtime behaviour is present. The package is new with few votes but is otherwise clean.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://download.nvidia.com/XFree86/NVIDIA-kernel-module-source/NVIDIA-kernel-module-source-$_nv.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgbase=gpu-unlock
    
      4pkgname=(gpu-unlock-dkms gpu-unlock-firmware)
    
      5pkgver=2.0.0
    
      6pkgrel=1
    
      7_commit=0532473b4b105ed216948ed9c5aaeab0fa5c734f
    
      8_nv=610.43.03
    
      9_installer=NVIDIA-Linux-x86_64-$_nv-no-compat32.run
    
      10pkgdesc='Lifts the GeForce cap that halves FP16/BF16/TF32 tensor throughput on RTX 20/30/40 cards'
    
      11arch=('x86_64')
    
      12url='https://github.com/Zagitta/gpu-unlock'
    
      13license=('GPL-2.0-only')
    
      14makedepends=('python' 'zstd' 'openssl')
    
      15options=('!strip' '!debug')
    
      16source=("$pkgbase-$_commit.tar.gz::$url/archive/$_commit.tar.gz"
    
      17        "https://download.nvidia.com/XFree86/NVIDIA-kernel-module-source/NVIDIA-kernel-module-source-$_nv.tar.xz"
    
      18        "https://download.nvidia.com/XFree86/Linux-x86_64/$_nv/$_installer"
    
      19        "gpu-unlock-dkms.install")
    
      20sha256sums=('a8d30dac52fbc0f0720ef81616effa8c08965afd21873c7a7f26f8c8c55642cd'
    
      21            '7e118923c7a23edc36114d63273a46e3e04e9af98695a42203e7ac2dfe9fc1dc'
    
      22            'e084451db730a6df29d3d74f655749c4d236e3c945f7d94b5205e84318fe2f90'
    
      23            '1b297cece7ea68599661c08540f1fbf7d33bea392c433b9b72822c314b870354')
    
      24noextract=("$_installer")
    
      25
    
      26prepare() {
    
      27  cd "$pkgbase-$_commit"
    
      28  [[ $(< VERSION) == "$pkgver" ]]
    
      29}
    
      30
    
      31build() {
    
      32  cd "$pkgbase-$_commit"
    
      33  python firmware/extract_gsp.py "$srcdir/$_installer" "$srcdir/assets"
    
      34  python firmware/extract_boot_assets.py "$srcdir/NVIDIA-kernel-module-source-$_nv" "$srcdir/assets"
    
      35}
    
      36
    
      37package_gpu-unlock-dkms() {
    
      38  pkgdesc+=' (DKMS module and initramfs hooks)'
    
      39  arch=('any')
    
      40  depends=('dkms' "gpu-unlock-firmware=$pkgver-$pkgrel")
    
      41  backup=('etc/mkinitcpio.conf.d/zz-gpu-unlock.conf')
    
      42  install=gpu-unlock-dkms.install
    
      43
    
      44  cd "$pkgbase-$_commit"
    
      45  make DESTDIR="$pkgdir" install-dkms install-mkinitcpio install-dracut
    
      46  make DESTDIR="$pkgdir" PKG=$pkgname install-licenses
    
      47}
    
      48
    
      49package_gpu-unlock-firmware() {
    
      50  pkgdesc+=' (firmware assets extracted from the NVIDIA installer)'
    
      51  license=('GPL-2.0-only' 'LicenseRef-NVIDIA')
    
      52
    
      53  cd "$pkgbase-$_commit"
    
      54  make DESTDIR="$pkgdir" ASSETS="$srcdir/assets" install-firmware
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-28 03:50:41	Low	3
2026-10-28 03:49:04	Medium	2