gravitymark

LOW

maintainer sbernard 1 votes scanned 2026-09-01 00:11:19.967602

View on AUR

Why flagged

Downloads a prebuilt binary from tellusim.com, which is the official vendor domain for GravityMark, with sha256 checksums provided; this is a legitimate proprietary GPU benchmark packaged from its own official distribution infrastructure, so the risk is low despite being a prebuilt executable.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads a prebuilt binary from tellusim.com, which is the official vendor domain for GravityMark, with sha256 checksums provided; this is a legitimate proprietary GPU benchmark packaged from its own official distribution infrastructure, so the risk is low despite being a prebuilt executable.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "GravityMark-${pkgver}-x86_64.run::https://tellusim.com/download/GravityMark_${pkgver}.run"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Samuel Bernard <samuel.bernard@gmail.com>
    
      2
    
      3pkgname=gravitymark
    
      4pkgver=1.89
    
      5pkgrel=1
    
      6pkgdesc="Cross-platform GPU benchmark and stress test"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://gravitymark.tellusim.com/"
    
      9license=('LicenseRef-GravityMark-EULA')
    
      10
    
      11depends=(
    
      12  'hicolor-icon-theme'
    
      13  'libglvnd'
    
      14  'libx11'
    
      15  'libxcb'
    
      16  'libxext'
    
      17  'libxrandr'
    
      18  'vulkan-icd-loader'
    
      19)
    
      20optdepends=(
    
      21  'vulkan-driver: Vulkan driver for Vulkan benchmarks'
    
      22)
    
      23# Keep the prebuilt upstream binaries unmodified; their launcher ensures that
    
      24# relative RUNPATH entries resolve from the package-owned runtime directory.
    
      25options=('!strip')
    
      26source=(
    
      27  'gravitymark.sh'
    
      28  'gravitymark.desktop'
    
      29)
    
      30source_x86_64=(
    
      31  "GravityMark-${pkgver}-x86_64.run::https://tellusim.com/download/GravityMark_${pkgver}.run"
    
      32)
    
      33source_aarch64=(
    
      34  "GravityMark-${pkgver}-aarch64.run::https://tellusim.com/download/GravityMark_${pkgver}_arm64.run"
    
      35)
    
      36sha256sums=(
    
      37  '73cee5ba4c5e13a70d8d4d721cb3f836e278542e75d1d3eca28892519271504e'
    
      38  'dc1be911ce5e5dd0e5d05f28cc1a2bbcb72b8ab269a63c4c254a2c371e786715'
    
      39)
    
      40sha256sums_x86_64=(
    
      41  'de090c7b9e40f10f225d9393f2cf73a660ad4edc21f6b333eea3190a8722e005'
    
      42)
    
      43sha256sums_aarch64=(
    
      44  '24919031efe3dd9b81f3b64453b7c04da60c3dfc2129ac18a94b28c0c97e6ba8'
    
      45)
    
      46
    
      47prepare() {
    
      48  local _src="${srcdir}/GravityMark_${pkgver}_linux"
    
      49
    
      50  rm -rf "$_src"
    
      51  mkdir "$_src"
    
      52
    
      53  sh "${srcdir}/GravityMark-${pkgver}-${CARCH}.run" --tar xf -C "$_src"
    
      54  bsdtar -xOf "${_src}/browser.zip" browser/images/gravitymark.svg \
    
      55    > "${srcdir}/gravitymark.svg"
    
      56}
    
      57
    
      58package() {
    
      59  local _src="${srcdir}/GravityMark_${pkgver}_linux"
    
      60
    
      61  install -dm755 "${pkgdir}/opt/gravitymark/bin"
    
      62  for _file in "${_src}/bin/"*; do
    
      63    if [[ "$_file" == *.so ]]; then
    
      64      install -m644 "$_file" "${pkgdir}/opt/gravitymark/bin/"
    
      65    else
    
      66      install -m755 "$_file" "${pkgdir}/opt/gravitymark/bin/"
    
      67    fi
    
      68  done
    
      69  install -m644 \
    
      70    "${_src}/browser.zip" \
    
      71    "${_src}/data.zip" \
    
      72    "${pkgdir}/opt/gravitymark/"
    
      73  install -m755 "${_src}"/run_*.sh \
    
      74    "${pkgdir}/opt/gravitymark/"
    
      75  install -Dm755 "${srcdir}/gravitymark.sh" \
    
      76    "${pkgdir}/usr/bin/gravitymark"
    
      77  install -Dm644 "${srcdir}/gravitymark.desktop" \
    
      78    "${pkgdir}/usr/share/applications/gravitymark.desktop"
    
      79  install -Dm644 "${srcdir}/gravitymark.svg" \
    
      80    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/gravitymark.svg"
    
      81  install -Dm644 "${_src}/GravityMark_EULA.pdf" \
    
      82    "${pkgdir}/usr/share/licenses/${pkgname}/GravityMark_EULA.pdf"
    
      83  install -Dm644 "${_src}/GravityMark_Commercial.pdf" \
    
      84    "${pkgdir}/usr/share/licenses/${pkgname}/GravityMark_Commercial.pdf"
    
      85  install -Dm644 "${_src}/Acknowledgements.txt" \
    
      86    "${pkgdir}/usr/share/licenses/${pkgname}/Acknowledgements.txt"
    
      87  install -Dm644 "${_src}/GravityMark_Manual.pdf" \
    
      88    "${pkgdir}/usr/share/doc/${pkgname}/GravityMark_Manual.pdf"
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 00:11:19	Low	3
2026-08-31 23:48:07	Low	3
2026-08-31 23:46:20	Medium	3