grml-full-systemd-boot

LOW

maintainer barbuk 1 votes scanned 2026-10-19 00:03:55.276608

View on AUR

Why flagged

The package downloads an official ISO from the project's own domain (grml.org) to extract bootloader components; this is a legitimate use of a non-whitelisted host for building a system integration package, with no code execution or supply-chain risk beyond standard AUR practices.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads an official ISO from the project's own domain (grml.org) to extract bootloader components; this is a legitimate use of a non-whitelisted host for building a system integration package, with no code execution or supply-chain risk beyond standard AUR practices.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 https://download.grml.org/grml-full-"${pkgver}"-amd64.iso

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Julien Virey <julien.virey+aur@gmail.com>
    
      2# Contributor: Christian Holme (Nordwin) <hcmh [at] mailbox [dot] org>
    
      3# Contributor: Nicolas Stalder <n+archlinux@stalder.io>
    
      4pkgname=grml-full-systemd-boot
    
      5pkgver=2026.09
    
      6pkgrel=1
    
      7pkgdesc="GRML-full as systemd-boot loader entry"
    
      8url="https://wiki.archlinux.org/title/Systemd-boot#Grml_on_ESP"
    
      9arch=('x86_64')
    
      10license=(GPL-2.0-or-later)
    
      11depends=(systemd)
    
      12options=('!debug')
    
      13backup=("boot/loader/entries/grml-full.conf")
    
      14source=(
    
      15  https://download.grml.org/grml-full-"${pkgver}"-amd64.iso
    
      16  grml-full.conf
    
      17)
    
      18noextract=(grml-full-"${pkgver}"-amd64.iso)
    
      19
    
      20sha256sums=('76e8019ff1b68ddb3e49cecb1ea35ecead9e0f1c1ba22c0e819c9b13de939e72'
    
      21            'c5fbdf83f1dcf220ad764175ab0eda013edd7d86ffccda747ea41ce1a8ba7b1f')
    
      22
    
      23prepare() {
    
      24  cd "${srcdir}"
    
      25  bsdtar xf grml-full-"${pkgver}"-amd64.iso \
    
      26    boot/grmlfullamd64/vmlinuz \
    
      27    boot/grmlfullamd64/initrd.img \
    
      28    live/grml-full-amd64/grml-full-amd64.squashfs
    
      29}
    
      30
    
      31package() {
    
      32  install -d ${pkgdir}/boot/grml
    
      33  cp "${srcdir}"/boot/grmlfullamd64/vmlinuz "${pkgdir}"/boot/grml/vmlinuz-grml-full
    
      34  cp "${srcdir}"/boot/grmlfullamd64/initrd.img "${pkgdir}"/boot/grml/initrd-grml-full.img
    
      35  cp "${srcdir}"/live/grml-full-amd64/grml-full-amd64.squashfs "${pkgdir}"/boot/grml
    
      36  install -d -m 755 "${pkgdir}"/boot/loader/entries
    
      37  cp grml-full.conf "${pkgdir}"/boot/loader/entries/grml-full.conf
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2