grml-iso

LOW

maintainer orphaned 2 votes scanned 2026-10-19 00:03:55.276608

View on AUR

Why flagged

The package downloads a Grml ISO image from the project's official download domain; while the host is not on a standard whitelist, it is plausibly the project's own infrastructure, and the ISO is installed as data for local usage by a rescue tool, not executed or installed system-wide.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Grml ISO image from the project's official download domain; while the host is not on a standard whitelist, it is plausibly the project's own infrastructure, and the ISO is installed as data for local usage by a rescue tool, not executed or installed system-wide.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("http://download.grml.org/grml${_isover}.iso")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Max Roder <maxroder@mailbox.org>
    
      2# Prev Maintainer: Xaekai <archuserrepo at pink dot horse>
    
      3# Prev Maintainer: Thiago Perrotta <perrotta dot thiago at poli dot ufrj dot br>
    
      4
    
      5pkgname=grml-iso
    
      6pkgver=2026.09
    
      7_isover="-full-$pkgver-amd64"
    
      8pkgrel=1
    
      9pkgdesc="provides the grml ISO image for usage by grml-rescueboot"
    
      10url="http://wiki.grml.org/doku.php?id=rescueboot"
    
      11arch=('any')
    
      12license=('GPL')
    
      13depends=('grub' 'grml-rescueboot>=0.5.0')
    
      14install="${pkgname}.install"
    
      15source=("http://download.grml.org/grml${_isover}.iso")
    
      16sha256sums=('76e8019ff1b68ddb3e49cecb1ea35ecead9e0f1c1ba22c0e819c9b13de939e72')
    
      17noextract=(grml${_isover}.iso)
    
      18
    
      19package() {
    
      20    install -Dm644 ${srcdir}/grml${_isover}.iso ${pkgdir}/opt/grml/grml${_isover}.iso
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2