grml-systemd-boot-small
LOW
maintainer Maxr
0 votes
scanned 2026-09-17 09:28:48.085828
Why flagged
All sources are from legitimate official hosts (download.grml.org with PGP signature verification, snapshot.debian.org for an immutable Debian package snapshot); the .deb is installed as data to the ESP's /boot/debs/ directory for use by the live system's dpkg, not executed at build/install time; no obfuscation, exfiltration, or remote code execution patterns present. Minor concern is the non-whitelisted snapshot.debian.org host, but it is Debian's official immutable snapshot infrastructure.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): All sources are from legitimate official hosts (download.grml.org with PGP signature verification, snapshot.debian.org for an immutable Debian package snapshot); the .deb is installed as data to the ESP's /boot/debs/ directory for use by the live system's dpkg, not executed at build/install time; no obfuscation, exfiltration, or remote code execution patterns present. Minor concern is the non-whitelisted snapshot.debian.org host, but it is Debian's official immutable snapshot infrastructure.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:45
https://download.grml.org/$_iso
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Max Roder <maxroder@mailbox.org>
2
# Based on grml-systemd-boot by Nicolas Stalder <n+archlinux@stalder.io>
3
#
4
# grml as a systemd-boot entry directly on the ESP (kernel, initrd, squashfs
5
# under /boot/grml), a second "toram" entry, a custom grml-autoconfig
6
# configuration under /boot/scripts (boot option "scripts") and a helper to
7
# build /boot/config.tbz (boot option "config"). See the migration runbook, 1l.
8
#
9
# The ESP needs ~700 MB of free space for this flavour. For the complete
10
# grml system (ISO ~1.1 GB) see the package grml-systemd-boot-full.
11
12
pkgname=grml-systemd-boot-small
13
_flavour=small
14
pkgver=2026.09
15
pkgrel=1
16
pkgdesc="grml-$_flavour live system as systemd-boot loader entry on the ESP, with grml-autoconfig scripts"
17
url="https://wiki.archlinux.org/title/Systemd-boot#Grml_on_ESP"
18
# The package ships an amd64 kernel, initrd and squashfs, so it is not "any".
19
arch=(x86_64)
20
# The packaging scripts are GPL-2.0-or-later. The grml ISO itself aggregates
21
# software under many licenses; see /usr/share/doc inside the live system.
22
license=('GPL-2.0-or-later')
23
depends=(systemd)
24
provides=(grml-systemd-boot)
25
# grml-systemd-boot (AUR, by nickray) uses the same paths on the ESP, and the
26
# two flavours here overwrite each other's /boot/grml files: all mutually exclusive.
27
conflicts=(grml-systemd-boot grml-systemd-boot-full)
28
install=$pkgname.install
29
backup=(
30
boot/loader/entries/grml.conf
31
boot/scripts/grml.sh
32
etc/grml-config-update.conf
33
)
34
optdepends=('sbctl: sign the grml kernel for Secure Boot')
35
36
_iso=grml-$_flavour-$pkgver-amd64.iso
37
# arch-install-scripts (arch-chroot, genfstab, pacstrap) is not part of grml.
38
# Architecture "all" and pure shell, so the version is independent of the grml
39
# release and is not bumped with it. Taken from snapshot.debian.org because
40
# deb.debian.org drops a pool file as soon as a newer version enters sid,
41
# which would break this PKGBUILD; snapshot URLs are immutable.
42
_ais=arch-install-scripts_31-1_all.deb
43
_ais_url=https://snapshot.debian.org/archive/debian/20260903T000000Z/pool/main/a/arch-install-scripts
44
source=(
45
https://download.grml.org/$_iso
46
https://download.grml.org/$_iso.asc
47
$_ais_url/$_ais
48
grml.conf
49
grml.sh
50
wpa.conf.example
51
grml-config-update
52
grml-config-update.conf
53
)
54
noextract=($_iso $_ais)
55
# Michael Prokop <mika@grml.org>, signs the grml release ISOs
56
validpgpkeys=('33CCB136401AFEC843A3876396A87872B7EA3737')
57
sha256sums=('81062142e320b158dcac541506e74e1b4d77f409e72bf7ef52820fc881d72c33'
58
'6f969c5f684a532261a3b4b180181ae31f311ed994d6c3dd5ea76b6a062f40d5'
59
'17d6b437fbb538b8c9b45d8cc85483fa2a34d9649faeba1850954ab700cfa536'
60
'76feb18f40202755af803c3bd5f500f821d9542946064aca25ccff4cc0aa9d24'
61
'22bb6e536e6f87e393711268fc2b14d89725238bbc2ad98732500a1770b551b3'
62
'8eb2d8fd95345cd373551e41b3fdc7081216c7aa4ba3f669d8604b882785d37c'
63
'd8bd452801bb38d92d35809c0e68ab42343ec152b6d8207ff0d260851cf05435'
64
'c38dcfddf5fa01adcf6f66fa0e993a6115d836091d2a6490ed385d60e36eeb51')
65
66
prepare() {
67
# Extract only the three live files from the ISO instead of unpacking
68
# the whole image. The directory names inside the ISO vary by release and
69
# flavour (boot/grmlfullamd64, boot/grmlsmallamd64, ...), hence wildcards.
70
rm -rf live
71
mkdir -p live
72
bsdtar -xf "$_iso" -C live \
73
'boot/*/vmlinuz' \
74
'boot/*/initrd.img' \
75
'live/*/*.squashfs'
76
for f in vmlinuz initrd.img; do
77
[ "$(find live/boot -name "$f" | wc -l)" = 1 ] || { echo "==> ERROR: $f not found exactly once in $_iso" >&2; return 1; }
78
done
79
[ "$(find live/live -name '*.squashfs' | wc -l)" = 1 ] || { echo "==> ERROR: squashfs not found exactly once in $_iso" >&2; return 1; }
80
}
81
82
package() {
83
# Live system: /grml/ is the live-media-path in grml.conf.
84
install -d "$pkgdir/boot/grml"
85
install -m644 "$(find live/boot -name vmlinuz)" "$pkgdir/boot/grml/vmlinuz"
86
install -m644 "$(find live/boot -name initrd.img)" "$pkgdir/boot/grml/initrd.img"
87
install -m644 "$(find live/live -name '*.squashfs')" "$pkgdir/boot/grml/"
88
89
# systemd-boot entry. Deliberately no "toram" variant, see the comment in grml.conf.
90
install -Dm644 grml.conf "$pkgdir/boot/loader/entries/grml.conf"
91
92
# grml-autoconfig: boot option "scripts" runs /scripts/grml.sh from the
93
# boot medium (= the ESP). wpa.conf with the WLAN PSK does not belong in
94
# the package, only the template; grml.sh starts WLAN only if wpa.conf exists.
95
install -Dm755 grml.sh "$pkgdir/boot/scripts/grml.sh"
96
install -Dm644 wpa.conf.example "$pkgdir/boot/scripts/wpa.conf.example"
97
98
# Boot option "debs": grml-autoconfig runs "dpkg -i <medium>/debs/*.deb"
99
# before the "scripts" stage, so arch-chroot and genfstab are available in
100
# the live system. The package has no dependencies of its own. pacstrap
101
# comes with it but needs pacman, which grml does not ship.
102
install -Dm644 "$_ais" "$pkgdir/boot/debs/$_ais"
103
104
# Helper that rebuilds /boot/config.tbz (boot option "config") from a path list
105
install -Dm755 grml-config-update "$pkgdir/usr/bin/grml-config-update"
106
install -Dm644 grml-config-update.conf "$pkgdir/etc/grml-config-update.conf"
107
}
108
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 09:28:48 | Low | 3 |
| 2026-09-17 09:25:44 | Medium | 2 |