grok-build-git

MEDIUM

maintainer olwig 1 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The PKGBUILD downloads and executes the rustup installer script directly from sh.rustup.rs via `curl ... | sh` (line 59) rather than using the system Rust/rustup packages or declaring it in source=(). This is a well-known but still risky pattern: it bypasses makepkg's source integrity checking and executes a remotely-fetched shell script. However, sh.rustup.rs is the official Rust toolchain installer from the Rust project, uses HTTPS with TLS 1.2+, and this pattern is commonly seen in AUR packages that need specific Rust toolchain versions. The `cargo install dotslash` (line 66) also pulls from crates.io at build time without pinning, which is a supply-chain concern. The rest of the PKGBUILD is straightforward: it builds from a GitHub source, performs license and version checks, and installs a single binary. There is no obfuscation, no exfiltration, and no substitution of upstream sources. The risks are real but not clearly malicious — this is a medium-severity supply-chain concern due to the unverified remote script execution and unpinned cargo dependency, not a genuine attack.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:59 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain none

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:66 cargo install dotslash

Medium AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): The PKGBUILD downloads and executes the rustup installer script directly from sh.rustup.rs via `curl ... | sh` (line 59) rather than using the system Rust/rustup packages or declaring it in source=(). This is a well-known but still risky pattern: it bypasses makepkg's source integrity checking and executes a remotely-fetched shell script. However, sh.rustup.rs is the official Rust toolchain installer from the Rust project, uses HTTPS with TLS 1.2+, and this pattern is commonly seen in AUR packages that need specific Rust toolchain versions. The `cargo install dotslash` (line 66) also pulls from crates.io at build time without pinning, which is a supply-chain concern. The rest of the PKGBUILD is straightforward: it builds from a GitHub source, performs license and version checks, and installs a single binary. There is no obfuscation, no exfiltration, and no substitution of upstream sources. The risks are real but not clearly malicious — this is a medium-severity supply-chain concern due to the unverified remote script execution and unpinned cargo dependency, not a genuine attack.

1 higher static finding superseded - not the current verdict (shown for transparency)

High Remote download executed by a shell curl_pipe_shell

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

PKGBUILD:59 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain none

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Olaf Wriggers <olaf@olwig.xyz>
    
      2
    
      3pkgname=grok-build-git
    
      4_pkgname=grok-build
    
      5pkgver=r43.75810042
    
      6pkgrel=1
    
      7pkgdesc="SpaceXAI's coding agent harness and TUI. Fullscreen, mouse interactive, extensible."
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://x.ai/build"
    
      10license=('Apache-2.0')
    
      11provides=('grok')
    
      12conflicts=('grok')
    
      13options=('!strip' '!debug' '!emptydirs')
    
      14
    
      15makedepends=("git" "curl")
    
      16backup=('etc/grok/requirements.toml')
    
      17
    
      18source=(
    
      19  "$_pkgname::git+https://github.com/xai-org/grok-build.git"
    
      20  "requirements.toml"
    
      21)
    
      22
    
      23b2sums=(
    
      24  "SKIP"
    
      25  "37b586af90c67f7a8cfb778d3408d60c87f81cd5aff6c52ed8e091c741446543f5aaecf773160f4cf29005bded1c653f2e62868b851e9470914dded3e585c58e"
    
      26)
    
      27
    
      28pkgver() {
    
      29  cd "$srcdir/$_pkgname"
    
      30  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      31}
    
      32
    
      33# TODO default "ultra" sandbox -> https://docs.x.ai/build/features/sandbox
    
      34# TODO restrict with explicit local grok user
    
      35
    
      36prepare() {
    
      37  cd "$srcdir/$_pkgname"
    
      38
    
      39  cargo_toml="crates/codegen/xai-grok-pager-bin/Cargo.toml"
    
      40  upstream_license=$(grep '^license =' "$cargo_toml" | cut -d '"' -f2)
    
      41  if [[ "$license" != "$upstream_license" ]]; then
    
      42    echo "License mismatch: $cargo_toml license is $upstream_license, but PKGBUILD license is $license"
    
      43    exit 1
    
      44  fi
    
      45  # TODO check also LICENSE file
    
      46
    
      47}
    
      48
    
      49build() {
    
      50  cd "$srcdir/$_pkgname"
    
      51  
    
      52  export RUSTUP_HOME="$srcdir/rustup"
    
      53  export CARGO_HOME="$srcdir/cargo"
    
      54  export PATH="$CARGO_HOME/bin:$PATH"
    
      55  export RUSTUP_INIT_SKIP_PATH_CHECK=yes
    
      56
    
      57  rm -rf "$RUSTUP_HOME" "$CARGO_HOME"
    
      58
    
      59  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain none  
    
      60  rustup show
    
      61
    
      62  # ring, used by xai-grok-tools, fails to link when -flto is present in CFLAGS
    
      63  # same for lzma and zstd, since moved install dotslash from prepare to build
    
      64  unset CFLAGS 
    
      65
    
      66  cargo install dotslash
    
      67  cargo build -p xai-grok-pager-bin --release 
    
      68
    
      69  binary="$srcdir/$_pkgname/target/release/xai-grok-pager"
    
      70  chmod +x "$binary"
    
      71
    
      72  cargo_toml="crates/codegen/xai-grok-pager-bin/Cargo.toml"
    
      73  upstream_version=$(grep '^version =' "$cargo_toml" | cut -d '"' -f2)
    
      74  binary_version=$("$binary" --version | awk '{print $2}')
    
      75  if [[ "$binary_version" != "$upstream_version" ]]; then
    
      76    echo "Version mismatch: built binary version is $binary_version, but upstream version is $upstream_version"
    
      77    exit 1
    
      78  fi
    
      79}
    
      80
    
      81package() {
    
      82  binary="$srcdir/$_pkgname/target/release/xai-grok-pager"
    
      83
    
      84  install -Dm755 "$binary" "$pkgdir/usr/bin/grok"
    
      85  install -Dm644 "$srcdir/$_pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      86  install -Dm644 "$srcdir/requirements.toml" "$pkgdir/etc/grok/requirements.toml"
    
      87
    
      88  install -d "$pkgdir/usr/share/bash-completion/completions"
    
      89  install -d "$pkgdir/usr/share/zsh/site-functions"
    
      90  install -d "$pkgdir/usr/share/fish/vendor_completions.d"
    
      91
    
      92  "$pkgdir/usr/bin/grok" completions bash > "$pkgdir/usr/share/bash-completion/completions/grok" || true
    
      93  "$pkgdir/usr/bin/grok" completions zsh  > "$pkgdir/usr/share/zsh/site-functions/_grok" || true
    
      94  "$pkgdir/usr/bin/grok" completions fish > "$pkgdir/usr/share/fish/vendor_completions.d/grok.fish" || true
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Medium	4
2026-10-01 00:02:06	Medium	4
2026-09-30 00:20:07	Medium	4
2026-09-29 00:07:46	Medium	4
2026-09-28 00:28:32	Medium	4
2026-09-27 00:07:07	Medium	4
2026-09-26 00:12:15	Medium	4
2026-09-25 00:03:36	Medium	4
2026-09-24 00:24:14	Medium	4
2026-09-23 00:28:13	Medium	4
2026-09-22 00:15:14	Medium	4
2026-09-21 00:26:32	Medium	4
2026-09-20 00:25:31	Medium	4
2026-09-19 00:25:36	Medium	4
2026-09-18 00:17:11	Medium	4
2026-09-17 21:26:26	High	3
2026-09-17 00:27:14	Medium	4
2026-09-16 00:03:17	Medium	4
2026-09-15 00:25:31	Medium	4
2026-09-14 00:27:57	Medium	4