grok-build-git
Triggered rules
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:50
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:52
cargo install dotslash
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
llm_review
The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): The PKGBUILD downloads and executes the rustup installer script directly from sh.rustup.rs via `curl | sh` in the prepare() step rather than using the system Rust toolchain or the `rust` makedepend. This is a well-known but non-standard pattern that bypasses pacman's dependency tracking and executes a remotely-fetched shell script. While rustup.rs is the official Rust installer host and the download uses --proto '=https' --tlsv1.2, executing arbitrary shell scripts from the internet during a build is a genuine supply-chain concern (medium impact). Additionally, `cargo install dotslash` fetches and compiles an external crate from crates.io at build time outside of the source=() array, which is another untracked external dependency. The main build itself (cargo build from the git source) is legitimate and builds from source. The license check and version verification steps are actually good hygiene. The source repository (xai-org/grok-build on GitHub) appears to be a real xAI project. The risks are real but not clearly malicious — this is sloppy/non-standard packaging that introduces supply-chain risk through the curl|sh pattern and untracked cargo dependency, warranting medium severity.
1 higher static finding superseded - not the current verdict (shown for transparency)
curl_pipe_shell
curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.
-
PKGBUILD:50
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
PKGBUILD
2 offending line(s) highlighted# Maintainer: Olaf Wriggers <olaf@olwig.xyz>
pkgname=grok-build-git
_pkgname=grok-build
pkgver=r33.d71f6e0
pkgrel=1
pkgdesc="SpaceXAI's coding agent harness and TUI. Fullscreen, mouse interactive, extensible."
arch=('x86_64' 'aarch64')
url="https://x.ai/build"
license=('Apache-2.0')
provides=('grok')
conflicts=('grok')
options=('!strip' '!debug' '!emptydirs')
makedepends=("git" "curl" "perl" "clang")
backup=('etc/grok/requirements.toml')
source=(
"$_pkgname::git+https://github.com/xai-org/grok-build.git"
"requirements.toml"
)
b2sums=(
"SKIP"
"4d37a050b4fa861b2ee076940908f4dfef7419e6297425bb3dfe6c26fcb9440b01befff1837451b9bed194ee45a3f52e30b040bd356b32a5bb178ede6aea694e"
)
pkgver() {
cd "$srcdir/$_pkgname"
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
}
# TODO default "ultra" sandbox -> https://docs.x.ai/build/features/sandbox
# TODO restrict with explicit local grok user
prepare() {
cd "$srcdir/$_pkgname"
cargo_toml="crates/codegen/xai-grok-pager-bin/Cargo.toml"
upstream_license=$(grep '^license =' "$cargo_toml" | cut -d '"' -f2)
if [[ "$license" != "$upstream_license" ]]; then
echo "License mismatch: $cargo_toml license is $upstream_license, but PKGBUILD license is $license"
exit 1
fi
# TODO check also LICENSE file
export RUSTUP_HOME="$srcdir/rustup"
export CARGO_HOME="$srcdir/cargo"
export PATH="$CARGO_HOME/bin:$PATH"
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
rustup toolchain install
cargo install dotslash
}
build() {
cd "$srcdir/$_pkgname"
export RUSTUP_HOME="$srcdir/rustup"
export CARGO_HOME="$srcdir/cargo"
export PATH="$CARGO_HOME/bin:$PATH"
# ring, used by xai-grok-tools, fails to link when -flto is present in CFLAGS
unset CFLAGS
cargo build -p xai-grok-pager-bin --release
binary="$srcdir/$_pkgname/target/release/xai-grok-pager"
chmod +x "$binary"
cargo_toml="crates/codegen/xai-grok-pager-bin/Cargo.toml"
upstream_version=$(grep '^version =' "$cargo_toml" | cut -d '"' -f2)
binary_version=$("$binary" --version | awk '{print $2}')
if [[ "$binary_version" != "$upstream_version" ]]; then
echo "Version mismatch: built binary version is $binary_version, but upstream version is $upstream_version"
exit 1
fi
}
package() {
binary="$srcdir/$_pkgname/target/release/xai-grok-pager"
install -Dm755 "$binary" "$pkgdir/usr/bin/grok"
install -Dm644 "$srcdir/$_pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
install -Dm644 "$srcdir/requirements.toml" "$pkgdir/etc/grok/requirements.toml"
install -d "$pkgdir/usr/share/bash-completion/completions"
install -d "$pkgdir/usr/share/zsh/site-functions"
install -d "$pkgdir/usr/share/fish/vendor_completions.d"
"$pkgdir/usr/bin/grok" completions bash > "$pkgdir/usr/share/bash-completion/completions/grok" || true
"$pkgdir/usr/bin/grok" completions zsh > "$pkgdir/usr/share/zsh/site-functions/_grok" || true
"$pkgdir/usr/bin/grok" completions fish > "$pkgdir/usr/share/fish/vendor_completions.d/grok.fish" || true
}
Changes since previous scan
--- PKGBUILD @ 2026-08-17 00:18+++ PKGBUILD @ 2026-08-18 00:03@@ -2,7 +2,7 @@ pkgname=grok-build-git _pkgname=grok-build-pkgver=r29.eb267fe+pkgver=r33.d71f6e0 pkgrel=1 pkgdesc="SpaceXAI's coding agent harness and TUI. Fullscreen, mouse interactive, extensible." arch=('x86_64' 'aarch64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | MEDIUM | 5 |
| 2026-08-17 21:39:22 | MEDIUM | 5 |
| 2026-08-17 21:37:43 | HIGH | 4 |
| 2026-08-17 00:18:29 | MEDIUM | 5 |
| 2026-08-16 00:03:42 | MEDIUM | 5 |
| 2026-08-15 15:33:54 | MEDIUM | 5 |
| 2026-08-15 15:30:38 | HIGH | 4 |