katago-cuda

LOW

maintainer chengscott 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The non-standard host hosts a neural network model (data file), not executable code; worst case is model tampering, not remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host hosts a neural network model (data file), not executable code; worst case is model tampering, not remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://media.katagotraining.org/uploaded/networks/models/kata1/kata1-zhizi-b40c768nbt-s11272M-d5935M.bin.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Scott Cheng <aur@chengscott.io>
    
      2# Contributor: Alexander F. Rødseth <xyproto@archlinux.org>
    
      3# Contributor: flovo <flovo-git-commit@f-voegele.de>
    
      4
    
      5pkgname=katago-cuda
    
      6_pkgname=katago
    
      7pkgver=1.18.2
    
      8pkgrel=1
    
      9pkgdesc='Baduk engine with no human-provided knowledge'
    
      10arch=(x86_64)
    
      11provides=($_pkgname)
    
      12conflicts=($_pkgname)
    
      13url='https://github.com/lightvector/KataGo'
    
      14license=(MIT)
    
      15depends=(libzip)
    
      16makedepends=(cmake cuda cudnn ninja)
    
      17source=("${pkgname}-${pkgver}.tar.gz"::"${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      18        # Strongest confidently-rated network
    
      19        "https://media.katagotraining.org/uploaded/networks/models/kata1/kata1-zhizi-b40c768nbt-s11272M-d5935M.bin.gz"
    
      20)
    
      21b2sums=('694677b5419d9a9a26e746c3ce5d1c09bb2f928f266d4fefd99961b7c884a43f96aa59723ea912c97329896f35b910e65b4d4603eeb28afc21b09d2d8eefdf58'
    
      22        '47d4f059434fdd3a85fe590186513e24999d6ed23ad7d5d073ecd73f44672b15e0ff10d475b17950b1673b7f49137be9573f059e182afd389c4b8e20ff2db0b2'
    
      23)
    
      24_model_source=("${source[@]:1}")
    
      25_model=("${_model_source[@]##*/}")
    
      26noextract=("${_model[@]}")
    
      27
    
      28build() {
    
      29  cmake \
    
      30    -S "KataGo-${pkgver}/cpp" \
    
      31    -B build \
    
      32    -D CMAKE_BUILD_TYPE=Release \
    
      33    -D CMAKE_INSTALL_PREFIX=/usr \
    
      34    -D USE_BACKEND=CUDA \
    
      35    -D NO_GIT_REVISION=1 \
    
      36    -G Ninja
    
      37  cmake --build build
    
      38}
    
      39
    
      40package() {
    
      41  install -Dm755 build/katago "${pkgdir}/usr/bin/katago"
    
      42  install -Dm644 "KataGo-${pkgver}/LICENSE" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      43  # install models
    
      44  for mi in "${_model[@]}"; do
    
      45      install -Dm644 "${mi}" "${pkgdir}/usr/share/${_pkgname}/${mi}"
    
      46  done
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2