katago-cuda (LOW)

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host hosts a neural network model (data file), not executable code; worst case is model tampering, not remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://media.katagotraining.org/uploaded/networks/models/kata1/kata1-zhizi-b40c768nbt-s11272M-d5935M.bin.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Scott Cheng <aur@chengscott.io>
    
      2# Contributor: Alexander F. Rødseth <xyproto@archlinux.org>
    
      3# Contributor: flovo <flovo-git-commit@f-voegele.de>
    
      4
    
      5pkgname=katago-cuda
    
      6_pkgname=katago
    
      7pkgver=1.18.2
    
      8pkgrel=1
    
      9pkgdesc='Baduk engine with no human-provided knowledge'
    
      10arch=(x86_64)
    
      11provides=($_pkgname)
    
      12conflicts=($_pkgname)
    
      13url='https://github.com/lightvector/KataGo'
    
      14license=(MIT)
    
      15depends=(libzip)
    
      16makedepends=(cmake cuda cudnn ninja)
    
      17source=("${pkgname}-${pkgver}.tar.gz"::"${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      18        # Strongest confidently-rated network
    
      19        "https://media.katagotraining.org/uploaded/networks/models/kata1/kata1-zhizi-b40c768nbt-s11272M-d5935M.bin.gz"
    
      20)
    
      21b2sums=('694677b5419d9a9a26e746c3ce5d1c09bb2f928f266d4fefd99961b7c884a43f96aa59723ea912c97329896f35b910e65b4d4603eeb28afc21b09d2d8eefdf58'
    
      22        '47d4f059434fdd3a85fe590186513e24999d6ed23ad7d5d073ecd73f44672b15e0ff10d475b17950b1673b7f49137be9573f059e182afd389c4b8e20ff2db0b2'
    
      23)
    
      24_model_source=("${source[@]:1}")
    
      25_model=("${_model_source[@]##*/}")
    
      26noextract=("${_model[@]}")
    
      27
    
      28build() {
    
      29  cmake \
    
      30    -S "KataGo-${pkgver}/cpp" \
    
      31    -B build \
    
      32    -D CMAKE_BUILD_TYPE=Release \
    
      33    -D CMAKE_INSTALL_PREFIX=/usr \
    
      34    -D USE_BACKEND=CUDA \
    
      35    -D NO_GIT_REVISION=1 \
    
      36    -G Ninja
    
      37  cmake --build build
    
      38}
    
      39
    
      40package() {
    
      41  install -Dm755 build/katago "${pkgdir}/usr/bin/katago"
    
      42  install -Dm644 "KataGo-${pkgver}/LICENSE" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      43  # install models
    
      44  for mi in "${_model[@]}"; do
    
      45      install -Dm644 "${mi}" "${pkgdir}/usr/share/${_pkgname}/${mi}"
    
      46  done
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-08-30 00:04
+++ PKGBUILD @ 2026-09-17 00:27
@@ -4,7 +4,7 @@
 
 pkgname=katago-cuda
 _pkgname=katago
-pkgver=1.17.2
+pkgver=1.18.2
 pkgrel=1
 pkgdesc='Baduk engine with no human-provided knowledge'
 arch=(x86_64)
@@ -18,7 +18,7 @@
         # Strongest confidently-rated network
         "https://media.katagotraining.org/uploaded/networks/models/kata1/kata1-zhizi-b40c768nbt-s11272M-d5935M.bin.gz"
 )
-b2sums=('1e6a000f4b79bc8896af090e2b8209ca3037e9e7cb6b9842b848c779800e066fe0835cbfe37c6012df23c7e65d3fbf4a44d7146c1afd05fed17949357367f832'
+b2sums=('694677b5419d9a9a26e746c3ce5d1c09bb2f928f266d4fefd99961b7c884a43f96aa59723ea912c97329896f35b910e65b4d4603eeb28afc21b09d2d8eefdf58'
         '47d4f059434fdd3a85fe590186513e24999d6ed23ad7d5d073ecd73f44672b15e0ff10d475b17950b1673b7f49137be9573f059e182afd389c4b8e20ff2db0b2'
 )
 _model_source=("${source[@]:1}")

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 13:42:42	Medium	1
2026-08-30 00:04:14	Low	2