libvirt-iso-alpine-virt-bin
LOW
maintainer RubenKelevra
0 votes
scanned 2026-10-22 13:37:44.441740
Why flagged
Downloads the official Alpine Linux virt ISO from dl-cdn.alpinelinux.org (Alpine's own CDN) and verifies it with GPG against the official Alpine release key fingerprint; the ISO is installed as pure data (not executed); SKIP'd checksums on the signature and key files are compensated by the explicit GPG verification in prepare(); the only mild concern is SKIP on the key file itself, but the fingerprint is hardcoded and checked in the script.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): Downloads the official Alpine Linux virt ISO from dl-cdn.alpinelinux.org (Alpine's own CDN) and verifies it with GPG against the official Alpine release key fingerprint; the ISO is installed as pure data (not executed); SKIP'd checksums on the signature and key files are compensated by the explicit GPG verification in prepare(); the only mild concern is SKIP on the key file itself, but the fingerprint is hardcoded and checked in the script.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
'alpine-release-key.pubkey::https://www.alpinelinux.org/keys/ncopa.asc'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: @RubenKelevra <rubenkelevra@gmail.com>
2
3
_pkgname='alpine'
4
_flavor='virt'
5
_series='v3.24'
6
pkgname="libvirt-iso-${_pkgname}-${_flavor}-bin"
7
pkgver=3.24.2
8
pkgrel=1
9
pkgdesc='Official Alpine Linux virtualization ISO for libvirt'
10
arch=('x86_64')
11
url='https://www.alpinelinux.org/downloads/'
12
license=('LicenseRef-Various')
13
makedepends=('gnupg')
14
checkdepends=('libarchive')
15
_iso="${_pkgname}-${_flavor}-${pkgver}-${CARCH}.iso"
16
_image="${_pkgname}-${_flavor}-${pkgver}-${CARCH}.iso"
17
_link="${_pkgname}-${_flavor}-${CARCH}.iso"
18
_base_url="https://dl-cdn.alpinelinux.org/alpine/${_series}/releases/${CARCH}"
19
source=(
20
"${_iso}::${_base_url}/${_iso}"
21
"${_iso}.signature::${_base_url}/${_iso}.asc"
22
'alpine-release-key.pubkey::https://www.alpinelinux.org/keys/ncopa.asc'
23
'DISTRIBUTION-LICENSE'
24
)
25
noextract=("${_iso}")
26
sha512sums=(
27
'7563011cefca3f84c77ddab032d47448216e1fc9b730b7d09be9cc26c8d5a69c1b75c9a404f5168654c76128fa231d83b248e24466d6c5dd2655696f44220aba'
28
'SKIP'
29
'SKIP'
30
'SKIP'
31
)
32
b2sums=(
33
'SKIP'
34
'b4490820dbd0e3d62356670b10ea36b2fedf091641ca574da2bcacf564e36e246c559c5ac6753f1849b170f7a297669e459e8ac385b31418dde9e9a7d843ca41'
35
'a0df34a1645d2c21a80dff3776a53fe8b71d1daae06f11fa6f0f5446a496caa42b4d5c2365d5b6f8efcc2460f9c3182c77f0204783ff45cba43201c18ae12057'
36
'6ca732810a034a28e8297a022a7bbcef378ce5534c21d772bed0fe1668046df0594e2c6c66638efd23a894eb59990c6ed34c10e4f7653ceb25f2b9843365b8b7'
37
)
38
validpgpkeys=('0482D84022F52DF1C4E7CD43293ACD0907D9495A')
39
40
prepare() {
41
local fingerprint
42
43
fingerprint="$(gpg --batch --show-keys --with-colons "${srcdir}/alpine-release-key.pubkey" |
44
awk -F: '$1 == "fpr" {print $10; exit}')" || return 1
45
[[ "${fingerprint}" == '0482D84022F52DF1C4E7CD43293ACD0907D9495A' ]] || return 1
46
gpg --batch --yes --dearmor --output "${srcdir}/release-key.gpg" \
47
"${srcdir}/alpine-release-key.pubkey" || return 1
48
gpgv --keyring "${srcdir}/release-key.gpg" \
49
"${srcdir}/${_iso}.signature" "${srcdir}/${_iso}"
50
}
51
52
check() {
53
local iso="${srcdir}/${_iso}"
54
local size
55
local magic
56
57
size="$(stat -Lc '%s' -- "${iso}")" || return 1
58
(( size > 0 && size % 2048 == 0 )) || return 1
59
magic="$(dd if="${iso}" bs=1 skip=32769 count=5 status=none)" || return 1
60
[[ "${magic}" == 'CD001' ]] || return 1
61
file -L --brief -- "${iso}" | grep -Fq 'ISO 9660' || return 1
62
bsdtar -tf "${iso}" > "${srcdir}/check-iso-list" || return 1
63
grep -Fxq 'boot/syslinux/isolinux.bin' "${srcdir}/check-iso-list" || return 1
64
grep -Fxq 'boot/vmlinuz-virt' "${srcdir}/check-iso-list" || return 1
65
grep -Fxq 'boot/initramfs-virt' "${srcdir}/check-iso-list" || return 1
66
grep -Fxq 'efi/boot/bootx64.efi' "${srcdir}/check-iso-list" || return 1
67
local release
68
release="$(bsdtar -xOf "${iso}" .alpine-release)" || return 1
69
[[ "${release}" == "alpine-virt-${pkgver} "* ]] || return 1
70
[[ "${release##* }" =~ ^[0-9]{6}$ ]] || return 1
71
bsdtar -xOf "${iso}" > /dev/null || return 1
72
}
73
74
_install_payload() {
75
local root="${1:?missing package root}"
76
local image_dir="${root}/var/lib/libvirt/images"
77
78
install -Dm644 -- "${srcdir}/${_iso}" "${image_dir}/${_image}" || return 1
79
ln -s -- "${_image}" "${image_dir}/${_link}" || return 1
80
install -Dm644 -- "${srcdir}/DISTRIBUTION-LICENSE" \
81
"${root}/usr/share/licenses/${pkgname}/LICENSE"
82
}
83
84
_check_payload() {
85
local root="${1:?missing package root}"
86
local check_owner="${2:-false}"
87
local image_path="${root}/var/lib/libvirt/images/${_image}"
88
local link_path="${root}/var/lib/libvirt/images/${_link}"
89
local license_path="${root}/usr/share/licenses/${pkgname}/LICENSE"
90
local manifest
91
92
[[ -f "${image_path}" && ! -L "${image_path}" ]] || return 1
93
[[ -L "${link_path}" ]] || return 1
94
[[ "$(readlink -- "${link_path}")" == "${_image}" ]] || return 1
95
[[ -f "${license_path}" ]] || return 1
96
[[ "$(stat -c '%a' -- "${image_path}")" == '644' ]] || return 1
97
[[ "$(stat -c '%a' -- "${license_path}")" == '644' ]] || return 1
98
manifest="$(find "${root}" \( -type f -o -type l \) -printf '%P\n' | LC_ALL=C sort)"
99
[[ "${manifest}" == "$(printf '%s\n' \
100
"usr/share/licenses/${pkgname}/LICENSE" \
101
"var/lib/libvirt/images/${_image}" \
102
"var/lib/libvirt/images/${_link}" | LC_ALL=C sort)" ]] || return 1
103
if [[ "${check_owner}" == 'true' ]]; then
104
[[ "$(stat -c '%u:%g' -- "${image_path}")" == '0:0' ]] || return 1
105
[[ "$(stat -c '%u:%g' -- "${license_path}")" == '0:0' ]] || return 1
106
[[ "$(stat -c '%u:%g' -- "${link_path}")" == '0:0' ]] || return 1
107
fi
108
}
109
110
package() {
111
_install_payload "${pkgdir}" || return 1
112
_check_payload "${pkgdir}" true
113
}
114
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-22 13:37:44 | Low | 3 |
| 2026-10-22 13:35:05 | Medium | 2 |