libvirt-iso-archlinux-bin

CLEAN

maintainer RubenKelevra 0 votes scanned 2026-09-16 00:03:17.191873

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package downloads and installs the official Arch Linux ISO from archive.archlinux.org, which is a trusted source; the ISO is verified via PGP signature and extensive integrity checks, and no untrusted or executable remote code is run during build or install.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: @RubenKelevra <rubenkelevra@gmail.com>
    
      2
    
      3_pkgname='archlinux'
    
      4pkgname="libvirt-iso-${_pkgname}-bin"
    
      5pkgver=2026.09.01
    
      6pkgrel=1
    
      7pkgdesc='Official Arch Linux installation ISO for libvirt'
    
      8arch=('x86_64')
    
      9url='https://archlinux.org/download/'
    
      10license=('LicenseRef-Various')
    
      11checkdepends=(
    
      12	'libarchive'
    
      13	'squashfs-tools'
    
      14)
    
      15source=(
    
      16	"${_pkgname}-${pkgver}-${CARCH}.iso::https://archive.archlinux.org/iso/${pkgver}/${_pkgname}-${pkgver}-${CARCH}.iso"
    
      17	"${_pkgname}-${pkgver}-${CARCH}.iso.sig::https://archive.archlinux.org/iso/${pkgver}/${_pkgname}-${pkgver}-${CARCH}.iso.sig"
    
      18	'DISTRIBUTION-LICENSE'
    
      19)
    
      20noextract=("${_pkgname}-${pkgver}-${CARCH}.iso")
    
      21sha256sums=(
    
      22	'be8458032f8105e60ee2a3067f950b6e3c007ee51b38dac50e8b48e765561c91'
    
      23	'SKIP'
    
      24	'cb5f1ca3b96864dcbf26ef4792510c79eabd25a8988fd57e24fef4c02b278d4c'
    
      25)
    
      26validpgpkeys=('3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C')
    
      27
    
      28_install_payload() {
    
      29	local root="${1:?missing package root}"
    
      30	local image="${_pkgname}-${pkgver}-${CARCH}.iso"
    
      31	local image_dir="${root}/var/lib/libvirt/images"
    
      32
    
      33	install -Dm644 -- "${srcdir}/${image}" "${image_dir}/${image}"
    
      34	ln -s -- "${image}" "${image_dir}/${_pkgname}-${CARCH}.iso"
    
      35	install -Dm644 -- "${srcdir}/DISTRIBUTION-LICENSE" \
    
      36		"${root}/usr/share/licenses/${pkgname}/LICENSE"
    
      37}
    
      38
    
      39_check_payload() {
    
      40	local root="${1:?missing package root}"
    
      41	local check_owner="${2:-false}"
    
      42	local image="${_pkgname}-${pkgver}-${CARCH}.iso"
    
      43	local image_path="${root}/var/lib/libvirt/images/${image}"
    
      44	local image_link="${root}/var/lib/libvirt/images/${_pkgname}-${CARCH}.iso"
    
      45	local license_path="${root}/usr/share/licenses/${pkgname}/LICENSE"
    
      46	local manifest
    
      47
    
      48	[[ -f "${image_path}" ]] || return 1
    
      49	[[ -L "${image_link}" ]] || return 1
    
      50	[[ "$(readlink -- "${image_link}")" == "${image}" ]] || return 1
    
      51	[[ -f "${license_path}" ]] || return 1
    
      52	[[ "$(stat -c '%a' -- "${image_path}")" == '644' ]] || return 1
    
      53	[[ "$(stat -c '%a' -- "${license_path}")" == '644' ]] || return 1
    
      54	[[ -z "$(find "${root}" -name '*.sig' -print -quit)" ]] || return 1
    
      55
    
      56	manifest="$(find "${root}" \( -type f -o -type l \) -printf '%P\n' | sort)"
    
      57	[[ "${manifest}" == "$(printf '%s\n' \
    
      58		"usr/share/licenses/${pkgname}/LICENSE" \
    
      59		"var/lib/libvirt/images/${image}" \
    
      60		"var/lib/libvirt/images/${_pkgname}-${CARCH}.iso")" ]] || return 1
    
      61
    
      62	if [[ "${check_owner}" == 'true' ]]; then
    
      63		[[ "$(stat -c '%u:%g' -- "${image_path}")" == '0:0' ]] || return 1
    
      64		[[ "$(stat -c '%u:%g' -- "${license_path}")" == '0:0' ]] || return 1
    
      65		[[ "$(stat -c '%u:%g' -- "${image_link}")" == '0:0' ]] || return 1
    
      66	fi
    
      67}
    
      68
    
      69check() {
    
      70	local image="${_pkgname}-${pkgver}-${CARCH}.iso"
    
      71	local iso="${srcdir}/${image}"
    
      72	local iso_listing="${srcdir}/check-iso-list"
    
      73	local squashfs="${srcdir}/check-airootfs.sfs"
    
      74	local squashfs_root="${srcdir}/check-squashfs-root"
    
      75	local package_root="${srcdir}/check-package-root"
    
      76	local image_size
    
      77	local pvd_type
    
      78	local pvd_magic
    
      79	local pvd_version
    
      80	local volume_sectors
    
      81	local required_path
    
      82
    
      83	printf '%s\n' 'check: ISO size and ISO9660 header'
    
      84	image_size="$(stat -Lc '%s' -- "${iso}")" || return 1
    
      85	(( image_size > 0 && image_size % 2048 == 0 )) || return 1
    
      86
    
      87	pvd_type="$(od -An -tu1 -j $((16 * 2048)) -N1 -- "${iso}" | tr -d ' ')" || return 1
    
      88	pvd_magic="$(dd if="${iso}" bs=1 skip=$((16 * 2048 + 1)) count=5 status=none)" || return 1
    
      89	pvd_version="$(od -An -tu1 -j $((16 * 2048 + 6)) -N1 -- "${iso}" | tr -d ' ')" || return 1
    
      90	volume_sectors="$(od -An -tu4 -j $((16 * 2048 + 80)) -N4 -- "${iso}" | tr -d ' ')" || return 1
    
      91
    
      92	[[ "${pvd_type}" == '1' ]] || return 1
    
      93	[[ "${pvd_magic}" == 'CD001' ]] || return 1
    
      94	[[ "${pvd_version}" == '1' ]] || return 1
    
      95	(( volume_sectors > 0 && volume_sectors * 2048 == image_size )) || return 1
    
      96
    
      97	printf '%s\n' 'check: file(1) ISO and bootability'
    
      98	file -L --brief -- "${iso}" | grep -Fq 'ISO 9660' || return 1
    
      99	file -L --brief -- "${iso}" | grep -Fq 'bootable' || return 1
    
      100
    
      101	printf '%s\n' 'check: ISO directory and required Arch files'
    
      102	bsdtar -tf "${iso}" > "${iso_listing}" || return 1
    
      103	for required_path in \
    
      104		"arch/boot/${CARCH}/vmlinuz-linux" \
    
      105		"arch/boot/${CARCH}/initramfs-linux.img" \
    
      106		"arch/${CARCH}/airootfs.sfs" \
    
      107		'EFI/BOOT/BOOTx64.EFI'; do
    
      108		grep -Fxq -- "${required_path}" "${iso_listing}" || return 1
    
      109	done
    
      110
    
      111	printf '%s\n' 'check: full ISO read'
    
      112	# Read every regular file from the ISO so truncated extents or unreadable data fail.
    
      113	bsdtar -xOf "${iso}" > /dev/null || return 1
    
      114
    
      115	printf '%s\n' 'check: SquashFS full decompression'
    
      116	# The live root filesystem is itself SquashFS. Extracting it forces every
    
      117	# compressed block to be decompressed, catching corruption hidden inside a
    
      118	# structurally valid and correctly signed ISO.
    
      119	bsdtar -xOf "${iso}" "arch/${CARCH}/airootfs.sfs" > "${squashfs}" || return 1
    
      120	rm -rf -- "${squashfs_root}"
    
      121	unsquashfs -no-xattrs -d "${squashfs_root}" "${squashfs}" > /dev/null || return 1
    
      122	[[ -f "${squashfs_root}/usr/lib/os-release" ]] || return 1
    
      123
    
      124	printf '%s\n' 'check: staged package payload'
    
      125	rm -rf -- "${package_root}"
    
      126	_install_payload "${package_root}"
    
      127	_check_payload "${package_root}"
    
      128}
    
      129
    
      130package() {
    
      131	_install_payload "${pkgdir}"
    
      132	_check_payload "${pkgdir}" true
    
      133}
    
      134

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 00:03:17	Clean	2
2026-09-15 23:20:44	Low	1