libvirt-iso-archlinux-bin
LOW
maintainer RubenKelevra
0 votes
scanned 2026-10-31 00:07:41.364992
Why flagged
The package downloads an official Arch Linux ISO from a known mirror (geo.mirror.pkgbuild.com), which is a legitimate source; the ISO is verified via PGP signature and extensive integrity checks, posing no real risk despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads an official Arch Linux ISO from a known mirror (geo.mirror.pkgbuild.com), which is a legitimate source; the ISO is verified via PGP signature and extensive integrity checks, posing no real risk despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
"${_pkgname}-${pkgver}-${CARCH}.iso::https://geo.mirror.pkgbuild.com/iso/${pkgver}/${_pkgname}-${pkgver}-${CARCH}.iso"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: @RubenKelevra <rubenkelevra@gmail.com>
2
3
_pkgname='archlinux'
4
pkgname="libvirt-iso-${_pkgname}-bin"
5
pkgver=2026.10.01
6
pkgrel=1
7
pkgdesc='Official Arch Linux installation ISO for libvirt'
8
arch=('x86_64')
9
url='https://archlinux.org/download/'
10
license=('LicenseRef-Various')
11
checkdepends=(
12
'libarchive'
13
'squashfs-tools'
14
)
15
source=(
16
"${_pkgname}-${pkgver}-${CARCH}.iso::https://geo.mirror.pkgbuild.com/iso/${pkgver}/${_pkgname}-${pkgver}-${CARCH}.iso"
17
"${_pkgname}-${pkgver}-${CARCH}.iso.sig::https://geo.mirror.pkgbuild.com/iso/${pkgver}/${_pkgname}-${pkgver}-${CARCH}.iso.sig"
18
'DISTRIBUTION-LICENSE'
19
)
20
noextract=("${_pkgname}-${pkgver}-${CARCH}.iso")
21
sha256sums=(
22
'684ded26c63240ff4a41e8c25ee84ea6da233f557364821f13d12c2b0a9059a5'
23
'SKIP'
24
'cb5f1ca3b96864dcbf26ef4792510c79eabd25a8988fd57e24fef4c02b278d4c'
25
)
26
validpgpkeys=('3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C')
27
28
_install_payload() {
29
local root="${1:?missing package root}"
30
local image="${_pkgname}-${pkgver}-${CARCH}.iso"
31
local image_dir="${root}/var/lib/libvirt/images"
32
33
install -Dm644 -- "${srcdir}/${image}" "${image_dir}/${image}"
34
ln -s -- "${image}" "${image_dir}/${_pkgname}-${CARCH}.iso"
35
install -Dm644 -- "${srcdir}/DISTRIBUTION-LICENSE" \
36
"${root}/usr/share/licenses/${pkgname}/LICENSE"
37
}
38
39
_check_payload() {
40
local root="${1:?missing package root}"
41
local check_owner="${2:-false}"
42
local image="${_pkgname}-${pkgver}-${CARCH}.iso"
43
local image_path="${root}/var/lib/libvirt/images/${image}"
44
local image_link="${root}/var/lib/libvirt/images/${_pkgname}-${CARCH}.iso"
45
local license_path="${root}/usr/share/licenses/${pkgname}/LICENSE"
46
local manifest
47
48
[[ -f "${image_path}" ]] || return 1
49
[[ -L "${image_link}" ]] || return 1
50
[[ "$(readlink -- "${image_link}")" == "${image}" ]] || return 1
51
[[ -f "${license_path}" ]] || return 1
52
[[ "$(stat -c '%a' -- "${image_path}")" == '644' ]] || return 1
53
[[ "$(stat -c '%a' -- "${license_path}")" == '644' ]] || return 1
54
[[ -z "$(find "${root}" -name '*.sig' -print -quit)" ]] || return 1
55
56
manifest="$(find "${root}" \( -type f -o -type l \) -printf '%P\n' | LC_ALL=C sort)"
57
[[ "${manifest}" == "$(printf '%s\n' \
58
"usr/share/licenses/${pkgname}/LICENSE" \
59
"var/lib/libvirt/images/${image}" \
60
"var/lib/libvirt/images/${_pkgname}-${CARCH}.iso" | LC_ALL=C sort)" ]] || return 1
61
62
if [[ "${check_owner}" == 'true' ]]; then
63
[[ "$(stat -c '%u:%g' -- "${image_path}")" == '0:0' ]] || return 1
64
[[ "$(stat -c '%u:%g' -- "${license_path}")" == '0:0' ]] || return 1
65
[[ "$(stat -c '%u:%g' -- "${image_link}")" == '0:0' ]] || return 1
66
fi
67
}
68
69
check() {
70
local image="${_pkgname}-${pkgver}-${CARCH}.iso"
71
local iso="${srcdir}/${image}"
72
local iso_listing="${srcdir}/check-iso-list"
73
local squashfs="${srcdir}/check-airootfs.sfs"
74
local squashfs_root="${srcdir}/check-squashfs-root"
75
local image_size
76
local pvd_type
77
local pvd_magic
78
local pvd_version
79
local volume_sectors
80
local required_path
81
82
printf '%s\n' 'check: ISO size and ISO9660 header'
83
image_size="$(stat -Lc '%s' -- "${iso}")" || return 1
84
(( image_size > 0 && image_size % 2048 == 0 )) || return 1
85
86
pvd_type="$(od -An -tu1 -j $((16 * 2048)) -N1 -- "${iso}" | tr -d ' ')" || return 1
87
pvd_magic="$(dd if="${iso}" bs=1 skip=$((16 * 2048 + 1)) count=5 status=none)" || return 1
88
pvd_version="$(od -An -tu1 -j $((16 * 2048 + 6)) -N1 -- "${iso}" | tr -d ' ')" || return 1
89
volume_sectors="$(od -An -tu4 -j $((16 * 2048 + 80)) -N4 -- "${iso}" | tr -d ' ')" || return 1
90
91
[[ "${pvd_type}" == '1' ]] || return 1
92
[[ "${pvd_magic}" == 'CD001' ]] || return 1
93
[[ "${pvd_version}" == '1' ]] || return 1
94
(( volume_sectors > 0 && volume_sectors * 2048 == image_size )) || return 1
95
96
printf '%s\n' 'check: file(1) ISO and bootability'
97
file -L --brief -- "${iso}" | grep -Fq 'ISO 9660' || return 1
98
file -L --brief -- "${iso}" | grep -Fq 'bootable' || return 1
99
100
printf '%s\n' 'check: ISO directory and required Arch files'
101
bsdtar -tf "${iso}" > "${iso_listing}" || return 1
102
for required_path in \
103
"arch/boot/${CARCH}/vmlinuz-linux" \
104
"arch/boot/${CARCH}/initramfs-linux.img" \
105
"arch/${CARCH}/airootfs.sfs" \
106
'EFI/BOOT/BOOTx64.EFI'; do
107
grep -Fxq -- "${required_path}" "${iso_listing}" || return 1
108
done
109
110
printf '%s\n' 'check: full ISO read'
111
# Read every regular file from the ISO so truncated extents or unreadable data fail.
112
bsdtar -xOf "${iso}" > /dev/null || return 1
113
114
printf '%s\n' 'check: SquashFS full decompression'
115
# The live root filesystem is itself SquashFS. Extracting it forces every
116
# compressed block to be decompressed, catching corruption hidden inside a
117
# structurally valid and correctly signed ISO.
118
bsdtar -xOf "${iso}" "arch/${CARCH}/airootfs.sfs" > "${squashfs}" || return 1
119
rm -rf -- "${squashfs_root}"
120
unsquashfs -no-xattrs -d "${squashfs_root}" "${squashfs}" > /dev/null || return 1
121
[[ -f "${squashfs_root}/usr/lib/os-release" ]] || return 1
122
123
}
124
125
package() {
126
_install_payload "${pkgdir}"
127
_check_payload "${pkgdir}" true
128
}
129
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |