libvirt-iso-systemrescue-bin
LOW
maintainer RubenKelevra
0 votes
scanned 2026-10-22 13:37:44.441740
Why flagged
The ISO is downloaded from SystemRescue's own official CDN (fastly-cdn.system-rescue.org), GPG-verified against a pinned key fetched from the project's own domain, and the PKGBUILD performs thorough integrity checks; the only minor concern is SKIP'd checksums for the signature/key/license files, but the GPG verification and key fingerprint pinning compensate adequately — this is a legitimate packaging of an official recovery ISO.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The ISO is downloaded from SystemRescue's own official CDN (fastly-cdn.system-rescue.org), GPG-verified against a pinned key fetched from the project's own domain, and the PKGBUILD performs thorough integrity checks; the only minor concern is SKIP'd checksums for the signature/key/license files, but the GPG verification and key fingerprint pinning compensate adequately — this is a legitimate packaging of an official recovery ISO.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
"${_archive}.signature::https://www.system-rescue.org/releases/${pkgver}/${_archive}.asc"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: @RubenKelevra <rubenkelevra@gmail.com>
2
3
_pkgname='systemrescue'
4
pkgname='libvirt-iso-systemrescue-bin'
5
pkgver=13.02
6
pkgrel=1
7
pkgdesc='Official SystemRescue live recovery ISO for libvirt'
8
arch=('x86_64')
9
url='https://www.system-rescue.org/'
10
license=('LicenseRef-Various')
11
makedepends=('gnupg')
12
checkdepends=('libarchive')
13
_archive="${_pkgname}-${pkgver}-amd64.iso"
14
_iso="${_archive}"
15
_image="${_pkgname}-${pkgver}-${CARCH}.iso"
16
_link="${_pkgname}-${CARCH}.iso"
17
_base_url="https://fastly-cdn.system-rescue.org/releases/${pkgver}"
18
source=(
19
"${_archive}::${_base_url}/${_archive}"
20
"${_archive}.signature::https://www.system-rescue.org/releases/${pkgver}/${_archive}.asc"
21
"systemrescue-release-key.pem::https://www.system-rescue.org/security/signing-keys/gnupg-pubkey-fdupoux-20210704-v001.pem"
22
'DISTRIBUTION-LICENSE'
23
)
24
noextract=("${_archive}")
25
sha512sums=(
26
'76bd250b478cbfedf407c721a79270b1615f26ec486dbd7c8b78d7e1034853f2c31cc664752dce1678485bb1e7045167e5114802d5e28a84d29481854f8854b8'
27
'SKIP'
28
'SKIP'
29
'SKIP'
30
)
31
b2sums=(
32
'SKIP'
33
'1709f92610b9a2e2e20d7232065b2792036791ef2163c45b1f656eb783772b85bcadaa4cb875e4e7c8719acb7070450496c2454184e69af29353eefb9cefe639'
34
'a842fdcf8944a0d064e9b21f103ba3b29c74f9ab2024aa064b9ea2573b5329dc67e770a89154e6086e2e3dccd5fa4b809c24072ea079672f663b3b13f71c585f'
35
'49664b7a5aefd8e40cb9c41ea8d28d9df61d2d04067eeca446a24b6f6c6658eddcd87458cd3c9b58def7cd7aa80a35992217a8de12f37bb022785db1d11af445'
36
)
37
validpgpkeys=('0FF11AF081E98345594812037091115F8320B897')
38
39
40
_verify_pinned_key() {
41
local key_file="${1:?missing signing key}"
42
local expected="${2:?missing signing fingerprint}"
43
local fingerprint
44
45
fingerprint="$(gpg --batch --show-keys --with-colons "${key_file}" |
46
awk -F: '$1 == "fpr" {print $10; exit}')" || return 1
47
[[ "${fingerprint}" == "${expected}" ]] || return 1
48
gpg --batch --yes --dearmor --output "${srcdir}/release-key.gpg" "${key_file}"
49
}
50
51
prepare() {
52
_verify_pinned_key "${srcdir}/systemrescue-release-key.pem" '0FF11AF081E98345594812037091115F8320B897' || return 1
53
gpgv --keyring "${srcdir}/release-key.gpg" \
54
"${srcdir}/${_archive}.signature" "${srcdir}/${_archive}"
55
}
56
57
58
check() {
59
local iso="${srcdir}/${_iso}"
60
local size
61
local magic
62
local entry
63
local release
64
local image_info
65
66
size="$(stat -Lc '%s' -- "${iso}")" || return 1
67
(( size > 0 && size % 2048 == 0 )) || return 1
68
magic="$(dd if="${iso}" bs=1 skip=32769 count=5 status=none)" || return 1
69
[[ "${magic}" == 'CD001' ]] || return 1
70
file -L --brief -- "${iso}" | grep -Fq 'ISO 9660' || return 1
71
bsdtar -tf "${iso}" > "${srcdir}/check-iso-list" || return 1
72
for entry in \
73
'isolinux/isolinux.bin' \
74
'EFI/boot/bootx64.efi' \
75
'sysresccd/boot/x86_64/vmlinuz' \
76
'sysresccd/boot/x86_64/sysresccd.img' \
77
'sysresccd/x86_64/airootfs.sfs'; do
78
grep -Fxq "${entry}" "${srcdir}/check-iso-list" || return 1
79
done
80
81
release="$(bsdtar -xOf "${iso}" 'sysresccd/VERSION')" || return 1
82
[[ "${release}" == "${pkgver}" ]] || return 1
83
image_info="$(bsdtar -xOf "${iso}" 'sysresccd/.imageinfo')" || return 1
84
grep -Fxq 'NAME=SystemRescue' <<< "${image_info}" || return 1
85
grep -Fxq "VERSION=${pkgver}" <<< "${image_info}" || return 1
86
grep -Fxq "ARCH=${CARCH}" <<< "${image_info}" || return 1
87
bsdtar -xOf "${iso}" > /dev/null || return 1
88
}
89
90
_install_payload() {
91
local root="${1:?missing package root}"
92
local image_dir="${root}/var/lib/libvirt/images"
93
94
install -Dm644 -- "${srcdir}/${_iso}" "${image_dir}/${_image}" || return 1
95
ln -s -- "${_image}" "${image_dir}/${_link}" || return 1
96
install -Dm644 -- "${srcdir}/DISTRIBUTION-LICENSE" \
97
"${root}/usr/share/licenses/${pkgname}/LICENSE"
98
}
99
100
_check_payload() {
101
local root="${1:?missing package root}"
102
local check_owner="${2:-false}"
103
local image_path="${root}/var/lib/libvirt/images/${_image}"
104
local link_path="${root}/var/lib/libvirt/images/${_link}"
105
local license_path="${root}/usr/share/licenses/${pkgname}/LICENSE"
106
local manifest
107
108
[[ -f "${image_path}" && ! -L "${image_path}" ]] || return 1
109
[[ -L "${link_path}" ]] || return 1
110
[[ "$(readlink -- "${link_path}")" == "${_image}" ]] || return 1
111
[[ -f "${license_path}" ]] || return 1
112
[[ "$(stat -c '%a' -- "${image_path}")" == '644' ]] || return 1
113
[[ "$(stat -c '%a' -- "${license_path}")" == '644' ]] || return 1
114
manifest="$(find "${root}" \( -type f -o -type l \) -printf '%P\n' | LC_ALL=C sort)"
115
[[ "${manifest}" == "$(printf '%s\n' \
116
"usr/share/licenses/${pkgname}/LICENSE" \
117
"var/lib/libvirt/images/${_image}" \
118
"var/lib/libvirt/images/${_link}" | LC_ALL=C sort)" ]] || return 1
119
if [[ "${check_owner}" == 'true' ]]; then
120
[[ "$(stat -c '%u:%g' -- "${image_path}")" == '0:0' ]] || return 1
121
[[ "$(stat -c '%u:%g' -- "${license_path}")" == '0:0' ]] || return 1
122
[[ "$(stat -c '%u:%g' -- "${link_path}")" == '0:0' ]] || return 1
123
fi
124
}
125
126
package() {
127
_install_payload "${pkgdir}" || return 1
128
_check_payload "${pkgdir}" true
129
}
130
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-22 13:37:44 | Low | 3 |
| 2026-10-22 13:35:05 | Medium | 2 |