linux-libre

maintainer dbermond · 41 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads kernel source and patches from the official FSFLA host (linux-libre.fsfla.org) and logos from Parabola's repo; these are legitimate project sources despite not being on a standard whitelist, and the content is source code and non-executable data.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads kernel source and patches from the official FSFLA host (linux-libre.fsfla.org) and logos from Parabola's repo; these are legitimate project sources despite not being on a standard whitelist, and the content is source code and non-executable data.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:42 source=("https://linux-libre.fsfla.org/pub/linux-libre/releases/${_basever}-gnu/linux-libre-${_basever}-gnu.tar.lz"{,.sign}
PKGBUILD:44 'https://repo.parabola.nu/other/linux-libre/logos/logo_linux_'{clut224.ppm,vga16.ppm,mono.pbm}{,.sig})

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer : Daniel Bermond <dbermond@archlinux.org>
    
      2# Contributor: Jonas Heinrich <onny@project-insanity.org>
    
      3# Contributor: André Silva <emulatorman@riseup.net>
    
      4# Contributor: Márcio Silva <coadde@riseup.net>
    
      5# Contributor (Parabola): Nicolás Reynolds <fauno@kiwwwi.com.ar>
    
      6# Contributor (Parabola): Sorin-Mihai Vârgolici <smv@yobicore.org>
    
      7# Contributor (Parabola): Michał Masłowski <mtjm@mtjm.eu>
    
      8# Contributor (Parabola): Luke Shumaker <lukeshu@sbcglobal.net>
    
      9# Contributor (Parabola): Luke R. <g4jc@openmailbox.org>
    
      10
    
      11pkgbase=linux-libre
    
      12pkgver=7.1.8
    
      13pkgrel=1
    
      14pkgdesc='Linux Libre'
    
      15url='https://linux-libre.fsfla.org/'
    
      16arch=(x86_64)
    
      17license=(GPL-2.0-only)
    
      18makedepends=(
    
      19  bc
    
      20  cpio
    
      21  gettext
    
      22  libelf
    
      23  pahole
    
      24  perl
    
      25  python
    
      26  rust
    
      27  rust-bindgen
    
      28  rust-src
    
      29  tar
    
      30  xz
    
      31
    
      32  # htmldocs
    
      33  graphviz
    
      34  imagemagick
    
      35  python-sphinx
    
      36  python-yaml
    
      37  texlive-latexextra
    
      38)
    
      39options=('!debug' '!strip')
    
      40_basever="$({ grep -Eq '[0-9]\.[0-9]+\.[0-9]+' <<< "$pkgver" && printf '%s' "${pkgver%.*}"; } || printf '%s' "$pkgver")"
    
      41_srcname="linux-${_basever}"
    
      42source=("https://linux-libre.fsfla.org/pub/linux-libre/releases/${_basever}-gnu/linux-libre-${_basever}-gnu.tar.lz"{,.sign}
    
      43        "http://linux-libre.fsfla.org/pub/linux-libre/releases/${pkgver}-gnu/patch-${_basever}-gnu-${pkgver}-gnu.bz2"{,.sign}
    
      44        'https://repo.parabola.nu/other/linux-libre/logos/logo_linux_'{clut224.ppm,vga16.ppm,mono.pbm}{,.sig})
    
      45source_x86_64=('config.x86_64')
    
      46sha256sums=('079be5a42b106bce2d53a6c746c381a678df1c289a432682cc05e5e88ddc347a'
    
      47            'SKIP'
    
      48            '4d90f16e24555e7c00b16d134dbd50fb3f9d11ca390cca8ca0c2bcf4e1cac5c6'
    
      49            'SKIP'
    
      50            'bfd4a7f61febe63c880534dcb7c31c5b932dde6acf991810b41a939a93535494'
    
      51            'SKIP'
    
      52            '6de8a8319271809ffdb072b68d53d155eef12438e6d04ff06a5a4db82c34fa8a'
    
      53            'SKIP'
    
      54            '13bd7a8d9ed6b6bc971e4cd162262c5a20448a83796af39ce394d827b0e5de74'
    
      55            'SKIP')
    
      56sha256sums_x86_64=('c059027c4905474962a217100032866d826c671cf59189a789990278c6da3132')
    
      57b2sums=('90d77b4eed1538a549c7f5d72f9ccc4523ebf9bfe6fb6bdc25181832eeaf0249d67a5cc83aa79f8d4ed155c988ebce81bc2cc06487f8c718893441043214762e'
    
      58        'SKIP'
    
      59        'e80d12d6c438044b711f6a66f804ed0679a569b57aec8fb95e9e668ae2610e1a4a18c144c33a0c5f6875f257ec8f50552adb282612141a61401a17a77c6aa947'
    
      60        'SKIP'
    
      61        '73fee2ae5cb1ffd3e6584e56da86a8b1ff6c713aae54d77c0dab113890fc673dc5f300eb9ed93fb367b045ece8fa80304ff277fe61665eccf7b7ce24f0c045eb'
    
      62        'SKIP'
    
      63        'd02a1153a4285b32c774dca4560fe37907ccf30b8e487a681b717ed95ae9bed5988875c0a118938e5885ae9d2857e53a6f216b732b6fa3368e3c5fe08c86382c'
    
      64        'SKIP'
    
      65        '580911af9431c066bbc072fd22d5e2ef65f12d8358cec5ff5a4f1b7deebb86cef6b5c1ad631f42350af72c51d44d2093c71f761234fb224a8b9dbb3b64b8201d'
    
      66        'SKIP')
    
      67b2sums_x86_64=('30fba18ef10bd6da080ae9f7cd7c9c77f0ade7b59fb98cc2a3638799d0340b50d8d58511011cbffe202286d8f95547219d1c46e3214473d358f6e5236d945485')
    
      68validpgpkeys=('474402C8C582DAFBE389C427BCB7CF877E7D47A7'  # Alexandre Oliva
    
      69              '6DB9C4B4F0D8C0DC432CF6E4227CA7C556B2BA78') # David P.
    
      70
    
      71export KBUILD_BUILD_HOST=archlinux
    
      72export KBUILD_BUILD_USER=$pkgbase
    
      73export KBUILD_BUILD_TIMESTAMP="$(date -Ru${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH})"
    
      74
    
      75prepare() {
    
      76  cd "$_srcname"
    
      77
    
      78  # freedo boot logo
    
      79  install -m644 -t drivers/video/logo ../logo_linux_{clut224.ppm,vga16.ppm,mono.pbm}
    
      80
    
      81  echo "Setting version..."
    
      82  echo "-$pkgrel" > localversion.10-pkgrel
    
      83  echo "${pkgbase#linux}" > localversion.20-pkgname
    
      84  sed -i 's|^-libre||'      localversion.20-pkgname # minimize diff
    
      85
    
      86  local _src
    
      87  for _src in "${source[@]}"
    
      88  do
    
      89    _src="${_src%%::*}"
    
      90    _src="${_src##*/}"
    
      91    _src="${_src%*.bz2}"
    
      92    [[ "$_src" = *.patch ]] || { [[ "$_src" = patch-* ]] && [[ "$_src" != *.sign ]]; } || continue
    
      93    echo "Applying patch $_src..."
    
      94    patch -Np1 < "../$_src"
    
      95  done
    
      96
    
      97  echo "Setting config..."
    
      98  cp "../config.${CARCH}" .config
    
      99  make olddefconfig
    
      100  diff -u "../config.${CARCH}" .config || :
    
      101
    
      102  make -s kernelrelease > version
    
      103  echo "Prepared $pkgbase version $(<version)"
    
      104}
    
      105
    
      106build() {
    
      107  make -C "$_srcname" htmldocs SPHINXOPTS='-QT' all
    
      108  make -C "${_srcname}/tools/bpf/bpftool" vmlinux.h feature-clang-bpf-co-re='1'
    
      109}
    
      110
    
      111_package() {
    
      112  pkgdesc="The $pkgdesc kernel and modules"
    
      113  depends=(
    
      114    coreutils
    
      115    initramfs
    
      116    kmod
    
      117  )
    
      118  optdepends=(
    
      119    "${pkgbase}-headers: headers and scripts for building modules"
    
      120    'linux-firmware: firmware images needed for some devices'
    
      121    'scx-scheds: to use sched-ext schedulers'
    
      122    'wireless-regdb: to set the correct wireless channels of your country'
    
      123  )
    
      124  provides=(
    
      125    KSMBD-MODULE
    
      126    NTSYNC-MODULE
    
      127    VIRTUALBOX-GUEST-MODULES
    
      128    WIREGUARD-MODULE
    
      129  )
    
      130  replaces=(
    
      131    virtualbox-guest-modules-arch
    
      132    wireguard-arch
    
      133  )
    
      134
    
      135  cd "$_srcname"
    
      136  local _modulesdir="$pkgdir/usr/lib/modules/$(<version)"
    
      137
    
      138  echo "Installing boot image..."
    
      139  # systemd expects to find the kernel here to allow hibernation
    
      140  # https://github.com/systemd/systemd/commit/edda44605f06a41fb86b7ab8128dcf99161d2344
    
      141  install -Dm644 "$(make -s image_name)" "$_modulesdir/vmlinuz"
    
      142
    
      143  # Used by mkinitcpio to name the kernel
    
      144  echo "$pkgbase" | install -Dm644 /dev/stdin "$_modulesdir/pkgbase"
    
      145
    
      146  echo "Installing modules..."
    
      147  ZSTD_CLEVEL=19 make INSTALL_MOD_PATH="$pkgdir/usr" INSTALL_MOD_STRIP=1 \
    
      148    DEPMOD=/doesnt/exist modules_install  # Suppress depmod
    
      149
    
      150  # remove build link
    
      151  rm "$_modulesdir"/build
    
      152}
    
      153
    
      154_package-headers() {
    
      155  pkgdesc="Headers and scripts for building modules for the $pkgdesc kernel"
    
      156  depends=(pahole)
    
      157  provides=(LINUX-HEADERS)
    
      158
    
      159  cd "$_srcname"
    
      160  local _builddir="$pkgdir/usr/lib/modules/$(<version)/build"
    
      161
    
      162  local _karch
    
      163  case "$CARCH" in
    
      164    x86_64) _karch='x86' ;;
    
      165    *) echo "Unknown CARCH ${CARCH}"; exit 1 ;;
    
      166  esac
    
      167
    
      168  echo "Installing build files..."
    
      169  install -Dt "$_builddir" -m644 .config Makefile Module.symvers System.map \
    
      170    localversion.* version vmlinux tools/bpf/bpftool/vmlinux.h
    
      171  install -Dt "$_builddir/kernel" -m644 kernel/Makefile
    
      172  install -Dt "$_builddir/arch/${_karch}" -m644 "arch/${_karch}/Makefile"
    
      173  cp -t "$_builddir" -a scripts
    
      174  ln -srt "$_builddir" "$_builddir/scripts/gdb/vmlinux-gdb.py"
    
      175
    
      176  if [[ "$(scripts/config -s CONFIG_HAVE_STACK_VALIDATION)" = 'y' ]]; then
    
      177    install -Dt "${_builddir}/tools/objtool" tools/objtool/objtool
    
      178  fi
    
      179
    
      180  if [[ "$(scripts/config -s CONFIG_DEBUG_INFO_BTF_MODULES)" = 'y' ]]; then
    
      181    install -Dt "${_builddir}/tools/bpf/resolve_btfids" tools/bpf/resolve_btfids/resolve_btfids
    
      182  fi
    
      183
    
      184  echo "Installing headers..."
    
      185  cp -t "$_builddir" -a include
    
      186  cp -t "$_builddir/arch/${_karch}" -a "arch/${_karch}/include"
    
      187  install -Dt "$_builddir/arch/${_karch}/kernel" -m644 "arch/${_karch}/kernel/asm-offsets.s"
    
      188
    
      189  install -Dt "$_builddir/drivers/md" -m644 drivers/md/*.h
    
      190  install -Dt "$_builddir/net/mac80211" -m644 net/mac80211/*.h
    
      191
    
      192  # https://bugs.archlinux.org/task/13146
    
      193  install -Dt "$_builddir/drivers/media/i2c" -m644 drivers/media/i2c/msp3400-driver.h
    
      194
    
      195  # https://bugs.archlinux.org/task/20402
    
      196  install -Dt "$_builddir/drivers/media/usb/dvb-usb" -m644 drivers/media/usb/dvb-usb/*.h
    
      197  install -Dt "$_builddir/drivers/media/dvb-frontends" -m644 drivers/media/dvb-frontends/*.h
    
      198  install -Dt "$_builddir/drivers/media/tuners" -m644 drivers/media/tuners/*.h
    
      199
    
      200  # https://bugs.archlinux.org/task/71392
    
      201  install -Dt "$_builddir/drivers/iio/common/hid-sensors" -m644 drivers/iio/common/hid-sensors/*.h
    
      202
    
      203  echo "Installing KConfig files..."
    
      204  find . -name 'Kconfig*' -exec install -Dm644 {} "$_builddir/{}" \;
    
      205
    
      206  echo "Installing Rust files..."
    
      207  if [[ "$(scripts/config -s CONFIG_RUST)" = 'y' ]]; then
    
      208    install -Dt "${_builddir}/rust" -m644 rust/*.rmeta
    
      209    install -Dt "${_builddir}/rust" rust/*.so
    
      210  fi
    
      211
    
      212  echo "Installing unstripped VDSO..."
    
      213  make INSTALL_MOD_PATH="${pkgdir}/usr" vdso_install \
    
      214    link=  # Suppress build-id symlinks
    
      215
    
      216  echo "Removing unneeded architectures..."
    
      217  local arch
    
      218  for arch in "$_builddir"/arch/*/; do
    
      219    [[ $arch = */"${_karch}/" ]] && continue
    
      220    echo "Removing $(basename "$arch")"
    
      221    rm -r "$arch"
    
      222  done
    
      223
    
      224  echo "Removing documentation..."
    
      225  rm -r "$_builddir/Documentation"
    
      226
    
      227  echo "Removing broken symlinks..."
    
      228  find -L "$_builddir" -type l -printf 'Removing %P\n' -delete
    
      229
    
      230  echo "Removing loose objects..."
    
      231  find "$_builddir" -type f -name '*.o' -printf 'Removing %P\n' -delete
    
      232
    
      233  echo "Stripping build tools..."
    
      234  local file
    
      235  while read -rd '' file; do
    
      236    case "$(file -Sib "$file")" in
    
      237      application/x-sharedlib\;*)      # Libraries (.so)
    
      238        strip -v $STRIP_SHARED "$file" ;;
    
      239      application/x-archive\;*)        # Libraries (.a)
    
      240        strip -v $STRIP_STATIC "$file" ;;
    
      241      application/x-executable\;*)     # Binaries
    
      242        strip -v $STRIP_BINARIES "$file" ;;
    
      243      application/x-pie-executable\;*) # Relocatable binaries
    
      244        strip -v $STRIP_SHARED "$file" ;;
    
      245    esac
    
      246  done < <(find "$_builddir" -type f -perm -u+x ! -name vmlinux -print0)
    
      247
    
      248  echo "Stripping vmlinux..."
    
      249  strip -v $STRIP_STATIC "$_builddir/vmlinux"
    
      250
    
      251  echo "Adding symlink..."
    
      252  mkdir -p "$pkgdir/usr/src"
    
      253  ln -sr "$_builddir" "$pkgdir/usr/src/$pkgbase"
    
      254}
    
      255
    
      256_package-docs() {
    
      257  pkgdesc="Documentation for the $pkgdesc kernel"
    
      258
    
      259  cd "$_srcname"
    
      260  local _builddir="$pkgdir/usr/lib/modules/$(<version)/build"
    
      261
    
      262  echo "Installing documentation..."
    
      263  local src dst
    
      264  while read -rd '' src; do
    
      265    dst="${src#Documentation/}"
    
      266    dst="$_builddir/Documentation/${dst#output/}"
    
      267    install -Dm644 "$src" "$dst"
    
      268  done < <(find Documentation -name '.*' -prune -o ! -type d -print0)
    
      269
    
      270  echo "Adding symlink..."
    
      271  mkdir -p "$pkgdir/usr/share/doc"
    
      272  ln -sr "$_builddir/Documentation" "$pkgdir/usr/share/doc/$pkgbase"
    
      273}
    
      274
    
      275pkgname=(
    
      276    "$pkgbase"
    
      277    "$pkgbase-headers"
    
      278    "$pkgbase-docs"
    
      279)
    
      280for _p in "${pkgname[@]}"; do
    
      281  eval "package_$_p() {
    
      282    $(declare -f "_package${_p#$pkgbase}")
    
      283    _package${_p#$pkgbase}
    
      284  }"
    
      285done
    
      286

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-18 00:03
@@ -9,7 +9,7 @@
 # Contributor (Parabola): Luke R. <g4jc@openmailbox.org>
 
 pkgbase=linux-libre
-pkgver=7.1.5
+pkgver=7.1.8
 pkgrel=1
 pkgdesc='Linux Libre'
 url='https://linux-libre.fsfla.org/'
@@ -45,7 +45,7 @@
 source_x86_64=('config.x86_64')
 sha256sums=('079be5a42b106bce2d53a6c746c381a678df1c289a432682cc05e5e88ddc347a'
             'SKIP'
-            '945f93de6ab7d9d66e700883cbec1f1b789a0207a654d2933f3abe2f43306044'
+            '4d90f16e24555e7c00b16d134dbd50fb3f9d11ca390cca8ca0c2bcf4e1cac5c6'
             'SKIP'
             'bfd4a7f61febe63c880534dcb7c31c5b932dde6acf991810b41a939a93535494'
             'SKIP'
@@ -53,10 +53,10 @@
             'SKIP'
             '13bd7a8d9ed6b6bc971e4cd162262c5a20448a83796af39ce394d827b0e5de74'
             'SKIP')
-sha256sums_x86_64=('cbcb95a3a6bcfffc892d51ef5c960fbb4be862c269dfb454866c8c016f82f302')
+sha256sums_x86_64=('c059027c4905474962a217100032866d826c671cf59189a789990278c6da3132')
 b2sums=('90d77b4eed1538a549c7f5d72f9ccc4523ebf9bfe6fb6bdc25181832eeaf0249d67a5cc83aa79f8d4ed155c988ebce81bc2cc06487f8c718893441043214762e'
         'SKIP'
-        'c73971a652fba798a1cbb81dd2aa773eec28fc920d58e2f8a152b96916686dff8041b9f35a92e202c9a2cc68dbe911955bc3cea66b35b255bc9210ed46a0a224'
+        'e80d12d6c438044b711f6a66f804ed0679a569b57aec8fb95e9e668ae2610e1a4a18c144c33a0c5f6875f257ec8f50552adb282612141a61401a17a77c6aa947'
         'SKIP'
         '73fee2ae5cb1ffd3e6584e56da86a8b1ff6c713aae54d77c0dab113890fc673dc5f300eb9ed93fb367b045ece8fa80304ff277fe61665eccf7b7ce24f0c045eb'
         'SKIP'
@@ -64,7 +64,7 @@
         'SKIP'
         '580911af9431c066bbc072fd22d5e2ef65f12d8358cec5ff5a4f1b7deebb86cef6b5c1ad631f42350af72c51d44d2093c71f761234fb224a8b9dbb3b64b8201d'
         'SKIP')
-b2sums_x86_64=('45b2092110071dc60cfb0bce1b1bb779e1cdc10ef87839dcd819ff863a2e6147c439f0b37a20f4f870aaecb3ad255130740306be6584ebad2c8b6409fddebc6c')
+b2sums_x86_64=('30fba18ef10bd6da080ae9f7cd7c9c77f0ade7b59fb98cc2a3638799d0340b50d8d58511011cbffe202286d8f95547219d1c46e3214473d358f6e5236d945485')
 validpgpkeys=('474402C8C582DAFBE389C427BCB7CF877E7D47A7'  # Alexandre Oliva
               '6DB9C4B4F0D8C0DC432CF6E4227CA7C556B2BA78') # David P.
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 01:22:13	MEDIUM	1
2026-07-27 00:24:32	CLEAN	2
2026-07-26 15:32:35	MEDIUM	1
2026-07-10 00:20:30	CLEAN	2
2026-07-09 23:33:03	MEDIUM	1
2026-06-28 20:33:42	CLEAN	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 17:53:10	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1