llama-prism-cuda

MEDIUM

maintainer rumatoest 0 votes scanned 2026-09-19 19:30:45.969940

View on AUR

Why flagged

The package installs prebuilt binaries from a GitHub release without a verifiable build process, creating a supply-chain risk if the release asset is tampered with or swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs prebuilt binaries from a GitHub release without a verifiable build process, creating a supply-chain risk if the release asset is tampered with or swapped.

PKGBUILD

      1# Maintainer: Rumato Estorsky <@rumatoest at x.com>
    
      2pkgname=llama-prism-cuda
    
      3pkgdesc="PrismML fork of llama.cpp with CUDA support to run Ternary Bonsai LLM models."
    
      4url="https://github.com/PrismML-Eng/llama.cpp"
    
      5pkgrel=1
    
      6arch=('x86_64')
    
      7license=('MIT')
    
      8
    
      9pkgver="0.0.1_b10709_9a9394a"
    
      10_tag="prism-b10709-9a9394a"
    
      11_asset="llama-${_tag}-bin-linux-cuda-13.3-x64.tar.gz"
    
      12_source="${pkgname}_${_tag}"
    
      13
    
      14depends=('glibc' 'libgcc' 'libstdc++' 'cuda')
    
      15conflicts=('llama-cpp' 'llama-cpp-git' 'ggml' 'ggml-cuda')
    
      16provides=('llama-cpp')
    
      17
    
      18source=("${_source}.tar.gz::${url}/releases/download/${_tag}/${_asset}")
    
      19sha256sums=('7e01a434e513b373026c347cd008502ab04f6307d1cab71fcd4cea212b4fdbb0')
    
      20
    
      21package() {
    
      22  cd "${srcdir}/llama-${_tag}"
    
      23
    
      24  install -d "${pkgdir}/usr/lib"
    
      25  cp -a lib*.so* "${pkgdir}/usr/lib/"
    
      26
    
      27  install -d "${pkgdir}/usr/bin"
    
      28  for f in *; do
    
      29    [[ $f == lib*.so* || $f == LICENSE || $f == *.tar.gz ]] && continue
    
      30    [[ -f $f ]] || continue
    
      31    install -Dm755 "$f" "${pkgdir}/usr/bin/$f"
    
      32  done
    
      33
    
      34  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-19 19:30:45	Medium	2