llama-prism-cuda-git

LOW

maintainer rumatoest 1 votes scanned 2026-11-04 20:11:01.549371

View on AUR

Why flagged

The package clones from the project's own GitHub repository (PrismML-Eng/llama.cpp) at a specific tag using a custom shallow-clone DLAGENT workaround; the SKIP checksum is expected for a git clone, the bundled service files have proper checksums, and the build process is straightforward CMake+npm with no obfuscated payloads or exfiltration — the only concern is the unconventional DLAGENT trick and low vote count, not any actual malicious behaviour.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The package clones from the project's own GitHub repository (PrismML-Eng/llama.cpp) at a specific tag using a custom shallow-clone DLAGENT workaround; the SKIP checksum is expected for a git clone, the bundled service files have proper checksums, and the build process is straightforward CMake+npm with no obfuscated payloads or exfiltration — the only concern is the unconventional DLAGENT trick and low vote count, not any actual malicious behaviour.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 source=( "shallow_git://llama.cpp" llama-server-system.service llama-server-user.service)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rumato Estorsky <@rumatoest at x.com>
    
      2
    
      3pkgname=llama-prism-cuda-git
    
      4pkgrel=1
    
      5pkgver="0.0.0_b12128_d7b2896"
    
      6_tag="prism-b10831-9d9efea"
    
      7pkgdesc='PrismML fork of llama.cpp with Ternary Bonsai models support. Build from sources with CUDA.'
    
      8arch=(x86_64)
    
      9url=https://github.com/PrismML-Eng/llama.cpp
    
      10license=(MIT)
    
      11depends=(
    
      12  cuda
    
      13  glibc
    
      14  libgcc
    
      15  libstdc++
    
      16  openssl
    
      17)
    
      18conflicts=(llama-cpp)
    
      19provides=(llama-cpp)
    
      20replaces=(
    
      21  llama-cpp-rocm
    
      22  llama-cpp-vulkan
    
      23)
    
      24makedepends=(
    
      25  cmake
    
      26  git
    
      27  ninja
    
      28  npm
    
      29)
    
      30
    
      31# Git repo size is huge.
    
      32# Need to download only exact commit but AUR tools are not allowing me to do that.
    
      33# This is a workaround to clone with depth=1
    
      34DLAGENTS=("shallow_git::/usr/bin/git clone --depth 1 --single-branch --branch ${_tag} https://github.com/PrismML-Eng/llama.cpp.git")
    
      35
    
      36source=( "shallow_git://llama.cpp" llama-server-system.service llama-server-user.service)
    
      37
    
      38sha256sums=(
    
      39    'SKIP'
    
      40    'fe37e0856db64877ace4164a51880e643776cdb8e43cc279bf500f42258dbc2a'
    
      41    '4a68f8a040532adb222fb0eeb8046fc553df7879200b6f6bd0cbe5cd3635accf'
    
      42)
    
      43
    
      44prepare() {
    
      45  # The custom DLAGENT leave a folder literally named "shallow_git:"
    
      46  # (trailing colon) instead of the expected "llama.cpp".
    
      47  # echo "PREPARE ${srcdir}"
    
      48  # pwd
    
      49  if [[ -d "${startdir}/shallow_git:" ]]; then
    
      50    rm -rf "${srcdir}/llama.cpp" 
    
      51    mv "${startdir}/shallow_git:/llama.cpp" "${srcdir}"
    
      52    rmdir "${startdir}/shallow_git:"
    
      53  fi
    
      54}
    
      55
    
      56build() {
    
      57  pushd "./llama.cpp/tools/ui"
    
      58  npm ci --ignore-scripts
    
      59  npm run build
    
      60  popd
    
      61
    
      62  cmake -S ./llama.cpp -B build -G Ninja \
    
      63      -DCMAKE_BUILD_TYPE=None \
    
      64      -DCMAKE_INSTALL_PREFIX=/usr \
    
      65      -DLLAMA_BUILD_APP=OFF \
    
      66      -DLLAMA_BUILD_EXAMPLES=ON \
    
      67      -DLLAMA_BUILD_SERVER=ON \
    
      68      -DLLAMA_BUILD_TESTS=OFF \
    
      69      -DLLAMA_BUILD_TOOLS=ON \
    
      70      -DLLAMA_BUILD_UI=ON \
    
      71      -DGGML_CUDA=ON 
    
      72      # -DGGML_CUDA=ON -DCMAKE_CUDA_ARCHITECTURES=75 #for rtx 20 series
    
      73      # -DGGML_CUDA=ON -DCMAKE_CUDA_ARCHITECTURES=86 #for rtx 30 series
    
      74      # -DGGML_CUDA=ON -DCMAKE_CUDA_ARCHITECTURES=89 #for rtx 40 series
    
      75      # -DGGML_CUDA=ON -DCMAKE_CUDA_ARCHITECTURES="130;140" #for rtx 60 series
    
      76
    
      77  cmake --build build
    
      78}
    
      79
    
      80package() {
    
      81  DESTDIR="${pkgdir}" cmake --install build
    
      82  install -Dm 644 llama.cpp/LICENSE -t "${pkgdir}"/usr/share/licenses/${pkgname}
    
      83  install -Dm 644 llama-server-system.service "${pkgdir}"/usr/lib/systemd/system/llama-server.service
    
      84  install -Dm 644 llama-server-user.service "${pkgdir}"/usr/lib/systemd/user/llama-server.service
    
      85  sed -i "s/%PKGVER%/$pkgver/g" "${pkgdir}"/usr/lib/systemd/*/llama-server.service
    
      86  mkdir -p "${pkgdir}"/usr/share/llama/models
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-04 20:11:01	Low	3
2026-11-04 20:08:04	Medium	2