llama.cpp-cuda-aidock-bin
LOW
maintainer mdrv
0 votes
scanned 2026-10-02 00:00:32.890515
Why flagged
The package installs prebuilt binaries from the project's official GitHub releases and NVIDIA's official redist servers; while the host is not universally whitelisted, the sources are verifiable and from legitimate project/vendor infrastructure, with no execution of remote code or obfuscated payloads.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs prebuilt binaries from the project's official GitHub releases and NVIDIA's official redist servers; while the host is not universally whitelisted, the sources are verifiable and from legitimate project/vendor infrastructure, with no execution of remote code or obfuscated payloads.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/cuda_cudart/linux-x86_64/cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Umar Alfarouk <medrivia@gmail.com>
2
3
_pkgname=llama.cpp-cuda
4
pkgname=${_pkgname}-aidock-bin
5
pkgver=0.4.1
6
pkgrel=1
7
pkgdesc='Prebuilt llama.cpp with CUDA 12.8 support (from ai-dock CI)'
8
arch=(x86_64 aarch64)
9
url='https://github.com/ai-dock/llama.cpp-cuda'
10
license=(MIT BSD-3-Clause LicenseRef-NVIDIA-CUDA)
11
depends=('openssl' 'nvidia-utils' 'libgomp' 'libstdc++' 'libgcc')
12
provides=("$_pkgname=$pkgver")
13
conflicts=("$_pkgname" "${_pkgname}-git")
14
makedepends=(patchelf)
15
# All ELF files below are prebuilt and already stripped upstream
16
options=('!strip' '!debug')
17
# CUDA 12.8 runtime (cudart, cublas, nccl) is bundled from NVIDIA's
18
# official redist server: Arch 'cuda' is 13.x and no longer provides
19
# the .so.12 sonames these binaries were linked against.
20
source=(LICENSE-ai-dock-$pkgver::https://raw.githubusercontent.com/ai-dock/llama.cpp-cuda/v$pkgver/LICENSE
21
LICENSE-llama.cpp-$pkgver::https://raw.githubusercontent.com/ggml-org/llama.cpp/v$pkgver/LICENSE)
22
source_x86_64=(llama.cpp-$pkgver-cuda-12.8-amd64.tar.gz::https://github.com/ai-dock/llama.cpp-cuda/releases/download/v$pkgver/llama.cpp-v$pkgver-cuda-12.8-amd64.tar.gz
23
cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/cuda_cudart/linux-x86_64/cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz
24
libcublas-linux-x86_64-12.8.4.1-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/libcublas/linux-x86_64/libcublas-linux-x86_64-12.8.4.1-archive.tar.xz
25
nccl_2.26.2-1+cuda12.8_x86_64.txz::https://developer.download.nvidia.com/compute/redist/nccl/v2.26.2/nccl_2.26.2-1+cuda12.8_x86_64.txz)
26
source_aarch64=(llama.cpp-$pkgver-cuda-12.8-arm64.tar.gz::https://github.com/ai-dock/llama.cpp-cuda/releases/download/v$pkgver/llama.cpp-v$pkgver-cuda-12.8-arm64.tar.gz
27
cuda_cudart-linux-sbsa-12.8.90-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/cuda_cudart/linux-sbsa/cuda_cudart-linux-sbsa-12.8.90-archive.tar.xz
28
libcublas-linux-sbsa-12.8.4.1-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/libcublas/linux-sbsa/libcublas-linux-sbsa-12.8.4.1-archive.tar.xz
29
nccl_2.26.2-1+cuda12.8_aarch64.txz::https://developer.download.nvidia.com/compute/redist/nccl/v2.26.2/nccl_2.26.2-1+cuda12.8_aarch64.txz)
30
sha256sums=('fe82a992d2a88e45746b062aea4d03912da24cde707446cef1f8fd08e38a05ad'
31
'94f29bbed6a22c35b992c5c6ebf0e7c92f13b836b90f36f461c9cf2f0f1d010d')
32
sha256sums_x86_64=('704a77d8ac099784186e2c1e767dc6da398eb4c150b5c7d41583f39dfb2cccdd'
33
'8d566b5fe745c46842dc16945cf36686227536decd2302c372be86da37faca68'
34
'21718957c2cf000bacd69d36c95708a2319199e39e056f8b4f0f68e3b9f323bb'
35
'669434a7a2e4f6f99d6969f0a4de7bf12a26d3873bbbd84f1a7bd05e1cd6e45e')
36
sha256sums_aarch64=('ac03ce9524ab20f2bf2081e4a221c6ee2eeb069a5c3c81171b1e9aa07b690c22'
37
'9e54c6686b193efa9642e7f6609ce78b064c5d576946478bcff4c024e1acdea7'
38
'429803c0ea8aec1db0050f7bfd807d519e22c9bf223c19000d6018d930741028'
39
'250a1bb323df4565bf6936dbacf6c20022deaf841c41b3a5c38c7963a9665050')
40
41
package() {
42
local _libdir="$pkgdir/usr/lib/$_pkgname"
43
install -dm755 "$_libdir" "$pkgdir/usr/bin" "$pkgdir/usr/share/licenses/$pkgname"
44
45
cp -a "$srcdir"/cuda-12.8/. "$_libdir/"
46
47
cp -a "$srcdir"/cuda_cudart-linux-*-archive/lib/libcudart.so.12* "$_libdir/"
48
cp -a "$srcdir"/libcublas-linux-*-archive/lib/libcublas.so.12* "$_libdir/"
49
cp -a "$srcdir"/libcublas-linux-*-archive/lib/libcublasLt.so.12* "$_libdir/"
50
51
local _nccl_dir
52
_nccl_dir=$(find "$srcdir" -maxdepth 1 -type d -name 'nccl_*' | head -1)
53
cp -a "$_nccl_dir"/lib/libnccl.so.2* "$_libdir/"
54
55
find "$_libdir" -maxdepth 1 -type f \( -perm -u+x -o -name '*.so*' \) \
56
-exec patchelf --set-rpath '$ORIGIN' {} \;
57
58
for _f in "$_libdir"/llama*; do
59
[[ -f $_f && -x $_f ]] || continue
60
ln -s /usr/lib/$_pkgname/"$(basename "$_f")" "$pkgdir/usr/bin/$(basename "$_f")"
61
done
62
63
cp "$srcdir"/LICENSE-ai-dock-$pkgver "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
64
cp "$srcdir"/LICENSE-llama.cpp-$pkgver "$pkgdir/usr/share/licenses/$pkgname/LICENSE.llama.cpp"
65
install -Dm644 "$srcdir"/cuda_cudart-linux-*-archive/LICENSE \
66
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.nvidia-cuda-eula"
67
install -Dm644 "$_nccl_dir"/LICENSE.txt \
68
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.nccl"
69
cp "$srcdir"/LICENSE-llama.cpp-$pkgver "$pkgdir/usr/share/licenses/$pkgname/LICENSE.llama.cpp"
70
}
71
Changes since previous scan
--- PKGBUILD @ 2026-09-24 00:24+++ PKGBUILD @ 2026-10-02 00:00@@ -2,7 +2,7 @@ _pkgname=llama.cpp-cuda pkgname=${_pkgname}-aidock-bin-pkgver=0.4.0+pkgver=0.4.1 pkgrel=1 pkgdesc='Prebuilt llama.cpp with CUDA 12.8 support (from ai-dock CI)' arch=(x86_64 aarch64)@@ -19,21 +19,21 @@ # the .so.12 sonames these binaries were linked against. source=(LICENSE-ai-dock-$pkgver::https://raw.githubusercontent.com/ai-dock/llama.cpp-cuda/v$pkgver/LICENSE LICENSE-llama.cpp-$pkgver::https://raw.githubusercontent.com/ggml-org/llama.cpp/v$pkgver/LICENSE)-source_x86_64=(llama.cpp-$pkgver-cuda-12.8-amd64.tar.gz::https://github.com/ai-dock/llama.cpp-cuda/releases/download/$pkgver/llama.cpp-$pkgver-cuda-12.8-amd64.tar.gz+source_x86_64=(llama.cpp-$pkgver-cuda-12.8-amd64.tar.gz::https://github.com/ai-dock/llama.cpp-cuda/releases/download/v$pkgver/llama.cpp-v$pkgver-cuda-12.8-amd64.tar.gz cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/cuda_cudart/linux-x86_64/cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz libcublas-linux-x86_64-12.8.4.1-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/libcublas/linux-x86_64/libcublas-linux-x86_64-12.8.4.1-archive.tar.xz nccl_2.26.2-1+cuda12.8_x86_64.txz::https://developer.download.nvidia.com/compute/redist/nccl/v2.26.2/nccl_2.26.2-1+cuda12.8_x86_64.txz)-source_aarch64=(llama.cpp-$pkgver-cuda-12.8-arm64.tar.gz::https://github.com/ai-dock/llama.cpp-cuda/releases/download/$pkgver/llama.cpp-$pkgver-cuda-12.8-arm64.tar.gz+source_aarch64=(llama.cpp-$pkgver-cuda-12.8-arm64.tar.gz::https://github.com/ai-dock/llama.cpp-cuda/releases/download/v$pkgver/llama.cpp-v$pkgver-cuda-12.8-arm64.tar.gz cuda_cudart-linux-sbsa-12.8.90-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/cuda_cudart/linux-sbsa/cuda_cudart-linux-sbsa-12.8.90-archive.tar.xz libcublas-linux-sbsa-12.8.4.1-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/libcublas/linux-sbsa/libcublas-linux-sbsa-12.8.4.1-archive.tar.xz nccl_2.26.2-1+cuda12.8_aarch64.txz::https://developer.download.nvidia.com/compute/redist/nccl/v2.26.2/nccl_2.26.2-1+cuda12.8_aarch64.txz) sha256sums=('fe82a992d2a88e45746b062aea4d03912da24cde707446cef1f8fd08e38a05ad' '94f29bbed6a22c35b992c5c6ebf0e7c92f13b836b90f36f461c9cf2f0f1d010d')-sha256sums_x86_64=('3ccddfdc1f3ecdeaa879463a79ae02bf2f9ee48ab797fb850ff766ae0cb55c41'+sha256sums_x86_64=('704a77d8ac099784186e2c1e767dc6da398eb4c150b5c7d41583f39dfb2cccdd' '8d566b5fe745c46842dc16945cf36686227536decd2302c372be86da37faca68' '21718957c2cf000bacd69d36c95708a2319199e39e056f8b4f0f68e3b9f323bb' '669434a7a2e4f6f99d6969f0a4de7bf12a26d3873bbbd84f1a7bd05e1cd6e45e')-sha256sums_aarch64=('c6554e5e6c0c95b48dc8c401269a1f25bc8619a1a0a21acbd8bae144041bb313'+sha256sums_aarch64=('ac03ce9524ab20f2bf2081e4a221c6ee2eeb069a5c3c81171b1e9aa07b690c22' '9e54c6686b193efa9642e7f6609ce78b064c5d576946478bcff4c024e1acdea7' '429803c0ea8aec1db0050f7bfd807d519e22c9bf223c19000d6018d930741028' '250a1bb323df4565bf6936dbacf6c20022deaf841c41b3a5c38c7963a9665050')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 19:44:16 | Medium | 1 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 11:28:26 | Medium | 1 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |