llama.cpp-cuda-aidock-bin

maintainer mdrv · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Prebuilt binaries come from the project's own GitHub releases (ai-dock/llama.cpp-cuda) and NVIDIA's official redist servers, all with explicit sha256 checksums; the non-standard host flagged is developer.download.nvidia.com which is NVIDIA's legitimate distribution infrastructure, so no meaningful supply-chain risk beyond trusting a third-party prebuilt.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Prebuilt binaries come from the project's own GitHub releases (ai-dock/llama.cpp-cuda) and NVIDIA's official redist servers, all with explicit sha256 checksums; the non-standard host flagged is developer.download.nvidia.com which is NVIDIA's legitimate distribution infrastructure, so no meaningful supply-chain risk beyond trusting a third-party prebuilt.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/cuda_cudart/linux-x86_64/cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Umar Alfarouk <medrivia@gmail.com>
    
      2
    
      3_pkgname=llama.cpp-cuda
    
      4pkgname=${_pkgname}-aidock-bin
    
      5pkgver=b10423
    
      6pkgrel=1
    
      7pkgdesc='Prebuilt llama.cpp with CUDA 12.8 support (from ai-dock CI)'
    
      8arch=(x86_64 aarch64)
    
      9url='https://github.com/ai-dock/llama.cpp-cuda'
    
      10license=(MIT BSD-3-Clause LicenseRef-NVIDIA-CUDA)
    
      11depends=('openssl' 'nvidia-utils' 'libgomp' 'libstdc++' 'libgcc')
    
      12provides=("$_pkgname=$pkgver")
    
      13conflicts=("$_pkgname" "${_pkgname}-git")
    
      14makedepends=(patchelf)
    
      15# All ELF files below are prebuilt and already stripped upstream
    
      16options=('!strip' '!debug')
    
      17# CUDA 12.8 runtime (cudart, cublas, nccl) is bundled from NVIDIA's
    
      18# official redist server: Arch 'cuda' is 13.x and no longer provides
    
      19# the .so.12 sonames these binaries were linked against.
    
      20source=(LICENSE-ai-dock-$pkgver::https://raw.githubusercontent.com/ai-dock/llama.cpp-cuda/$pkgver/LICENSE
    
      21        LICENSE-llama.cpp-$pkgver::https://raw.githubusercontent.com/ggml-org/llama.cpp/$pkgver/LICENSE)
    
      22source_x86_64=(llama.cpp-$pkgver-cuda-12.8-amd64.tar.gz::https://github.com/ai-dock/llama.cpp-cuda/releases/download/$pkgver/llama.cpp-$pkgver-cuda-12.8-amd64.tar.gz
    
      23               cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/cuda_cudart/linux-x86_64/cuda_cudart-linux-x86_64-12.8.90-archive.tar.xz
    
      24               libcublas-linux-x86_64-12.8.4.1-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/libcublas/linux-x86_64/libcublas-linux-x86_64-12.8.4.1-archive.tar.xz
    
      25               nccl_2.26.2-1+cuda12.8_x86_64.txz::https://developer.download.nvidia.com/compute/redist/nccl/v2.26.2/nccl_2.26.2-1+cuda12.8_x86_64.txz)
    
      26source_aarch64=(llama.cpp-$pkgver-cuda-12.8-arm64.tar.gz::https://github.com/ai-dock/llama.cpp-cuda/releases/download/$pkgver/llama.cpp-$pkgver-cuda-12.8-arm64.tar.gz
    
      27                cuda_cudart-linux-sbsa-12.8.90-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/cuda_cudart/linux-sbsa/cuda_cudart-linux-sbsa-12.8.90-archive.tar.xz
    
      28                libcublas-linux-sbsa-12.8.4.1-archive.tar.xz::https://developer.download.nvidia.com/compute/cuda/redist/libcublas/linux-sbsa/libcublas-linux-sbsa-12.8.4.1-archive.tar.xz
    
      29                nccl_2.26.2-1+cuda12.8_aarch64.txz::https://developer.download.nvidia.com/compute/redist/nccl/v2.26.2/nccl_2.26.2-1+cuda12.8_aarch64.txz)
    
      30sha256sums=('fe82a992d2a88e45746b062aea4d03912da24cde707446cef1f8fd08e38a05ad'
    
      31            '94f29bbed6a22c35b992c5c6ebf0e7c92f13b836b90f36f461c9cf2f0f1d010d')
    
      32sha256sums_x86_64=('3ccddfdc1f3ecdeaa879463a79ae02bf2f9ee48ab797fb850ff766ae0cb55c41'
    
      33                   '8d566b5fe745c46842dc16945cf36686227536decd2302c372be86da37faca68'
    
      34                   '21718957c2cf000bacd69d36c95708a2319199e39e056f8b4f0f68e3b9f323bb'
    
      35                   '669434a7a2e4f6f99d6969f0a4de7bf12a26d3873bbbd84f1a7bd05e1cd6e45e')
    
      36sha256sums_aarch64=('c6554e5e6c0c95b48dc8c401269a1f25bc8619a1a0a21acbd8bae144041bb313'
    
      37                    '9e54c6686b193efa9642e7f6609ce78b064c5d576946478bcff4c024e1acdea7'
    
      38                    '429803c0ea8aec1db0050f7bfd807d519e22c9bf223c19000d6018d930741028'
    
      39                    '250a1bb323df4565bf6936dbacf6c20022deaf841c41b3a5c38c7963a9665050')
    
      40
    
      41package() {
    
      42    local _libdir="$pkgdir/usr/lib/$_pkgname"
    
      43    install -dm755 "$_libdir" "$pkgdir/usr/bin" "$pkgdir/usr/share/licenses/$pkgname"
    
      44
    
      45    cp -a "$srcdir"/cuda-12.8/. "$_libdir/"
    
      46
    
      47    cp -a "$srcdir"/cuda_cudart-linux-*-archive/lib/libcudart.so.12* "$_libdir/"
    
      48    cp -a "$srcdir"/libcublas-linux-*-archive/lib/libcublas.so.12* "$_libdir/"
    
      49    cp -a "$srcdir"/libcublas-linux-*-archive/lib/libcublasLt.so.12* "$_libdir/"
    
      50
    
      51    local _nccl_dir
    
      52    _nccl_dir=$(find "$srcdir" -maxdepth 1 -type d -name 'nccl_*' | head -1)
    
      53    cp -a "$_nccl_dir"/lib/libnccl.so.2* "$_libdir/"
    
      54
    
      55    find "$_libdir" -maxdepth 1 -type f \( -perm -u+x -o -name '*.so*' \) \
    
      56        -exec patchelf --set-rpath '$ORIGIN' {} \;
    
      57
    
      58    for _f in "$_libdir"/llama*; do
    
      59        [[ -f $_f && -x $_f ]] || continue
    
      60        ln -s /usr/lib/$_pkgname/"$(basename "$_f")" "$pkgdir/usr/bin/$(basename "$_f")"
    
      61    done
    
      62
    
      63    cp "$srcdir"/LICENSE-ai-dock-$pkgver "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      64    cp "$srcdir"/LICENSE-llama.cpp-$pkgver "$pkgdir/usr/share/licenses/$pkgname/LICENSE.llama.cpp"
    
      65    install -Dm644 "$srcdir"/cuda_cudart-linux-*-archive/LICENSE \
    
      66        "$pkgdir/usr/share/licenses/$pkgname/LICENSE.nvidia-cuda-eula"
    
      67    install -Dm644 "$_nccl_dir"/LICENSE.txt \
    
      68        "$pkgdir/usr/share/licenses/$pkgname/LICENSE.nccl"
    
      69    cp "$srcdir"/LICENSE-llama.cpp-$pkgver "$pkgdir/usr/share/licenses/$pkgname/LICENSE.llama.cpp"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 13:34:03	LOW	3
2026-08-15 13:30:33	MEDIUM	2