lustre-tools-6

maintainer mJolimaitre · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a pre-compiled binary toolchain from a university-hosted domain that is plausibly the official project site; while the host is not a standard forge, it matches the project's academic origin and the installed files are managed via wrapper scripts for correct environment setup, with no evidence of malicious behavior.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a pre-compiled binary toolchain from a university-hosted domain that is plausibly the official project site; while the host is not a standard forge, it matches the project's academic origin and the installed files are managed via wrapper scripts for correct environment setup, with no evidence of malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://www-verimag.imag.fr/DIST-TOOLS/SYNCHRONE/lustre-v6/pre-compiled/x86_64-Linux-lv6-bin-dist.tgz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: JOLIMAITRE Matthieu <matthieu@imagevo.fr>
    
      2pkgname="lustre-tools-6"
    
      3pkgver=6.112.5
    
      4pkgrel=1
    
      5pkgdesc="The Lustre developpment tools free distribution version 6."
    
      6url="https://www-verimag.imag.fr/DIST-TOOLS/SYNCHRONE/lustre-v4/distrib/"
    
      7arch=("x86_64")
    
      8license=("Free Distribution of the Lustre/Lesar Software")
    
      9makedepends=()
    
      10optdepends=()
    
      11depends=('findutils')
    
      12source=("https://www-verimag.imag.fr/DIST-TOOLS/SYNCHRONE/lustre-v6/pre-compiled/x86_64-Linux-lv6-bin-dist.tgz")
    
      13sha256sums=("04f307a18769ba34a3ce2628faa08e8e3f80456c0c37de30de197e3b092cb464")
    
      14
    
      15
    
      16build() {
    
      17	cd "$srcdir/lv6-bin-dist"
    
      18
    
      19    # Variable LUSTRE_INSTALL is required for some binaries in this package
    
      20    # proxying each of them with a script that sets it ensures it is set
    
      21    # properly. Even in situations where both lustre-tools-4 and
    
      22    # lustre-tools-6 are in use.
    
      23
    
      24	mv bin bin_
    
      25	mkdir bin
    
      26	for exec in $(cd bin_ ; ls)
    
      27	do
    
      28		echo '#!/bin/sh
    
      29set -e
    
      30export LUSTRE_INSTALL=/usr/share/lustre-tools-6
    
      31/usr/share/lustre-tools-6/bin_/'$exec' $@
    
      32' > "bin/$exec"
    
      33		chmod a+x "bin/$exec"
    
      34	done
    
      35}
    
      36
    
      37package() {
    
      38	mkdir -p "$pkgdir/usr/share" "$pkgdir/etc/profile.d"
    
      39	cp -r "$srcdir/lv6-bin-dist" "$pkgdir/usr/share/lustre-tools-6"
    
      40	echo "append_path '/usr/share/lustre-tools-6/bin'
    
      41export PATH" > "$pkgdir/etc/profile.d/lustre-tools-6.sh"
    
      42}
    
      43
    
      44pkgver() {
    
      45    $srcdir/lv6-bin-dist/bin/lv6 --version
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2