mumax3

MEDIUM

maintainer kahlos 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary tarball (containing mumax3, mumax3-server, mumax3-convert) from mumax.ugent.be — the official distribution host for the mumax3 project from Ghent University, which is the upstream developer. The binaries are installed directly to /opt/mumax3 and executed at runtime. While the host is the legitimate upstream (not a personal/unofficial mirror), it is still a prebuilt binary rather than source-compiled, and the host is not a major well-known distribution channel. The sha256 checksums are present and verify the download. The concern is real but mild: if the upstream host were compromised, users would execute malicious GPU simulation binaries with CUDA/NVIDIA access. This is a standard medium-risk pattern for AUR packages distributing prebuilt binaries from upstream vendor hosts — not clearly malicious, but not source-built either.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://mumax.ugent.be/mumax3-binaries/mumax3.10_linux_cuda11.0.tar.gz"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball (containing mumax3, mumax3-server, mumax3-convert) from mumax.ugent.be — the official distribution host for the mumax3 project from Ghent University, which is the upstream developer. The binaries are installed directly to /opt/mumax3 and executed at runtime. While the host is the legitimate upstream (not a personal/unofficial mirror), it is still a prebuilt binary rather than source-compiled, and the host is not a major well-known distribution channel. The sha256 checksums are present and verify the download. The concern is real but mild: if the upstream host were compromised, users would execute malicious GPU simulation binaries with CUDA/NVIDIA access. This is a standard medium-risk pattern for AUR packages distributing prebuilt binaries from upstream vendor hosts — not clearly malicious, but not source-built either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Callum Vincent <kahlos@gmail.com>
    
      2pkgname=mumax3
    
      3pkgver=3.10
    
      4pkgrel='1'
    
      5pkgdesc="GPU-accelerated micromagnetic simulation program"
    
      6arch=('x86_64')
    
      7url="https://mumax.github.io/"
    
      8license=('GPL')
    
      9depends=('cuda>=11.0' 'nvidia>=450.36.06')
    
      10optdepends=('gnuplot: for plots in the web GUI')
    
      11source=("https://mumax.ugent.be/mumax3-binaries/mumax3.10_linux_cuda11.0.tar.gz"
    
      12	mumax3-user.conf
    
      13	mumax3-dir.conf
    
      14	mumax3@.service)
    
      15sha256sums=('4c03533986dbf2a9cd7f9708c2f32e4e1ca849bb300e7b0946fdf50daf0a2694'
    
      16	 'bde08909ca59497cfb05686e0ec1a43dc08f499a59861e96cac0d1412545321a'
    
      17	 '0ddad9502bc15cf7e6918c4c83cae8fa909f25b17120cbdf9fad8ba47ee18449'
    
      18	 '515cf6447368b8f03a8392ee54fe35b3bd6e3a91f8de3ebbc2fd8403310d6d8d')
    
      19
    
      20install=mumax3.install
    
      21
    
      22package() {
    
      23  mkdir -p ${pkgdir}/opt/mumax3/ 
    
      24  cp ${srcdir}/mumax3.10_linux_cuda11.0/mumax3{,-server,-convert} ${pkgdir}/opt/mumax3
    
      25  install -Dm644 "$srcdir/$pkgname-user.conf" "$pkgdir/usr/lib/sysusers.d/mumax3.conf"
    
      26  install -Dm644 "$srcdir/$pkgname-dir.conf" "$pkgdir/usr/lib/tmpfiles.d/mumax3.conf"
    
      27  install -Dm644 "$srcdir/mumax3@.service" "$pkgdir/usr/lib/systemd/system/mumax3@.service"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2