mumax3

MEDIUM

maintainer kahlos 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary tarball (containing mumax3, mumax3-server, mumax3-convert) from mumax.ugent.be — the official distribution host for the mumax3 project from Ghent University, which is the upstream developer. The binaries are installed directly to /opt/mumax3 and executed at runtime. While the host is the legitimate upstream (not a personal/unofficial mirror), it is still a prebuilt binary rather than source-compiled, and the host is not a major well-known distribution channel. The sha256 checksums are present and verify the download. The concern is real but mild: if the upstream host were compromised, users would execute malicious GPU simulation binaries with CUDA/NVIDIA access. This is a standard medium-risk pattern for AUR packages distributing prebuilt binaries from upstream vendor hosts — not clearly malicious, but not source-built either.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://mumax.ugent.be/mumax3-binaries/mumax3.10_linux_cuda11.0.tar.gz"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball (containing mumax3, mumax3-server, mumax3-convert) from mumax.ugent.be — the official distribution host for the mumax3 project from Ghent University, which is the upstream developer. The binaries are installed directly to /opt/mumax3 and executed at runtime. While the host is the legitimate upstream (not a personal/unofficial mirror), it is still a prebuilt binary rather than source-compiled, and the host is not a major well-known distribution channel. The sha256 checksums are present and verify the download. The concern is real but mild: if the upstream host were compromised, users would execute malicious GPU simulation binaries with CUDA/NVIDIA access. This is a standard medium-risk pattern for AUR packages distributing prebuilt binaries from upstream vendor hosts — not clearly malicious, but not source-built either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Callum Vincent <kahlos@gmail.com>
    
      2pkgname=mumax3
    
      3pkgver=3.10
    
      4pkgrel='1'
    
      5pkgdesc="GPU-accelerated micromagnetic simulation program"
    
      6arch=('x86_64')
    
      7url="https://mumax.github.io/"
    
      8license=('GPL')
    
      9depends=('cuda>=11.0' 'nvidia>=450.36.06')
    
      10optdepends=('gnuplot: for plots in the web GUI')
    
      11source=("https://mumax.ugent.be/mumax3-binaries/mumax3.10_linux_cuda11.0.tar.gz"
    
      12	mumax3-user.conf
    
      13	mumax3-dir.conf
    
      14	mumax3@.service)
    
      15sha256sums=('4c03533986dbf2a9cd7f9708c2f32e4e1ca849bb300e7b0946fdf50daf0a2694'
    
      16	 'bde08909ca59497cfb05686e0ec1a43dc08f499a59861e96cac0d1412545321a'
    
      17	 '0ddad9502bc15cf7e6918c4c83cae8fa909f25b17120cbdf9fad8ba47ee18449'
    
      18	 '515cf6447368b8f03a8392ee54fe35b3bd6e3a91f8de3ebbc2fd8403310d6d8d')
    
      19
    
      20install=mumax3.install
    
      21
    
      22package() {
    
      23  mkdir -p ${pkgdir}/opt/mumax3/ 
    
      24  cp ${srcdir}/mumax3.10_linux_cuda11.0/mumax3{,-server,-convert} ${pkgdir}/opt/mumax3
    
      25  install -Dm644 "$srcdir/$pkgname-user.conf" "$pkgdir/usr/lib/sysusers.d/mumax3.conf"
    
      26  install -Dm644 "$srcdir/$pkgname-dir.conf" "$pkgdir/usr/lib/tmpfiles.d/mumax3.conf"
    
      27  install -Dm644 "$srcdir/mumax3@.service" "$pkgdir/usr/lib/systemd/system/mumax3@.service"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2