mumax3

maintainer kahlos · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball (containing mumax3, mumax3-server, mumax3-convert) from mumax.ugent.be — the official distribution host for the mumax3 project from Ghent University, which is the upstream developer. The binaries are installed directly to /opt/mumax3 and executed at runtime. While the host is the legitimate upstream (not a personal/unofficial mirror), it is still a prebuilt binary rather than source-compiled, and the host is not a major well-known distribution channel. The sha256 checksums are present and verify the download. The concern is real but mild: if the upstream host were compromised, users would execute malicious GPU simulation binaries with CUDA/NVIDIA access. This is a standard medium-risk pattern for AUR packages distributing prebuilt binaries from upstream vendor hosts — not clearly malicious, but not source-built either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://mumax.ugent.be/mumax3-binaries/mumax3.10_linux_cuda11.0.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball (containing mumax3, mumax3-server, mumax3-convert) from mumax.ugent.be — the official distribution host for the mumax3 project from Ghent University, which is the upstream developer. The binaries are installed directly to /opt/mumax3 and executed at runtime. While the host is the legitimate upstream (not a personal/unofficial mirror), it is still a prebuilt binary rather than source-compiled, and the host is not a major well-known distribution channel. The sha256 checksums are present and verify the download. The concern is real but mild: if the upstream host were compromised, users would execute malicious GPU simulation binaries with CUDA/NVIDIA access. This is a standard medium-risk pattern for AUR packages distributing prebuilt binaries from upstream vendor hosts — not clearly malicious, but not source-built either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Callum Vincent <kahlos@gmail.com>
    
      2pkgname=mumax3
    
      3pkgver=3.10
    
      4pkgrel='1'
    
      5pkgdesc="GPU-accelerated micromagnetic simulation program"
    
      6arch=('x86_64')
    
      7url="https://mumax.github.io/"
    
      8license=('GPL')
    
      9depends=('cuda>=11.0' 'nvidia>=450.36.06')
    
      10optdepends=('gnuplot: for plots in the web GUI')
    
      11source=("https://mumax.ugent.be/mumax3-binaries/mumax3.10_linux_cuda11.0.tar.gz"
    
      12	mumax3-user.conf
    
      13	mumax3-dir.conf
    
      14	mumax3@.service)
    
      15sha256sums=('4c03533986dbf2a9cd7f9708c2f32e4e1ca849bb300e7b0946fdf50daf0a2694'
    
      16	 'bde08909ca59497cfb05686e0ec1a43dc08f499a59861e96cac0d1412545321a'
    
      17	 '0ddad9502bc15cf7e6918c4c83cae8fa909f25b17120cbdf9fad8ba47ee18449'
    
      18	 '515cf6447368b8f03a8392ee54fe35b3bd6e3a91f8de3ebbc2fd8403310d6d8d')
    
      19
    
      20install=mumax3.install
    
      21
    
      22package() {
    
      23  mkdir -p ${pkgdir}/opt/mumax3/ 
    
      24  cp ${srcdir}/mumax3.10_linux_cuda11.0/mumax3{,-server,-convert} ${pkgdir}/opt/mumax3
    
      25  install -Dm644 "$srcdir/$pkgname-user.conf" "$pkgdir/usr/lib/sysusers.d/mumax3.conf"
    
      26  install -Dm644 "$srcdir/$pkgname-dir.conf" "$pkgdir/usr/lib/tmpfiles.d/mumax3.conf"
    
      27  install -Dm644 "$srcdir/mumax3@.service" "$pkgdir/usr/lib/systemd/system/mumax3@.service"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2