novabench

MEDIUM

maintainer sbernard 0 votes scanned 2026-08-30 19:45:45.710053

View on AUR

Why flagged

A prebuilt binary .deb is downloaded from cdn.novabench.net (the project's own CDN, plausibly official) with a sha256 checksum provided, which mitigates swap risk; however it is a closed-source prebuilt executable from a CDN that could be silently updated (the URL is not version-pinned and always fetches 'novabench-x64.deb'), and the EULA HTML is fetched with SKIP'd checksum, making this a medium-risk proprietary binary package rather than anything actively malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "novabench-${pkgver}-${CARCH}.deb::https://cdn.novabench.net/novabench-x64.deb"
PKGBUILD:39 "Novabench-EULA.html::https://novabench.com/legal/eula"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): A prebuilt binary .deb is downloaded from cdn.novabench.net (the project's own CDN, plausibly official) with a sha256 checksum provided, which mitigates swap risk; however it is a closed-source prebuilt executable from a CDN that could be silently updated (the URL is not version-pinned and always fetches 'novabench-x64.deb'), and the EULA HTML is fetched with SKIP'd checksum, making this a medium-risk proprietary binary package rather than anything actively malicious.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Samuel Bernard <samuel.bernard@gmail.com>
    
      2
    
      3pkgname=novabench
    
      4pkgver=6.1.2
    
      5pkgrel=1
    
      6pkgdesc="Cross-platform benchmark for CPU, GPU, memory, storage, and NPU"
    
      7arch=('x86_64')
    
      8url="https://novabench.com/"
    
      9license=('LicenseRef-Novabench-EULA')
    
      10depends=(
    
      11  'cairo'
    
      12  'curl'
    
      13  'dbus'
    
      14  'gdk-pixbuf2'
    
      15  'glib2'
    
      16  'glibc'
    
      17  'gtk3'
    
      18  'hicolor-icon-theme'
    
      19  'libdecor'
    
      20  'libgcc'
    
      21  'libsoup3'
    
      22  'libstdc++'
    
      23  'openssl'
    
      24  'pango'
    
      25  'vulkan-icd-loader'
    
      26  'wayland'
    
      27  'webkit2gtk-4.1'
    
      28  'zlib-ng-compat'
    
      29)
    
      30optdepends=(
    
      31  'vulkan-driver: Vulkan driver for GPU benchmarks'
    
      32)
    
      33install=novabench.install
    
      34# The privileged service authorizes the core executable by SHA-256.
    
      35# Keep upstream binaries byte-for-byte intact.
    
      36options=('!strip')
    
      37source=(
    
      38  "novabench-${pkgver}-${CARCH}.deb::https://cdn.novabench.net/novabench-x64.deb"
    
      39  "Novabench-EULA.html::https://novabench.com/legal/eula"
    
      40)
    
      41sha256sums=(
    
      42  '9fb452522351a56599f6a3eebb9594fb3249c276ff4c945701a91d97cf4ce51c'
    
      43  'SKIP'
    
      44)
    
      45
    
      46package() {
    
      47  bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}"
    
      48
    
      49  install -Dm644 \
    
      50    "${srcdir}/Novabench-EULA.html" \
    
      51    "${pkgdir}/usr/share/licenses/${pkgname}/EULA.html"
    
      52
    
      53  # The privileged sensor service uses an authorization manifest containing
    
      54  # the Novabench core executable path and SHA-256 hash. Generate it from the
    
      55  # exact executable included in this package.
    
      56  local _exec="/usr/lib/Novabench/resources/novabench"
    
      57  local _exec_hash
    
      58  _exec_hash="$(sha256sum "${pkgdir}${_exec}" | cut -d ' ' -f1)"
    
      59
    
      60  printf 'version 1\ncore-executable %s sha256:%s\n' "$_exec" "$_exec_hash" \
    
      61    > "${pkgdir}/usr/lib/novabench/novabench-service.manifest"
    
      62
    
      63  chmod 0644 "${pkgdir}/usr/lib/novabench/novabench-service.manifest"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 19:45:45	Medium	3
2026-08-30 19:44:01	Medium	3