novabench

MEDIUM

maintainer sbernard 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a non-whitelisted CDN (cdn.novabench.net), which are then extracted and installed; while the host is plausibly official, the lack of verifiable upstream source code and reliance on unstripped, precompiled binaries from a non-standard domain introduces a supply-chain risk if the host were compromised or redirected.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "Novabench-EULA.html::https://novabench.com/legal/eula"
PKGBUILD:41 "novabench-${pkgver}-x86_64.deb::https://cdn.novabench.net/novabench-x64.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted CDN (cdn.novabench.net), which are then extracted and installed; while the host is plausibly official, the lack of verifiable upstream source code and reliance on unstripped, precompiled binaries from a non-standard domain introduces a supply-chain risk if the host were compromised or redirected.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Samuel Bernard <samuel.bernard@gmail.com>
    
      2
    
      3pkgname=novabench
    
      4pkgver=6.2.1
    
      5pkgrel=1
    
      6pkgdesc="Cross-platform benchmark for CPU, GPU, memory, storage, and NPU"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://novabench.com/"
    
      9license=('LicenseRef-Novabench-EULA')
    
      10depends=(
    
      11  'cairo'
    
      12  'curl'
    
      13  'dbus'
    
      14  'gdk-pixbuf2'
    
      15  'glib2'
    
      16  'glibc'
    
      17  'gtk3'
    
      18  'hicolor-icon-theme'
    
      19  'libdecor'
    
      20  'libgcc'
    
      21  'libsoup3'
    
      22  'libstdc++'
    
      23  'openssl'
    
      24  'pango'
    
      25  'vulkan-icd-loader'
    
      26  'wayland'
    
      27  'webkit2gtk-4.1'
    
      28  'zlib'
    
      29)
    
      30optdepends=(
    
      31  'vulkan-driver: Vulkan driver for GPU benchmarks'
    
      32)
    
      33install=novabench.install
    
      34# The privileged service authorizes the core executable by SHA-256.
    
      35# Keep upstream binaries byte-for-byte intact.
    
      36options=('!strip')
    
      37source=(
    
      38  "Novabench-EULA.html::https://novabench.com/legal/eula"
    
      39)
    
      40source_x86_64=(
    
      41  "novabench-${pkgver}-x86_64.deb::https://cdn.novabench.net/novabench-x64.deb"
    
      42)
    
      43source_aarch64=(
    
      44  "novabench-${pkgver}-aarch64.deb::https://cdn.novabench.net/novabench-arm64.deb"
    
      45)
    
      46
    
      47sha256sums=(
    
      48  'SKIP'
    
      49)
    
      50sha256sums_x86_64=(
    
      51  '90239399f07355eee78e5a7990347e62e145b1d4bc605db09556b531c809ce8c'
    
      52)
    
      53sha256sums_aarch64=(
    
      54  '9e807052b7632cfc8a1795d046b3f5b1e5b387d0c74b8d9edafdc6d1878f57ff'
    
      55)
    
      56
    
      57package() {
    
      58  bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}"
    
      59
    
      60  install -Dm644 \
    
      61    "${srcdir}/Novabench-EULA.html" \
    
      62    "${pkgdir}/usr/share/licenses/${pkgname}/EULA.html"
    
      63
    
      64  # The privileged sensor service uses an authorization manifest containing
    
      65  # the Novabench core executable path and SHA-256 hash. Generate it from the
    
      66  # exact executable included in this package.
    
      67  local _exec="/usr/lib/Novabench/resources/novabench"
    
      68  local _exec_hash
    
      69  _exec_hash="$(sha256sum "${pkgdir}${_exec}" | cut -d ' ' -f1)"
    
      70
    
      71  printf 'version 1\ncore-executable %s sha256:%s\n' "$_exec" "$_exec_hash" \
    
      72    > "${pkgdir}/usr/lib/novabench/novabench-service.manifest"
    
      73
    
      74  chmod 0644 "${pkgdir}/usr/lib/novabench/novabench-service.manifest"
    
      75}
    
      76

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,10 +1,10 @@
 # Maintainer: Samuel Bernard <samuel.bernard@gmail.com>
 
 pkgname=novabench
-pkgver=6.1.2
+pkgver=6.2.1
 pkgrel=1
 pkgdesc="Cross-platform benchmark for CPU, GPU, memory, storage, and NPU"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://novabench.com/"
 license=('LicenseRef-Novabench-EULA')
 depends=(
@@ -25,7 +25,7 @@
   'vulkan-icd-loader'
   'wayland'
   'webkit2gtk-4.1'
-  'zlib-ng-compat'
+  'zlib'
 )
 optdepends=(
   'vulkan-driver: Vulkan driver for GPU benchmarks'
@@ -35,12 +35,23 @@
 # Keep upstream binaries byte-for-byte intact.
 options=('!strip')
 source=(
-  "novabench-${pkgver}-${CARCH}.deb::https://cdn.novabench.net/novabench-x64.deb"
   "Novabench-EULA.html::https://novabench.com/legal/eula"
 )
+source_x86_64=(
+  "novabench-${pkgver}-x86_64.deb::https://cdn.novabench.net/novabench-x64.deb"
+)
+source_aarch64=(
+  "novabench-${pkgver}-aarch64.deb::https://cdn.novabench.net/novabench-arm64.deb"
+)
+
 sha256sums=(
-  '9fb452522351a56599f6a3eebb9594fb3249c276ff4c945701a91d97cf4ce51c'
   'SKIP'
+)
+sha256sums_x86_64=(
+  '90239399f07355eee78e5a7990347e62e145b1d4bc605db09556b531c809ce8c'
+)
+sha256sums_aarch64=(
+  '9e807052b7632cfc8a1795d046b3f5b1e5b387d0c74b8d9edafdc6d1878f57ff'
 )
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 11:16:06	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2
2026-10-10 00:11:52	Medium	2
2026-10-09 00:05:33	Medium	2
2026-10-08 00:28:03	Medium	2
2026-10-07 00:21:34	Medium	2
2026-10-06 00:13:36	Medium	2
2026-10-05 00:08:03	Medium	2
2026-10-04 00:18:08	Medium	2
2026-10-03 00:23:04	Medium	2
2026-10-02 00:00:32	Medium	2
2026-10-01 00:02:06	Medium	2
2026-09-30 00:20:07	Medium	2
2026-09-29 00:07:46	Medium	2