nsight-systems-bin
maintainer lywel
· 1 votes
· scanned 2026-08-18 00:03:42.021799
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb binary from a non-whitelisted but plausible NVIDIA host; while the source is official, the unverifiable executable constitutes a supply-chain risk if the host were compromised.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
"https://developer.nvidia.com/downloads/assets/tools/secure/nsight-systems/${_year}_${_month}/$_deb"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb binary from a non-whitelisted but plausible NVIDIA host; while the source is official, the unverifiable executable constitutes a supply-chain risk if the host were compromised.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Maxime Lewandowski <lywel@lywel.link>
2
3
pkgname=nsight-systems-bin
4
pkgver=2026.4.1.191
5
pkgrel=1
6
pkgdesc='System-wide statistical sampling profiler with tracing features (upstream .deb)'
7
arch=(x86_64)
8
url='https://developer.nvidia.com/nsight-systems'
9
license=(LicenseRef-NVIDIA-SLA)
10
depends=(
11
dbus fontconfig glib2 glibc libdrm libglvnd libx11 libxcb libxext libxi
12
libxkbcommon libxkbcommon-x11 libxkbfile libxshmfence nspr nss wayland
13
xcb-util-cursor xcb-util-image xcb-util-keysyms xcb-util-renderutil
14
)
15
optdepends=('cuda: for GPU profiling on the local system')
16
provides=("nsight-systems=$pkgver")
17
conflicts=(nsight-systems)
18
options=(!strip)
19
20
_short=${pkgver%.*} # 2026.3.1
21
_year=${pkgver%%.*} # 2026
22
_rest=${pkgver#*.}; _month=${_rest%%.*} # 3
23
_deb=nsight-systems-${_short}_${pkgver}-1_amd64.deb
24
25
source=(
26
"https://developer.nvidia.com/downloads/assets/tools/secure/nsight-systems/${_year}_${_month}/$_deb"
27
nsight-systems.desktop
28
)
29
sha256sums=('8aeaf8c73401ccafb0b9bbe59981a6fcc97a038388462b15ef48ff75458aba19'
30
'31fb773b641c477b0ccd4b6d081ddbb7acf390c1db6233439ad70deb321f7cc5')
31
32
package() {
33
bsdtar -xf "$_deb"
34
bsdtar -xf data.tar.*
35
36
install -d "$pkgdir/opt/nvidia/nsight-systems"
37
cp -a "opt/nvidia/nsight-systems/$_short" "$pkgdir/opt/nvidia/nsight-systems/"
38
39
install -d "$pkgdir/usr/bin"
40
ln -s "/opt/nvidia/nsight-systems/$_short/bin/nsys" "$pkgdir/usr/bin/nsys"
41
ln -s "/opt/nvidia/nsight-systems/$_short/bin/nsys-ui" "$pkgdir/usr/bin/nsys-ui"
42
43
install -Dm644 nsight-systems.desktop \
44
"$pkgdir/usr/share/applications/nsight-systems-$_short.desktop"
45
sed -i "s|^Exec=.*|Exec=/opt/nvidia/nsight-systems/$_short/bin/nsys-ui|" \
46
"$pkgdir/usr/share/applications/nsight-systems-$_short.desktop"
47
}
48
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-08-18 00:03@@ -1,7 +1,7 @@ # Maintainer: Maxime Lewandowski <lywel@lywel.link> pkgname=nsight-systems-bin-pkgver=2026.3.1.157+pkgver=2026.4.1.191 pkgrel=1 pkgdesc='System-wide statistical sampling profiler with tracing features (upstream .deb)' arch=(x86_64)@@ -26,10 +26,8 @@ "https://developer.nvidia.com/downloads/assets/tools/secure/nsight-systems/${_year}_${_month}/$_deb" nsight-systems.desktop )-sha256sums=(- 5ee19712bab10f3f1848493ffe808d1bf540b5c6bdf0e06ac9da867dab28935b- 31fb773b641c477b0ccd4b6d081ddbb7acf390c1db6233439ad70deb321f7cc5-)+sha256sums=('8aeaf8c73401ccafb0b9bbe59981a6fcc97a038388462b15ef48ff75458aba19'+ '31fb773b641c477b0ccd4b6d081ddbb7acf390c1db6233439ad70deb321f7cc5') package() { bsdtar -xf "$_deb"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | MEDIUM | 2 |
| 2026-08-17 00:18:29 | MEDIUM | 2 |
| 2026-08-16 00:03:42 | MEDIUM | 2 |
| 2026-08-15 00:26:13 | MEDIUM | 2 |
| 2026-08-14 00:03:41 | MEDIUM | 2 |
| 2026-08-13 15:26:23 | MEDIUM | 2 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |