nurv-bin

maintainer aseoista · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary from es-static.fbk.eu (Fondazione Bruno Kessler, an Italian research institution and the apparent upstream vendor for NuRV/nuXmv tools), installs it directly as an executable, and uses sha256sums='SKIP', meaning no integrity verification is performed. The host appears to be the legitimate upstream vendor site, which reduces the concern somewhat compared to a random personal host. However, the combination of: (1) a prebuilt binary being executed directly, (2) no checksum verification whatsoever (SKIP), and (3) sourcing from a non-major-CDN institutional host that could be compromised or serve different content over time, constitutes a genuine supply-chain risk. If the host were compromised or the tarball swapped, arbitrary code would execute on the user's system with no integrity check to catch it. The patchelf usage is legitimate (adapting the binary to use the versioned libxml2 soname). This is a real medium-severity concern: not clearly malicious, but a prebuilt binary from a non-standard host with no checksum.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("https://es-static.fbk.eu/tools/nurv/releases/NuRV-${pkgver}-linuxx64.tar.bz2")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary from es-static.fbk.eu (Fondazione Bruno Kessler, an Italian research institution and the apparent upstream vendor for NuRV/nuXmv tools), installs it directly as an executable, and uses sha256sums='SKIP', meaning no integrity verification is performed. The host appears to be the legitimate upstream vendor site, which reduces the concern somewhat compared to a random personal host. However, the combination of: (1) a prebuilt binary being executed directly, (2) no checksum verification whatsoever (SKIP), and (3) sourcing from a non-major-CDN institutional host that could be compromised or serve different content over time, constitutes a genuine supply-chain risk. If the host were compromised or the tarball swapped, arbitrary code would execute on the user's system with no integrity check to catch it. The patchelf usage is legitimate (adapting the binary to use the versioned libxml2 soname). This is a real medium-severity concern: not clearly malicious, but a prebuilt binary from a non-standard host with no checksum.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alberto Bonizzi <aseoista at gmail dot com>
    
      2
    
      3pkgname=nurv-bin
    
      4pkgver=2.0.0
    
      5pkgrel=3
    
      6pkgdesc="Assumption Based Runtime Verification tool built on nuXmv"
    
      7arch=('x86_64')
    
      8url="https://es-static.fbk.eu/tools/nurv/"
    
      9license=('LicenseRef-NuRV-FBK-License')
    
      10provides=('NuRV')
    
      11depends=('gcc-libs' 'glibc' 'gmp' 'libxml2-legacy' 'util-linux-libs')
    
      12makedepends=('patchelf')
    
      13
    
      14source_x86_64=("https://es-static.fbk.eu/tools/nurv/releases/NuRV-${pkgver}-linuxx64.tar.bz2")
    
      15
    
      16sha256sums_x86_64=('SKIP')
    
      17
    
      18package() {
    
      19  _output="${srcdir}/NuRV-${pkgver}-linuxx64"
    
      20  install -Dm755 "${_output}/NuRV" "${pkgdir}/usr/bin/NuRV"
    
      21  install -Dm644 "${_output}/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      22  install -Dm644 "${_output}/LICENSE_FOR_EVALUATION.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      23
    
      24  patchelf --replace-needed libxml2.so.2 libxml2.so.2.13.9 "${pkgdir}/usr/bin/NuRV"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2