nurv-bin

LOW

maintainer aseoista 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary tarball from a project-associated but non-whitelisted host; however, the source is verifiable via checksum, and the content is installed as-is without remote code execution or obfuscation, limiting risk to supply-chain trust in the upstream provider.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary tarball from a project-associated but non-whitelisted host; however, the source is verifiable via checksum, and the content is installed as-is without remote code execution or obfuscation, limiting risk to supply-chain trust in the upstream provider.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("NuRV-${pkgver}-linux64.tar.xz::https://es-static-lfs.fbk.eu/access/unit/es-tools-releases/NuRV/${pkgver}/NuRV-${pkgver}-linux64.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alberto Bonizzi <aseoista at gmail dot com>
    
      2
    
      3pkgname=nurv-bin
    
      4pkgver=2.1.0
    
      5pkgrel=1
    
      6pkgdesc="Assumption Based Runtime Verification tool built on nuXmv"
    
      7arch=('x86_64')
    
      8url="https://es-static.fbk.eu/tools/nurv/"
    
      9license=('LicenseRef-NuRV-FBK-License')
    
      10provides=('NuRV')
    
      11depends=('glib2' 'glibc' 'gmp' 'jsonrpc-glib' 'libbsd' 'libgcc' 'libstdc++' 'ncurses' 'util-linux-libs' 'xz' 'zlib')
    
      12optdepends=('python: For the Python examples and generated Python monitors')
    
      13makedepends=('patchelf')
    
      14
    
      15source_x86_64=("NuRV-${pkgver}-linux64.tar.xz::https://es-static-lfs.fbk.eu/access/unit/es-tools-releases/NuRV/${pkgver}/NuRV-${pkgver}-linux64.tar.xz")
    
      16
    
      17sha256sums_x86_64=('b20ec03f53bea50831ae302ac9d8e90f4a8d77f7de2dbc39440e3b72e0c9d09f')
    
      18
    
      19package() {
    
      20  _output="${srcdir}/NuRV-${pkgver}-linux64"
    
      21  local _libdir="${CARCH}-linux-gnu"
    
      22
    
      23  install -Dm755 \
    
      24    "${_output}/usr/local/bin/NuRV" \
    
      25    "${_output}/usr/local/bin/NuRV_orbit" \
    
      26    -t "${pkgdir}/usr/bin/"
    
      27
    
      28  install -Dm755 \
    
      29    "${_output}/usr/local/lib/${_libdir}/libedit.so.2" \
    
      30    "${_output}/usr/local/lib/${_libdir}/libicudata.so.70" \
    
      31    "${_output}/usr/local/lib/${_libdir}/libicuuc.so.70" \
    
      32    "${_output}/usr/local/lib/${_libdir}/libxml2.so.2" \
    
      33    "${_output}/usr/local/lib/${_libdir}/libORBit-2.so.0" \
    
      34    "${_output}/usr/local/lib/${_libdir}/libORBitCosNaming-2.so.0" \
    
      35    -t "${pkgdir}/usr/lib/nurv/"
    
      36
    
      37  local _share="${_output}/usr/local/share"
    
      38  find "${_share}" -type f | while read -r f; do
    
      39    install -Dm644 "${f}" "${pkgdir}/usr/share/${f#"${_share}"/}"
    
      40  done
    
      41
    
      42  install -Dm644 "${_output}/nurv-manual.pdf" "${_output}/NEWS.md" -t "${pkgdir}/usr/share/doc/${pkgname}/"
    
      43
    
      44  patchelf --force-rpath --set-rpath '/usr/lib/nurv' "${pkgdir}/usr/bin/NuRV"
    
      45  patchelf --force-rpath --set-rpath '/usr/lib/nurv' "${pkgdir}/usr/bin/NuRV_orbit"
    
      46
    
      47  patchelf --force-rpath --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/nurv/libicuuc.so.70"
    
      48  patchelf --force-rpath --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/nurv/libxml2.so.2"
    
      49  patchelf --force-rpath --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/nurv/libORBitCosNaming-2.so.0"
    
      50
    
      51  install -Dm644 "${_output}/LICENSE.txt" "${_output}/LICENSE_FOR_EVALUATION.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      52}
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,26 +1,53 @@
 # Maintainer: Alberto Bonizzi <aseoista at gmail dot com>
 
 pkgname=nurv-bin
-pkgver=2.0.0
-pkgrel=3
+pkgver=2.1.0
+pkgrel=1
 pkgdesc="Assumption Based Runtime Verification tool built on nuXmv"
 arch=('x86_64')
 url="https://es-static.fbk.eu/tools/nurv/"
 license=('LicenseRef-NuRV-FBK-License')
 provides=('NuRV')
-depends=('gcc-libs' 'glibc' 'gmp' 'libxml2-legacy' 'util-linux-libs')
+depends=('glib2' 'glibc' 'gmp' 'jsonrpc-glib' 'libbsd' 'libgcc' 'libstdc++' 'ncurses' 'util-linux-libs' 'xz' 'zlib')
+optdepends=('python: For the Python examples and generated Python monitors')
 makedepends=('patchelf')
 
-source_x86_64=("https://es-static.fbk.eu/tools/nurv/releases/NuRV-${pkgver}-linuxx64.tar.bz2")
+source_x86_64=("NuRV-${pkgver}-linux64.tar.xz::https://es-static-lfs.fbk.eu/access/unit/es-tools-releases/NuRV/${pkgver}/NuRV-${pkgver}-linux64.tar.xz")
 
-sha256sums_x86_64=('SKIP')
+sha256sums_x86_64=('b20ec03f53bea50831ae302ac9d8e90f4a8d77f7de2dbc39440e3b72e0c9d09f')
 
 package() {
-  _output="${srcdir}/NuRV-${pkgver}-linuxx64"
-  install -Dm755 "${_output}/NuRV" "${pkgdir}/usr/bin/NuRV"
-  install -Dm644 "${_output}/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
-  install -Dm644 "${_output}/LICENSE_FOR_EVALUATION.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
+  _output="${srcdir}/NuRV-${pkgver}-linux64"
+  local _libdir="${CARCH}-linux-gnu"
 
-  patchelf --replace-needed libxml2.so.2 libxml2.so.2.13.9 "${pkgdir}/usr/bin/NuRV"
+  install -Dm755 \
+    "${_output}/usr/local/bin/NuRV" \
+    "${_output}/usr/local/bin/NuRV_orbit" \
+    -t "${pkgdir}/usr/bin/"
+
+  install -Dm755 \
+    "${_output}/usr/local/lib/${_libdir}/libedit.so.2" \
+    "${_output}/usr/local/lib/${_libdir}/libicudata.so.70" \
+    "${_output}/usr/local/lib/${_libdir}/libicuuc.so.70" \
+    "${_output}/usr/local/lib/${_libdir}/libxml2.so.2" \
+    "${_output}/usr/local/lib/${_libdir}/libORBit-2.so.0" \
+    "${_output}/usr/local/lib/${_libdir}/libORBitCosNaming-2.so.0" \
+    -t "${pkgdir}/usr/lib/nurv/"
+
+  local _share="${_output}/usr/local/share"
+  find "${_share}" -type f | while read -r f; do
+    install -Dm644 "${f}" "${pkgdir}/usr/share/${f#"${_share}"/}"
+  done
+
+  install -Dm644 "${_output}/nurv-manual.pdf" "${_output}/NEWS.md" -t "${pkgdir}/usr/share/doc/${pkgname}/"
+
+  patchelf --force-rpath --set-rpath '/usr/lib/nurv' "${pkgdir}/usr/bin/NuRV"
+  patchelf --force-rpath --set-rpath '/usr/lib/nurv' "${pkgdir}/usr/bin/NuRV_orbit"
+
+  patchelf --force-rpath --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/nurv/libicuuc.so.70"
+  patchelf --force-rpath --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/nurv/libxml2.so.2"
+  patchelf --force-rpath --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/nurv/libORBitCosNaming-2.so.0"
+
+  install -Dm644 "${_output}/LICENSE.txt" "${_output}/LICENSE_FOR_EVALUATION.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 15:48:05	Medium	1
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2