nvidia-beta

maintainer dbermond · 350 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package downloads a prebuilt NVIDIA driver binary from a non-whitelisted host; while nvidia.com is legitimate, the specific subdomain and path are not standard, and the binary is unverifiable, posing a supply-chain risk if the source were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("http://us.download.nvidia.com/XFree86/Linux-${CARCH}/${pkgver}/${_pkg}.run"

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt NVIDIA driver binary from a non-whitelisted host; while nvidia.com is legitimate, the specific subdomain and path are not standard, and the binary is unverifiable, posing a supply-chain risk if the source were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer : Daniel Bermond <dbermond@archlinux.org>
    
      2# Contributor: Det <nimetonmaili g-mail>
    
      3# Contributor: Ng Oon-Ee
    
      4# Contributor: Dan Vratil
    
      5
    
      6pkgname=nvidia-beta
    
      7pkgver=610.57.04
    
      8pkgrel=1
    
      9pkgdesc="NVIDIA kernel module (beta version)"
    
      10arch=('x86_64')
    
      11url='https://www.nvidia.com/'
    
      12license=('LicenseRef-Custom')
    
      13makedepends=(
    
      14    'dkms'
    
      15    'linux-headers')
    
      16provides=("nvidia=${pkgver}" "nvidia-beta=${pkgver}" 'NVIDIA-MODULE')
    
      17conflicts=('nvidia')
    
      18options=('!strip')
    
      19_pkg="NVIDIA-Linux-${CARCH}-${pkgver}-no-compat32"
    
      20source=("http://us.download.nvidia.com/XFree86/Linux-${CARCH}/${pkgver}/${_pkg}.run"
    
      21        '110-nvidia-change-dkms-conf.patch')
    
      22sha256sums=('83619d878211aadf4c7e1c5de3d2a865c9936fb2dfa5c1b4c3aabccc20c3f283'
    
      23            '03bb209054fba81aea3b16f4dc241b83612f2bb2267435e9f9e33b40966a79d7')
    
      24
    
      25prepare() {
    
      26    # extract the source file
    
      27    [ -d "$_pkg" ] && rm -rf "$_pkg"
    
      28    printf '%s\n' "  -> Self-Extracting ${_pkg}.run..."
    
      29    sh "${_pkg}.run" --extract-only
    
      30    ln -s kernel "${_pkg}/nvidia-${pkgver}"
    
      31    
    
      32    patch -d "$_pkg" -Np1 -i "${srcdir}/110-nvidia-change-dkms-conf.patch"
    
      33}
    
      34
    
      35build() {
    
      36    fakeroot dkms build --dkmstree "$srcdir" --sourcetree "${srcdir}/${_pkg}" -m "nvidia/${pkgver}" -k "$(</usr/src/linux/version)"
    
      37}
    
      38
    
      39package() {
    
      40    depends=(
    
      41        'libglvnd'
    
      42        'linux'
    
      43        "nvidia-utils-beta=${pkgver}")
    
      44    
    
      45    local _kernver
    
      46    _kernver="$(</usr/src/linux/version)"
    
      47    
    
      48    install -D -m644 "nvidia/${pkgver}/${_kernver}/${CARCH}/module"/* -t "${pkgdir}/usr/lib/modules/${_kernver}/extramodules"
    
      49    install -D -m644 "${_pkg}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      50    find "$pkgdir" -name '*.ko' -exec zstd --rm -19 {} +
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-07-10 00:20
+++ PKGBUILD @ 2026-08-18 00:03
@@ -4,7 +4,7 @@
 # Contributor: Dan Vratil
 
 pkgname=nvidia-beta
-pkgver=610.43.02
+pkgver=610.57.04
 pkgrel=1
 pkgdesc="NVIDIA kernel module (beta version)"
 arch=('x86_64')
@@ -19,8 +19,8 @@
 _pkg="NVIDIA-Linux-${CARCH}-${pkgver}-no-compat32"
 source=("http://us.download.nvidia.com/XFree86/Linux-${CARCH}/${pkgver}/${_pkg}.run"
         '110-nvidia-change-dkms-conf.patch')
-sha256sums=('4d53abaa1e0e1d502b40ecf145c831c331304adb9bdcb83293a0b393fb6d00d0'
-            '8775aabec2a66ca98616048a757b54f32b821d58c7a3a39030efaf6f7182df15')
+sha256sums=('83619d878211aadf4c7e1c5de3d2a865c9936fb2dfa5c1b4c3aabccc20c3f283'
+            '03bb209054fba81aea3b16f4dc241b83612f2bb2267435e9f9e33b40966a79d7')
 
 prepare() {
     # extract the source file

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 00:03:42	MEDIUM	2
2026-08-15 00:26:13	MEDIUM	2
2026-08-14 00:03:41	MEDIUM	2
2026-08-13 00:17:07	MEDIUM	2
2026-08-12 01:22:13	MEDIUM	2
2026-07-10 00:20:30	CLEAN	2
2026-07-09 23:33:03	LOW	1
2026-06-20 00:50:07	CLEAN	2
2026-06-20 00:18:46	MEDIUM	2
2026-06-19 23:51:18	CLEAN	2
2026-06-19 19:07:35	LOW	2
2026-06-18 16:11:54	LOW	1