okc

MEDIUM

maintainer lapsus 0 votes scanned 2026-10-29 17:56:54.985796

View on AUR

Why flagged

Prebuilt proprietary binary downloaded from a non-whitelisted personal/project domain (openkernelchallenge.dev) with no way to verify upstream authenticity; checksums are present but the host is not an established vendor infrastructure, making silent substitution plausible. The latestver() function also fetches from the same host at runtime but is not executed during build.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:22 curl -fsSL https://openkernelchallenge.dev/okc/latest

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("okc_${pkgver}_x86_64.gz::https://openkernelchallenge.dev/okc/${pkgver}/okc-linux-amd64.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt proprietary binary downloaded from a non-whitelisted personal/project domain (openkernelchallenge.dev) with no way to verify upstream authenticity; checksums are present but the host is not an established vendor infrastructure, making silent substitution plausible. The latestver() function also fetches from the same host at runtime but is not executed during build.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=okc
    
      4pkgver=0.7.2
    
      5pkgrel=1
    
      6pkgdesc="Command-line client for the Muse Spark Open Kernel Challenge"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://openkernelchallenge.dev"
    
      9# Upstream ships no licence file, so namcap reports one missing; do not invent one to silence it.
    
      10license=('LicenseRef-proprietary')
    
      11# Static Go binary: TLS roots come from the system trust store, which namcap cannot see.
    
      12depends=('ca-certificates')
    
      13optdepends=('git: "okc serve init" fetches the pinned SGLang with git')
    
      14# Already stripped upstream; !strip keeps the installed file byte-identical to upstream's SHA256SUMS.
    
      15options=('!strip' '!debug')
    
      16source_x86_64=("okc_${pkgver}_x86_64.gz::https://openkernelchallenge.dev/okc/${pkgver}/okc-linux-amd64.gz")
    
      17sha256sums_x86_64=('151719b64903bc996abc37b9f09a05c658f2e4665d0dc15a25ff6cc78f124a49')
    
      18source_aarch64=("okc_${pkgver}_aarch64.gz::https://openkernelchallenge.dev/okc/${pkgver}/okc-linux-arm64.gz")
    
      19sha256sums_aarch64=('cf51ce9defe357712ed050e4d35b883e3e2f3ec1ea6df5b4852d9b0493fd9653')
    
      20
    
      21latestver() {
    
      22  curl -fsSL https://openkernelchallenge.dev/okc/latest
    
      23}
    
      24
    
      25build() {
    
      26  chmod +x "okc_${pkgver}_${CARCH}"
    
      27}
    
      28
    
      29check() {
    
      30  ./okc_${pkgver}_${CARCH} version | grep -qx "okc ${pkgver}"
    
      31}
    
      32
    
      33package() {
    
      34  install -Dm755 "okc_${pkgver}_${CARCH}" "${pkgdir}/usr/bin/okc"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 17:56:54	Medium	4
2026-10-29 17:53:05	Medium	3