openonload

maintainer ido · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source archive from a non-whitelisted but plausibly official vendor domain (xilinx.com) for building OpenOnload, a legitimate high-performance network stack; the source is verified via a matching sha512sum, and no unreviewed remote code execution occurs.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source archive from a non-whitelisted but plausibly official vendor domain (xilinx.com) for building OpenOnload, a legitimate high-performance network stack; the source is verified via a matching sha512sum, and no unreviewed remote code execution occurs.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 source=("https://www.xilinx.com/content/dam/xilinx/publications/solarflare/onload/openonload/9_0_2_47/sf-109585-ls-47-openonload-release-package.zip"

PKGBUILD

1 offending line(s) highlighted

      1# $Id: 469156894119f3e86346aecbb0de97fac03a04fe $
    
      2# Maintainer: Ido Rosen <ido@kernel.org>
    
      3# Contributor: Xiaoxu Guo <ftiasch0@gmail.com>
    
      4#
    
      5# NOTE: To request changes to this package, please submit a pull request
    
      6#       to the GitHub repository at https://github.com/ido/packages-archlinux
    
      7#       Otherwise, open a GitHub issue.  Thank you! -Ido
    
      8# 
    
      9# From the OpenOnload website, http://www.openonload.org/ :
    
      10#   ``OpenOnload(r) is a high performance network stack from Solarflare that
    
      11#   dramatically reduces latency and cpu utilisation, and increases message rate
    
      12#   and bandwidth.  OpenOnload runs on Linux and supports TCP/UDP/IP network
    
      13#   protocols with the standard BSD sockets API, and requires no modifications
    
      14#   to applications to use. It achieves performance improvements in part by
    
      15#   performing network processing at user-level, bypassing the OS kernel
    
      16#   entirely on the data path. Networking performance is improved without
    
      17#   sacrificing the security and multiplexing functions that the OS kernel
    
      18#   normally provides.'' (10/3/2013)
    
      19
    
      20# AMD/Xilinx's website seems to block certain user-agent strings. Argh.
    
      21DLAGENTS=("https::/usr/bin/curl -A 'Mozilla' -fLC - --retry 3 --retry-delay 3 -o %o %u")
    
      22
    
      23pkgname='openonload'
    
      24pkgdesc="A high performance network stack from Solarflare."
    
      25epoch=1
    
      26pkgver='9.0.2.140'
    
      27pkgrel=1
    
      28arch=('i686' 'x86_64')
    
      29url='http://www.openonload.org/'
    
      30license=('custom')
    
      31depends=("linux-lts")
    
      32makedepends=("linux-lts" "linux-lts-headers" "libarchive") # libarchive for bsdunzip
    
      33options=('libtool' '!strip' '!makeflags' '!buildflags' 'staticlibs')
    
      34source=("https://www.xilinx.com/content/dam/xilinx/publications/solarflare/onload/openonload/9_0_2_47/sf-109585-ls-47-openonload-release-package.zip"
    
      35        'openonload.install'
    
      36        'openonload.service'
    
      37	'openonload-9_0_2_140-noegrep.patch'
    
      38)
    
      39sha512sums=('227159ddd9e6236a2ecdde0464cadb411524a0a842fc615298deda1018d428fec42bc09fed23d1a89311acd379af80176569db48efc9b643dd71b1f3323f9dd5'
    
      40            '68e6ed6ea8a6f8b62dfdb291354385015c977603c8b5ee0ae321c7f0177cedb30a6abdade9c2de76bf00d88bcd095c028e1c9bd6fef535f34f0273acca1ff02c'
    
      41            'b7e4529e37c64f99c660ca9b58f388cdd8f0d2f250ba875eb210f4909bb1f1c985a065aae64c048ca6f824adc6e3176c6eae1f582c049631326db73e939edd7b'
    
      42            '835d5150284de22c956dc11526dd6ab3c379f4f1728d9a3501e7470fc8fa38ff54d29a79d3d654cc74c230520384989efd5d61b2d4034060a8c7e856e8e33fa9')
    
      43
    
      44install="openonload.install"
    
      45
    
      46if [[ -z "$_kernelver" ]]; then
    
      47    #_kernelver="$(uname -r)"                                      # running
    
      48    _kernelver="$(pacman -Q linux-lts | cut -d' ' -f2)-lts"        # installed
    
      49fi
    
      50
    
      51prepare() {
    
      52  cd "${srcdir}/"
    
      53
    
      54  tar xzf ${pkgname##open}-${pkgver}.tgz
    
      55
    
      56  cd "${pkgname##open}-${pkgver}"
    
      57  patch -p1 < "${srcdir}/openonload-9_0_2_140-noegrep.patch"
    
      58}
    
      59
    
      60build() {
    
      61  cd "${srcdir}/${pkgname##open}-${pkgver}"
    
      62
    
      63  case $CARCH in
    
      64    "i686")
    
      65      # x86 (32 bit) build
    
      66      ./scripts/onload_build --kernelver "$_kernelver" --user32 ${DEBUG:+--debug}
    
      67    ;;
    
      68    "x86_64")
    
      69      # x64 build
    
      70      ./scripts/onload_build --kernelver "$_kernelver" ${DEBUG:+--debug}
    
      71    ;;
    
      72    *)
    
      73      # unsupported
    
      74      echo "Unsupported architecture."
    
      75      exit 1
    
      76    ;;
    
      77  esac
    
      78}
    
      79
    
      80package() {
    
      81  cd "${srcdir}/${pkgname##open}-${pkgver}"
    
      82
    
      83  # OpenOnload:
    
      84  install -dm755 "${pkgdir}/etc/modprobe.d"
    
      85  install -dm755 "${pkgdir}/etc/depmod.d"
    
      86  i_prefix="${pkgdir}" ./scripts/onload_install --verbose \
    
      87      --kernelver "$_kernelver" \
    
      88      --kernelmodulesdir="/usr/lib/modules" \
    
      89      --moddir="extramodules" \
    
      90      ${DEBUG:+--debug} --nobuild
    
      91  rm -f "${pkgdir}/etc/modprobe.conf" # may be created by onload_install
    
      92  mv "${pkgdir}/usr/lib64/"* "${pkgdir}/usr/lib/"
    
      93  rmdir "${pkgdir}/usr/lib64"
    
      94  mv "${pkgdir}/sbin/"* "${pkgdir}/usr/bin/"
    
      95  rmdir "${pkgdir}/sbin"
    
      96  mv "${pkgdir}/usr/sbin/"* "${pkgdir}/usr/bin/"
    
      97  rmdir "${pkgdir}/usr/sbin"
    
      98
    
      99  install -Dm755 scripts/onload_install \
    
      100                                  "${pkgdir}/usr/lib/onload/onload_install"
    
      101
    
      102  install -Dm644 "${srcdir}/openonload.service" \
    
      103                                  "${pkgdir}/usr/lib/systemd/system/openonload.service"
    
      104
    
      105  # ef_vi libraries:
    
      106  install -dm755                  "${pkgdir}/usr/lib/"
    
      107  install -m644 build/gnu_${CARCH}/lib/ciul/libciul.so.1.1.1 \
    
      108      "${pkgdir}/usr/lib/"
    
      109  ln -s /usr/lib/libciul.so.1.1.1 ${pkgdir}/usr/lib/libciul.so.1
    
      110  ln -s /usr/lib/libciul.so.1.1.1 ${pkgdir}/usr/lib/libciul.so
    
      111
    
      112  install -m644 build/gnu_${CARCH}/lib/ciul/lib{ciul,efvi}1.a \
    
      113      "${pkgdir}/usr/lib/"
    
      114
    
      115  # Install documentation:
    
      116  install -dm755                  "${pkgdir}/usr/share/doc/openonload"
    
      117  install -m644 ChangeLog         "${pkgdir}/usr/share/doc/openonload"
    
      118  install -m644 LICENSE           "${pkgdir}/usr/share/doc/openonload"
    
      119  install -m644 README            "${pkgdir}/usr/share/doc/openonload"
    
      120  install -m644 README.ef_vi      "${pkgdir}/usr/share/doc/openonload"
    
      121  install -m644 ReleaseNotes      "${pkgdir}/usr/share/doc/openonload"
    
      122  install -m644 ReleaseNotes-sfc  "${pkgdir}/usr/share/doc/openonload"
    
      123
    
      124  # Install ef_vi tests/samples:
    
      125  install -dm755                  "${pkgdir}/usr/share/openonload/examples"
    
      126  cp -r "src/tests/."             "${pkgdir}/usr/share/openonload/examples/."
    
      127  chmod -R a=rX                   "${pkgdir}/usr/share/openonload/examples"
    
      128
    
      129  # Install LICENSE file:
    
      130  install -dm755                  "${pkgdir}/usr/share/licenses/openonload"
    
      131  ln -s "/usr/share/doc/openonload/LICENSE" \
    
      132                                  "${pkgdir}/usr/share/licenses/openonload"
    
      133
    
      134}
    
      135

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2