penguin-burner

LOW

maintainer jpietek 2 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds and installs a Rust daemon binary and Python wheel from the project's own source code; the flagged privileged install refers to standard post-install setup handled by the package manager, not self-updating or unauthorized privilege escalation.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds and installs a Rust daemon binary and Python wheel from the project's own source code; the flagged privileged install refers to standard post-install setup handled by the package manager, not self-updating or unauthorized privilege escalation.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:46 rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: PenguinBurner contributors
    
      2
    
      3pkgname=penguin-burner
    
      4pkgver=0.8.3
    
      5pkgrel=1
    
      6pkgdesc='Automatic NVIDIA GPU undervolting, overclocking and adaptive per-game tuning'
    
      7arch=('x86_64')
    
      8url='https://github.com/jpietek/PenguinBurner'
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
'bash'
    
'hicolor-icon-theme'
    
'pyside6>=6.7'
    
'python'
    
'python-colorama>=0.4'
    
'python-pyqtgraph>=0.13'
    
'python-yaml>=6.0'
    
      18)
    
      19makedepends=(
    
'cargo'
    
'cmake'
    
# The 32-bit companion Vulkan layer, which is the only thing a 32-bit game's
    
# i386 winevulkan can load. Both live in [multilib] -- already enabled on any
    
# machine that can run a 32-bit game at all, since its lib32 Vulkan driver
    
# comes from there too.
    
'lib32-gcc-libs'
    
'lib32-glibc'
    
'mingw-w64-gcc'
    
'python-build'
    
'python-installer'
    
'python-setuptools'
    
'python-wheel'
    
'vulkan-headers'
    
      34)
    
      35source=("${pkgname}-${pkgver}.tar.gz::https://github.com/jpietek/PenguinBurner/archive/refs/tags/v${pkgver}.tar.gz")
    
      36sha256sums=('SKIP')
    
      37
    
      38build() {
    
cd "PenguinBurner-${pkgver}"
    
# The virtual cargo dependency can be supplied by rustup, whose proxy is
    
# not a compiler. Bootstrap as the makepkg user, without replacing an
    
# existing default toolchain; preserve an explicitly selected toolchain.
    
if command -v rustup >/dev/null 2>&1 &&
    
    [[ "$(command -v cargo)" -ef "$(command -v rustup)" ]]; then
    
  export RUSTUP_TOOLCHAIN="${RUSTUP_TOOLCHAIN:-stable}"
    
  rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal --no-self-update
    
fi
    
cargo --version
    
rustc --version
    
      50
    
# Both the wheel builder and the explicit daemon build below invoke Cargo.
    
# Some Arch derivatives lack the triple-prefixed linker expected by rustc.
    
if ! command -v x86_64-linux-gnu-gcc >/dev/null 2>&1; then
    
  export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=gcc
    
fi
    
export PENGUIN_BURNER_REQUIRE_DAEMON=1
    
export PENGUIN_BURNER_REQUIRE_NATIVE_LAYER=1
    
# Fail the build rather than quietly shipping an overlay that never appears
    
# in a 32-bit game; the lib32 makedepends above provide the toolchain.
    
export PENGUIN_BURNER_REQUIRE_NATIVE_LAYER32=1
    
# MinGW cross-compiles the NVAPI latency shim into the wheel; fail loudly
    
# if the toolchain is missing instead of shipping the feature hollow.
    
export PENGUIN_BURNER_REQUIRE_NVAPI_SHIM=1
    
# CachyOS resolves the mingw-w64-gcc makedepend to llvm-mingw from its own
    
# repo, which ships the same-named cross compilers off-PATH under
    
# /opt/llvm-mingw. Surface them so the shim build finds a toolchain.
    
if ! command -v x86_64-w64-mingw32-g++ >/dev/null 2>&1 &&
    
    [[ -x /opt/llvm-mingw/bin/x86_64-w64-mingw32-g++ ]]; then
    
  export PATH="/opt/llvm-mingw/bin:${PATH}"
    
fi
    
python -m build --wheel --no-isolation --skip-dependency-check
    
      72
    
# Root daemon: compiled from the bundled Rust crate in burnerd/. --locked
    
# pins the committed Cargo.lock; crates.io is fetched during build() (makepkg
    
# allows network there by default).
    
cargo build --release --locked --manifest-path burnerd/Cargo.toml
    
      77}
    
      78
    
      79package() {
    
cd "PenguinBurner-${pkgver}"
    
python -m installer --destdir="${pkgdir}" dist/*.whl
    
# Package-owned source copied to the canonical /var/opt target at setup.
    
install -Dm755 burnerd/target/release/penguin-burnerd \
    
  "${pkgdir}/usr/libexec/penguin-burnerd"
    
      85}
    
      86

Changes since previous scan

--- PKGBUILD @ 2026-09-22 21:39
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,8 +1,8 @@
 # Maintainer: PenguinBurner contributors
 
 pkgname=penguin-burner
-pkgver=0.8.2
-pkgrel=2
+pkgver=0.8.3
+pkgrel=1
 pkgdesc='Automatic NVIDIA GPU undervolting, overclocking and adaptive per-game tuning'
 arch=('x86_64')
 url='https://github.com/jpietek/PenguinBurner'
@@ -37,6 +37,23 @@
 
 build() {
   cd "PenguinBurner-${pkgver}"
+  # The virtual cargo dependency can be supplied by rustup, whose proxy is
+  # not a compiler. Bootstrap as the makepkg user, without replacing an
+  # existing default toolchain; preserve an explicitly selected toolchain.
+  if command -v rustup >/dev/null 2>&1 &&
+      [[ "$(command -v cargo)" -ef "$(command -v rustup)" ]]; then
+    export RUSTUP_TOOLCHAIN="${RUSTUP_TOOLCHAIN:-stable}"
+    rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal --no-self-update
+  fi
+  cargo --version
+  rustc --version
+
+  # Both the wheel builder and the explicit daemon build below invoke Cargo.
+  # Some Arch derivatives lack the triple-prefixed linker expected by rustc.
+  if ! command -v x86_64-linux-gnu-gcc >/dev/null 2>&1; then
+    export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=gcc
+  fi
+  export PENGUIN_BURNER_REQUIRE_DAEMON=1
   export PENGUIN_BURNER_REQUIRE_NATIVE_LAYER=1
   # Fail the build rather than quietly shipping an overlay that never appears
   # in a 32-bit game; the lib32 makedepends above provide the toolchain.
@@ -53,13 +70,6 @@
   fi
   python -m build --wheel --no-isolation --skip-dependency-check
 
-  # Arch's rust 1.98 bakes the triple-prefixed x86_64-linux-gnu-gcc in as the
-  # default linker; the matching symlink only ships with gcc 16.2.1+r23. On
-  # hosts whose gcc predates it (partial upgrades, lagging derivatives) cargo
-  # cannot exec the linker, so fall back to plain gcc there.
-  if ! command -v x86_64-linux-gnu-gcc >/dev/null 2>&1; then
-    export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=gcc
-  fi
   # Root daemon: compiled from the bundled Rust crate in burnerd/. --locked
   # pins the committed Cargo.lock; crates.io is fetched during build() (makepkg
   # allows network there by default).

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 11:13:20	Medium	1
2026-09-22 21:39:17	Clean	0
2026-09-21 21:36:21	Clean	0
2026-09-06 21:12:32	Clean	0
2026-08-31 09:44:49	Clean	0
2026-08-20 13:11:31	Clean	0
2026-07-16 13:51:33	Clean	0
2026-07-15 15:49:13	Clean	0
2026-07-14 13:45:26	Clean	0
2026-07-08 13:28:23	Clean	0
2026-06-23 20:18:13	Clean	0
2026-06-18 16:11:54	Clean	0