r-torch

maintainer BioArchLinuxBot · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt binaries (libtorch and lantern) from non-standard hosts (pytorch.org and torch-cdn.mlverse.org) which are not the official CRAN repository; while these hosts are likely legitimate, the binaries are not verifiable via standard R package checks and could pose a supply-chain risk if compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:39 https://download.pytorch.org/libtorch/cpu/libtorch-shared-with-deps-2.8.0+cpu.zip
PKGBUILD:40 https://torch-cdn.mlverse.org/binaries/refs/heads/cran/v${_pkgver}/latest/lantern-$_pkgver+cpu+x86_64-Linux.zip

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt binaries (libtorch and lantern) from non-standard hosts (pytorch.org and torch-cdn.mlverse.org) which are not the official CRAN repository; while these hosts are likely legitimate, the binaries are not verifiable via standard R package checks and could pose a supply-chain risk if compromised.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: sukanka <su975853527@gmail.com>
    
      2
    
      3_pkgname=torch
    
      4_pkgver=0.17.0
    
      5pkgname=r-${_pkgname,,}
    
      6pkgver=${_pkgver//-/.}
    
      7pkgrel=4
    
      8pkgdesc="Tensors and Neural Networks with 'GPU' Acceleration"
    
      9arch=(x86_64)
    
      10url="https://cran.r-project.org/package=$_pkgname"
    
      11license=('MIT')
    
      12depends=(
    
      13  r-bit64
    
      14  r-callr
    
      15  r-cli
    
      16  r-coro
    
      17  r-desc
    
      18  r-glue
    
      19  r-jsonlite
    
      20  r-magrittr
    
      21  r-r6
    
      22  r-rcpp
    
      23  r-rlang
    
      24  r-safetensors
    
      25  r-scales
    
      26  r-withr
    
      27)
    
      28optdepends=(
    
      29  r-covr
    
      30  r-katex
    
      31  r-knitr
    
      32  r-mvtnorm
    
      33  r-numderiv
    
      34  r-palmerpenguins
    
      35  r-rmarkdown
    
      36  r-testthat
    
      37)
    
      38source=("https://cran.r-project.org/src/contrib/${_pkgname}_${_pkgver}.tar.gz"
    
      39  https://download.pytorch.org/libtorch/cpu/libtorch-shared-with-deps-2.8.0+cpu.zip
    
      40  https://torch-cdn.mlverse.org/binaries/refs/heads/cran/v${_pkgver}/latest/lantern-$_pkgver+cpu+x86_64-Linux.zip
    
      41)
    
      42md5sums=('962471bc62a5a8a35e4bcc14bc0e27e5'
    
      43         'cedcb2102f9734543df22a8e33523e2f'
    
      44         'f69b8b2f6a2229fb35e0f6c4903333dd')
    
      45b2sums=('0f19ee2587008374a5c64dfa3bdf109562e0057258b3e8a46f3b483b2faad8f4a51840480a91bcd9a39dd429a5886fcc656949ba9d76155e538d0192ca55cea4'
    
      46        'a2453310eb45ff42ca1fa5938429e1a2cdfe9a15821baa29e2b275f4fe9a2d2c78948886cfb130bfd3177e534520924f3e39d1bad57bcf90704eb75de2ece7b7'
    
      47        '600cce08b214ff811104276ea1fe989e88c9c274d84eaccdf0efa96514ee43ca2eb9b9153e7dbf25d1a2620028b10568a53be879c3bf34575fd5fbd19cd5cb5f')
    
      48
    
      49build() {
    
      50  mkdir build
    
      51  R CMD INSTALL -l build "$_pkgname"
    
      52}
    
      53
    
      54package() {
    
      55  install -d "$pkgdir/usr/lib/R/library"
    
      56  cp -a --no-preserve=ownership "build/$_pkgname" "$pkgdir/usr/lib/R/library"
    
      57  # We do it manually:
    
      58  cp -a $srcdir/libtorch/* $pkgdir/usr/lib/R/library/torch/
    
      59  cp -a $srcdir/lantern-$_pkgver+cpu+x86_64-Linux/* $pkgdir/usr/lib/R/library/torch/
    
      60
    
      61  install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      62  ln -s "/usr/lib/R/library/$_pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname"
    
      63}
    
      64

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,7 +4,7 @@
 _pkgver=0.17.0
 pkgname=r-${_pkgname,,}
 pkgver=${_pkgver//-/.}
-pkgrel=1
+pkgrel=4
 pkgdesc="Tensors and Neural Networks with 'GPU' Acceleration"
 arch=(x86_64)
 url="https://cran.r-project.org/package=$_pkgname"
@@ -35,9 +35,16 @@
   r-rmarkdown
   r-testthat
 )
-source=("https://cran.r-project.org/src/contrib/${_pkgname}_${_pkgver}.tar.gz")
-md5sums=('962471bc62a5a8a35e4bcc14bc0e27e5')
-b2sums=('0f19ee2587008374a5c64dfa3bdf109562e0057258b3e8a46f3b483b2faad8f4a51840480a91bcd9a39dd429a5886fcc656949ba9d76155e538d0192ca55cea4')
+source=("https://cran.r-project.org/src/contrib/${_pkgname}_${_pkgver}.tar.gz"
+  https://download.pytorch.org/libtorch/cpu/libtorch-shared-with-deps-2.8.0+cpu.zip
+  https://torch-cdn.mlverse.org/binaries/refs/heads/cran/v${_pkgver}/latest/lantern-$_pkgver+cpu+x86_64-Linux.zip
+)
+md5sums=('962471bc62a5a8a35e4bcc14bc0e27e5'
+         'cedcb2102f9734543df22a8e33523e2f'
+         'f69b8b2f6a2229fb35e0f6c4903333dd')
+b2sums=('0f19ee2587008374a5c64dfa3bdf109562e0057258b3e8a46f3b483b2faad8f4a51840480a91bcd9a39dd429a5886fcc656949ba9d76155e538d0192ca55cea4'
+        'a2453310eb45ff42ca1fa5938429e1a2cdfe9a15821baa29e2b275f4fe9a2d2c78948886cfb130bfd3177e534520924f3e39d1bad57bcf90704eb75de2ece7b7'
+        '600cce08b214ff811104276ea1fe989e88c9c274d84eaccdf0efa96514ee43ca2eb9b9153e7dbf25d1a2620028b10568a53be879c3bf34575fd5fbd19cd5cb5f')
 
 build() {
   mkdir build
@@ -47,6 +54,9 @@
 package() {
   install -d "$pkgdir/usr/lib/R/library"
   cp -a --no-preserve=ownership "build/$_pkgname" "$pkgdir/usr/lib/R/library"
+  # We do it manually:
+  cp -a $srcdir/libtorch/* $pkgdir/usr/lib/R/library/torch/
+  cp -a $srcdir/lantern-$_pkgver+cpu+x86_64-Linux/* $pkgdir/usr/lib/R/library/torch/
 
   install -d "$pkgdir/usr/share/licenses/$pkgname"
   ln -s "/usr/lib/R/library/$_pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 19:12:33	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0