r-torch

MEDIUM

maintainer BioArchLinuxBot 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt binaries (libtorch and lantern) from non-standard hosts (pytorch.org and torch-cdn.mlverse.org) which are not the official CRAN repository; while these hosts are likely legitimate, the binaries are not verifiable via standard R package checks and could pose a supply-chain risk if compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:39 https://download.pytorch.org/libtorch/cpu/libtorch-shared-with-deps-2.8.0+cpu.zip
PKGBUILD:40 https://torch-cdn.mlverse.org/binaries/refs/heads/cran/v${_pkgver}/latest/lantern-$_pkgver+cpu+x86_64-Linux.zip

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt binaries (libtorch and lantern) from non-standard hosts (pytorch.org and torch-cdn.mlverse.org) which are not the official CRAN repository; while these hosts are likely legitimate, the binaries are not verifiable via standard R package checks and could pose a supply-chain risk if compromised.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: sukanka <su975853527@gmail.com>
    
      2
    
      3_pkgname=torch
    
      4_pkgver=0.17.0
    
      5pkgname=r-${_pkgname,,}
    
      6pkgver=${_pkgver//-/.}
    
      7pkgrel=4
    
      8pkgdesc="Tensors and Neural Networks with 'GPU' Acceleration"
    
      9arch=(x86_64)
    
      10url="https://cran.r-project.org/package=$_pkgname"
    
      11license=('MIT')
    
      12depends=(
    
      13  r-bit64
    
      14  r-callr
    
      15  r-cli
    
      16  r-coro
    
      17  r-desc
    
      18  r-glue
    
      19  r-jsonlite
    
      20  r-magrittr
    
      21  r-r6
    
      22  r-rcpp
    
      23  r-rlang
    
      24  r-safetensors
    
      25  r-scales
    
      26  r-withr
    
      27)
    
      28optdepends=(
    
      29  r-covr
    
      30  r-katex
    
      31  r-knitr
    
      32  r-mvtnorm
    
      33  r-numderiv
    
      34  r-palmerpenguins
    
      35  r-rmarkdown
    
      36  r-testthat
    
      37)
    
      38source=("https://cran.r-project.org/src/contrib/${_pkgname}_${_pkgver}.tar.gz"
    
      39  https://download.pytorch.org/libtorch/cpu/libtorch-shared-with-deps-2.8.0+cpu.zip
    
      40  https://torch-cdn.mlverse.org/binaries/refs/heads/cran/v${_pkgver}/latest/lantern-$_pkgver+cpu+x86_64-Linux.zip
    
      41)
    
      42md5sums=('962471bc62a5a8a35e4bcc14bc0e27e5'
    
      43         'cedcb2102f9734543df22a8e33523e2f'
    
      44         'f69b8b2f6a2229fb35e0f6c4903333dd')
    
      45b2sums=('0f19ee2587008374a5c64dfa3bdf109562e0057258b3e8a46f3b483b2faad8f4a51840480a91bcd9a39dd429a5886fcc656949ba9d76155e538d0192ca55cea4'
    
      46        'a2453310eb45ff42ca1fa5938429e1a2cdfe9a15821baa29e2b275f4fe9a2d2c78948886cfb130bfd3177e534520924f3e39d1bad57bcf90704eb75de2ece7b7'
    
      47        '600cce08b214ff811104276ea1fe989e88c9c274d84eaccdf0efa96514ee43ca2eb9b9153e7dbf25d1a2620028b10568a53be879c3bf34575fd5fbd19cd5cb5f')
    
      48
    
      49build() {
    
      50  mkdir build
    
      51  R CMD INSTALL -l build "$_pkgname"
    
      52}
    
      53
    
      54package() {
    
      55  install -d "$pkgdir/usr/lib/R/library"
    
      56  cp -a --no-preserve=ownership "build/$_pkgname" "$pkgdir/usr/lib/R/library"
    
      57  # We do it manually:
    
      58  cp -a $srcdir/libtorch/* $pkgdir/usr/lib/R/library/torch/
    
      59  cp -a $srcdir/lantern-$_pkgver+cpu+x86_64-Linux/* $pkgdir/usr/lib/R/library/torch/
    
      60
    
      61  install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      62  ln -s "/usr/lib/R/library/$_pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname"
    
      63}
    
      64

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2