stockfish

maintainer niklasf · 169 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host is used only to download pre-trained neural network files (.nnue) for the chess engine, which are data assets, not executable code; the primary source is from the official GitHub repository, and the worst case of a swapped source is limited to model integrity, not remote code execution.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The non-standard host is used only to download pre-trained neural network files (.nnue) for the chess engine, which are data assets, not executable code; the primary source is from the official GitHub repository, and the worst case of a swapped source is limited to model integrity, not remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "https://tests.stockfishchess.org/api/nn/nn-${_net_name_big}.nnue"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: niklas.fiekas at backscattering dot de
    
      2# Contributor: mark.blakeney at bullet-systems dot net
    
      3# Contributor: Tod Jackson <tod.jackson@gmail.com>
    
      4# Contributor: Özgür Sarıer <echo b3pndXJzYXJpZXIxMDExNjAxMTE1QGdtYWlsLmNvbQo= | base64 -d>
    
      5# Contributor: user6553591 <Message on Reddit>
    
      6# Contributor: P. Badredin <p dot badredin at gmail dot com>
    
      7# Contributor: Justin Blanchard <UncombedCoconut at gmail dot com>
    
      8# Contributor: Auguste Pop < auguste [at] gmail [dot] com >
    
      9# Contributor: SandaruKasa <echo c2FuZGFydWthc2ErYXVyQHlhLnJ1Cg== | base64 -d>
    
      10# Contributor: bagasdotme
    
      11# Contributor: HurricanePootis
    
      12
    
      13pkgname=stockfish
    
      14pkgver=18
    
      15pkgrel=1
    
      16epoch=1
    
      17pkgdesc="A strong UCI chess engine"
    
      18arch=('x86_64' 'i686' 'armv7h' 'aarch64')
    
      19url="https://stockfishchess.org/"
    
      20license=('GPL-3.0')
    
      21depends=('glibc' 'gcc-libs')
    
      22# Check EvalFileDefaultName{Big,Small} in src/evaluate.h and change accordingly
    
      23_net_name_big=('c288c895ea92')
    
      24_net_name_small=('37f18f62d772')
    
      25source=("$pkgname-$pkgver.zip::https://github.com/official-stockfish/Stockfish/archive/sf_$pkgver.zip"
    
      26        "https://tests.stockfishchess.org/api/nn/nn-${_net_name_big}.nnue"
    
      27        "https://tests.stockfishchess.org/api/nn/nn-${_net_name_small}.nnue")
    
      28sha512sums=('1a0b36fc70146aefccc45a1647d04a5ac409df811a527fc7f679bb966271b5fd3348d3c9ecb3277ffcacda2dd760b6f06dbba677aa10b0553c445237e5ee544f'
    
      29            '9568d21d7b229ec9c8ee97363e94560858f3f44f4c6647ec11770f617b4a3b03cbcfa445c407f52a6104f281d43e19e0f461cc13c875218b543860ebc8411622'
    
      30            'bf4d01f8cbff94dbff484636dd0351cd66f37eeaea7b7dbe16a3bfe231ae78cfabdeed040b789b64049c6063ef0dca21e4a4f332b99e49a52993e8595e372839')
    
      31
    
      32prepare() {
    
      33  ln -sf "${srcdir}/nn-${_net_name_big}.nnue" "Stockfish-sf_${pkgver}/src"
    
      34  ln -sf "${srcdir}/nn-${_net_name_small}.nnue" "Stockfish-sf_${pkgver}/src"
    
      35}
    
      36
    
      37build() {
    
      38  cd "Stockfish-sf_${pkgver}/src"
    
      39
    
      40  if [[ "$CC" = "gcc" ]]
    
      41  then
    
      42    _COMP=gcc
    
      43  elif [[ "$CC" = "clang" ]]
    
      44  then
    
      45    _COMP=clang
    
      46  else
    
      47    _COMP=
    
      48  fi
    
      49
    
      50  COMP=${_COMP} make profile-build
    
      51}
    
      52
    
      53package() {
    
      54  cd "Stockfish-sf_${pkgver}/src"
    
      55  make PREFIX="$pkgdir/usr" install
    
      56}
    
      57
    
      58# vim:set ts=2 sw=2 et:
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2