stockfish

LOW

maintainer niklasf 170 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The non-standard host (tests.stockfishchess.org) hosts a neural network evaluation file (.nnue) used as data by the chess engine; it is not executable code and cannot lead to remote code execution, making the risk low despite the untrusted domain.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The non-standard host (tests.stockfishchess.org) hosts a neural network evaluation file (.nnue) used as data by the chess engine; it is not executable code and cannot lead to remote code execution, making the risk low despite the untrusted domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "https://tests.stockfishchess.org/api/nn/${_net_name}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: niklas.fiekas at backscattering dot de
    
      2# Contributor: mark.blakeney at bullet-systems dot net
    
      3# Contributor: Tod Jackson <tod.jackson@gmail.com>
    
      4# Contributor: Özgür Sarıer <echo b3pndXJzYXJpZXIxMDExNjAxMTE1QGdtYWlsLmNvbQo= | base64 -d>
    
      5# Contributor: user6553591 <Message on Reddit>
    
      6# Contributor: P. Badredin <p dot badredin at gmail dot com>
    
      7# Contributor: Justin Blanchard <UncombedCoconut at gmail dot com>
    
      8# Contributor: Auguste Pop < auguste [at] gmail [dot] com >
    
      9# Contributor: SandaruKasa <echo c2FuZGFydWthc2ErYXVyQHlhLnJ1Cg== | base64 -d>
    
      10# Contributor: bagasdotme
    
      11# Contributor: HurricanePootis
    
      12
    
      13pkgname=stockfish
    
      14pkgver=19
    
      15pkgrel=1
    
      16epoch=1
    
      17pkgdesc="A strong UCI chess engine"
    
      18arch=('x86_64' 'i686' 'armv7h' 'aarch64')
    
      19url="https://stockfishchess.org/"
    
      20license=('GPL-3.0')
    
      21depends=('glibc' 'gcc-libs')
    
      22_net_name="nn-1a298aa575a0.nnue" # From EvalFileDefaultName in src/evaluate.h
    
      23source=("$pkgname-$pkgver.zip::https://github.com/official-stockfish/Stockfish/archive/sf_$pkgver.zip"
    
      24        "https://tests.stockfishchess.org/api/nn/${_net_name}")
    
      25sha512sums=('49e073b15cf56d1aab7e2e23d883e5d1737b3176441051ca42c2214f8b606b919b95c7a7ca47051e133c02a49d77f68ebb072398a1ed18b8f7a27fcb1773a2d0'
    
      26            '136a0f9725da7b692894a080d03d61bbfc67dcabf2f869b008891dbf042dfacb74c75df12a48bb9a9c736ce3accd670a55afae5ee40f090a0b86558e459c70bb')
    
      27
    
      28prepare() {
    
      29  ln -sf "${srcdir}/${_net_name}" "Stockfish-sf_${pkgver}/src"
    
      30}
    
      31
    
      32build() {
    
      33  cd "Stockfish-sf_${pkgver}/src"
    
      34
    
      35  if [[ "$CC" = "gcc" ]]
    
      36  then
    
      37    _COMP=gcc
    
      38  elif [[ "$CC" = "clang" ]]
    
      39  then
    
      40    _COMP=clang
    
      41  else
    
      42    _COMP=
    
      43  fi
    
      44
    
      45  COMP=${_COMP} make profile-build
    
      46}
    
      47
    
      48package() {
    
      49  cd "Stockfish-sf_${pkgver}/src"
    
      50  make PREFIX="$pkgdir/usr" install
    
      51}
    
      52
    
      53# vim:set ts=2 sw=2 et:
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-09-05 00:16
+++ PKGBUILD @ 2026-09-17 00:27
@@ -11,7 +11,7 @@
 # Contributor: HurricanePootis
 
 pkgname=stockfish
-pkgver=18
+pkgver=19
 pkgrel=1
 epoch=1
 pkgdesc="A strong UCI chess engine"
@@ -19,19 +19,14 @@
 url="https://stockfishchess.org/"
 license=('GPL-3.0')
 depends=('glibc' 'gcc-libs')
-# Check EvalFileDefaultName{Big,Small} in src/evaluate.h and change accordingly
-_net_name_big=('c288c895ea92')
-_net_name_small=('37f18f62d772')
+_net_name="nn-1a298aa575a0.nnue" # From EvalFileDefaultName in src/evaluate.h
 source=("$pkgname-$pkgver.zip::https://github.com/official-stockfish/Stockfish/archive/sf_$pkgver.zip"
-        "https://tests.stockfishchess.org/api/nn/nn-${_net_name_big}.nnue"
-        "https://tests.stockfishchess.org/api/nn/nn-${_net_name_small}.nnue")
-sha512sums=('1a0b36fc70146aefccc45a1647d04a5ac409df811a527fc7f679bb966271b5fd3348d3c9ecb3277ffcacda2dd760b6f06dbba677aa10b0553c445237e5ee544f'
-            '9568d21d7b229ec9c8ee97363e94560858f3f44f4c6647ec11770f617b4a3b03cbcfa445c407f52a6104f281d43e19e0f461cc13c875218b543860ebc8411622'
-            'bf4d01f8cbff94dbff484636dd0351cd66f37eeaea7b7dbe16a3bfe231ae78cfabdeed040b789b64049c6063ef0dca21e4a4f332b99e49a52993e8595e372839')
+        "https://tests.stockfishchess.org/api/nn/${_net_name}")
+sha512sums=('49e073b15cf56d1aab7e2e23d883e5d1737b3176441051ca42c2214f8b606b919b95c7a7ca47051e133c02a49d77f68ebb072398a1ed18b8f7a27fcb1773a2d0'
+            '136a0f9725da7b692894a080d03d61bbfc67dcabf2f869b008891dbf042dfacb74c75df12a48bb9a9c736ce3accd670a55afae5ee40f090a0b86558e459c70bb')
 
 prepare() {
-  ln -sf "${srcdir}/nn-${_net_name_big}.nnue" "Stockfish-sf_${pkgver}/src"
-  ln -sf "${srcdir}/nn-${_net_name_small}.nnue" "Stockfish-sf_${pkgver}/src"
+  ln -sf "${srcdir}/${_net_name}" "Stockfish-sf_${pkgver}/src"
 }
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 14:00:22	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2