tux-burner

LOW

maintainer Grakul 0 votes scanned 2026-10-27 13:50:54.305876

View on AUR

Why flagged

The flagged line 64 is just a note in the .install hook telling the user to run 'sudo tburn-cli --install-systemd-service' themselves; no privileged code is executed automatically. The package builds from a GitHub release tarball of a plausibly project-owned repo, installs files normally, and the .install hook only copies config directories and prints messages. The main concerns are that this is a new/low-vote package from an unverified fork, but there is no obfuscation, no remote code execution, and no credential exfiltration.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The flagged line 64 is just a note in the .install hook telling the user to run 'sudo tburn-cli --install-systemd-service' themselves; no privileged code is executed automatically. The package builds from a GitHub release tarball of a plausibly project-owned repo, installs files normally, and the .install hook only copies config directories and prints messages. The main concerns are that this is a new/low-vote package from an unverified fork, but there is no obfuscation, no remote code execution, and no credential exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:64 rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Eugene Flanagin <eflanagin@pm.me>
    
      2#
    
      3# Tux Burner is a fork of PenguinBurner by jpietek (GPL-3.0-or-later).
    
      4# Tux Burner is Copyright (C) 2026 by Eugene Flanagin. Licensed under GPL-3.0-or-later.
    
      5#
    
      6# Changes compared with upstream's packaging/arch/PKGBUILD (all marked here):
    
      7#   * pkgname tux-burner, provides/conflicts penguin-burner and penguin-burner-amd,
    
      8#     replaces penguin-burner-amd (the earlier local AMD port).
    
      9#   * source is the Tux Burner source tarball (release asset, or `git archive` of work/).
    
      10#   * no NVAPI latency shim and no mingw-w64-gcc makedepend (NVIDIA/Windows only).
    
      11#   * AMD optdepends (OpenCL ICD, LACT, RADV); nothing providing libcuda is pulled in.
    
      12#   * tux-burner.install migrates /etc/penguin-burner and /var/lib/penguin-burner.
    
      13
    
      14pkgname=tux-burner
    
      15pkgver=0.99
    
      16pkgrel=1
    
      17pkgdesc='GPU undervolting, overclocking, and per-game tuning (AMD and NVIDIA)'
    
      18arch=('x86_64')
    
      19url='https://github.com/eugenesflanagin-spec/tux-burner'
    
      20license=('GPL-3.0-or-later')
    
      21provides=('penguin-burner' 'penguin-burner-amd')
    
      22conflicts=('penguin-burner' 'penguin-burner-amd')
    
      23replaces=('penguin-burner-amd')
    
      24install=tux-burner.install
    
      25depends=(
    
      26  'bash'
    
      27  'hicolor-icon-theme'
    
      28  'pyside6>=6.7'
    
      29  'python'
    
      30  'python-colorama>=0.4'
    
      31  'python-pyqtgraph>=0.13'
    
      32  'python-yaml>=6.0'
    
      33  'hwdata'
    
      34  'ocl-icd'
    
      35)
    
      36optdepends=(
    
      37  'rocm-opencl-runtime: AMD OpenCL ICD for the --amd-stress / --amd-auto-uv workload (rusticl also works)'
    
      38  'lact: when lactd runs it owns GPU tuning; use --amd-export-lact to hand it a plan'
    
      39  'vulkan-radeon: RADV, needed by the Q2RTX stability benchmark'
    
      40)
    
      41makedepends=(
    
      42  'cargo'
    
      43  'cmake'
    
      44  'lib32-gcc-libs'
    
      45  'lib32-glibc'
    
      46  'python-build'
    
      47  'python-installer'
    
      48  'python-setuptools'
    
      49  'python-wheel'
    
      50  'vulkan-headers'
    
      51)
    
      52source=("${pkgname}-${pkgver}.tar.gz::${url}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
    
      53        'tux-burner.install')
    
      54sha256sums=('741fccbafb0814563bc90325b1238f98f60ffbb897075e72178419278e0f264f'
    
      55            '245090698f989b17681a9f3fcf6315c2b7818be7472b488a0b92e116fbd3654f')
    
      56
    
      57build() {
    
      58  cd "${pkgname}-${pkgver}"
    
      59  # The virtual cargo dependency can be supplied by rustup, whose proxy is not a
    
      60  # compiler. Bootstrap as the makepkg user, without replacing a default toolchain.
    
      61  if command -v rustup >/dev/null 2>&1 &&
    
      62      [[ "$(command -v cargo)" -ef "$(command -v rustup)" ]]; then
    
      63    export RUSTUP_TOOLCHAIN="${RUSTUP_TOOLCHAIN:-stable}"
    
      64    rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal --no-self-update
    
      65  fi
    
      66  cargo --version
    
      67  rustc --version
    
      68  if ! command -v x86_64-linux-gnu-gcc >/dev/null 2>&1; then
    
      69    export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=gcc
    
      70  fi
    
      71  export TUX_BURNER_REQUIRE_DAEMON=1
    
      72  export TUX_BURNER_REQUIRE_NATIVE_LAYER=1
    
      73  export TUX_BURNER_REQUIRE_NATIVE_LAYER32=1
    
      74  # Tux Burner change: the Reflex/NVAPI marker shim is NVIDIA/Windows only.
    
      75  export TUX_BURNER_BUILD_NVAPI_SHIM=0
    
      76  python -m build --wheel --no-isolation --skip-dependency-check
    
      77  cargo build --release --locked --manifest-path burnerd/Cargo.toml
    
      78}
    
      79
    
      80check() {
    
      81  cd "${pkgname}-${pkgver}"
    
      82  # Pure parsers and the engine's AMD apply path, tested against captured OD text;
    
      83  # no GPU needed.
    
      84  cargo test --release --locked --manifest-path burnerd/Cargo.toml -- amd
    
      85}
    
      86
    
      87package() {
    
      88  cd "${pkgname}-${pkgver}"
    
      89  python -m installer --destdir="${pkgdir}" dist/*.whl
    
      90  install -Dm755 burnerd/target/release/tux-burnerd "${pkgdir}/usr/libexec/tux-burnerd"
    
      91  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      92  install -Dm644 CREDITS.md "${pkgdir}/usr/share/licenses/${pkgname}/CREDITS.md"
    
      93  install -Dm644 CHANGELOG.md "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG.md"
    
      94  install -Dm644 docs/amd.md "${pkgdir}/usr/share/doc/${pkgname}/amd.md"
    
      95  install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      96  local f
    
      97  for f in docs/user-guide/*.md docs/user-guide/Tux-Burner-User-Guide.pdf docs/user-guide/Tux-Burner-User-Guide.html; do
    
      98    [ -f "$f" ] && install -Dm644 "$f" "${pkgdir}/usr/share/doc/${pkgname}/$(basename "$f")"
    
      99  done
    
      100  if [ -d docs/user-guide/images ]; then
    
      101    for f in docs/user-guide/images/*.png; do
    
      102      install -Dm644 "$f" "${pkgdir}/usr/share/doc/${pkgname}/images/$(basename "$f")"
    
      103    done
    
      104  fi
    
      105  install -Dm644 packaging/man/tburn-cli.1 "${pkgdir}/usr/share/man/man1/tburn-cli.1"
    
      106  ln -s tburn-cli.1 "${pkgdir}/usr/share/man/man1/tux-burner-cli.1"
    
      107  install -Dm644 packaging/man/tux-burner.1 "${pkgdir}/usr/share/man/man1/tux-burner.1"
    
      108  ln -s tux-burner.1 "${pkgdir}/usr/share/man/man1/tburn.1"
    
      109  install -Dm644 packaging/man/tux-burnerd.8 "${pkgdir}/usr/share/man/man8/tux-burnerd.8"
    
      110}
    
      111

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 13:50:54	Low	3
2026-10-27 13:48:00	Medium	2