gki-kernel

The script is primarily a build orchestrator, but it contains a critical supply-chain weakness: it downloads a remote `setup.sh` script at runtime from a raw URL and executes it directly (`curl ... | bash -`) without pinning or integrity verification. Since that script can modify the kernel source tree that the subsequent build compiles, compromise of the upstream script or related supply-chain components could result in malicious or unwanted kernel artifacts. Other behaviors (repo init/sync, git commit, background build with logging) are expected for this workflow but still contribute to the end-to-end risk profile.

No direct malware behavior is evident in the provided documentation fragment. However, it explicitly instructs running a remotely fetched `setup.sh` via `curl ... | bash -` without showing integrity pinning/verification, and that script is described as patching kernel build files to include a security-sensitive kernel module capability. This creates a meaningful supply-chain risk: if the remote script or referenced ref is compromised, arbitrary code can be executed during kernel build time and alter the resulting kernel artifacts. Recommend pinning to an immutable commit, verifying cryptographic integrity of the downloaded installer, and reviewing the installer’s actions before execution.