akkoma-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt Elixir/OTP release binaries (executed code) from an S3-hosted URL (akkoma-updates.s3-website.fr-par.scw.cloud) rather than from a canonical release page tied to the project's official domain (akkoma.social or a well-known forge like GitLab/GitHub releases). This is a real supply-chain concern: the S3 bucket is controlled by the project maintainer(s) but is not cryptographically tied to the upstream project identity, and a bucket misconfiguration or compromise could silently swap the binaries. SHA-256 checksums are present and pinned per-version, which mitigates but does not eliminate the risk (the checksums themselves are only as trustworthy as the PKGBUILD commit). The binaries are installed directly into /opt/akkoma and run as a system service, so any compromise would result in code execution with service-level privileges. This is a textbook medium-severity supply-chain pattern: unofficial/personal/project-controlled object-storage host serving executed binaries, not clearly malicious but not using a verifiable release artifact from a well-known forge.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=("akkoma-amd64-${pkgver}.zip::https://akkoma-updates.s3-website.fr-par.scw.cloud/stable/akkoma-amd64.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt Elixir/OTP release binaries (executed code) from an S3-hosted URL (akkoma-updates.s3-website.fr-par.scw.cloud) rather than from a canonical release page tied to the project's official domain (akkoma.social or a well-known forge like GitLab/GitHub releases). This is a real supply-chain concern: the S3 bucket is controlled by the project maintainer(s) but is not cryptographically tied to the upstream project identity, and a bucket misconfiguration or compromise could silently swap the binaries. SHA-256 checksums are present and pinned per-version, which mitigates but does not eliminate the risk (the checksums themselves are only as trustworthy as the PKGBUILD commit). The binaries are installed directly into /opt/akkoma and run as a system service, so any compromise would result in code execution with service-level privileges. This is a textbook medium-severity supply-chain pattern: unofficial/personal/project-controlled object-storage host serving executed binaries, not clearly malicious but not using a verifiable release artifact from a well-known forge.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Bjoern Franke <bjo+aur@schafweide.org>
    
      2# based on pleroma-bin PKGBUILD
    
      3# Contributor: gudzpoz <gudzpoz ant live dot com>
    
      4# Contributor: Faye Jackson <justalittleepsilon ant gmail dot com>
    
      5
    
      6pkgname=akkoma-bin
    
      7pkgver=3.13.2
    
      8pkgrel=1
    
      9epoch=1
    
      10pkgdesc='a smallish microblogging platform, aka the cooler pleroma'
    
      11url='https://akkoma.social'
    
      12license=('AGPL' 'CCPL:cc-by-4.0' 'CCPL:cc-by-sa-4.0')
    
      13arch=(x86_64 aarch64)
    
      14depends=(ncurses file libxcrypt-compat)
    
      15optdepends=('postgresql: local postgresql database support'
    
      16            'imagemagick: Pleroma.Upload.Filters.Mogrify, Pleroma.Upload.Filters.Mogrifun support'
    
      17            'ffmpeg: media preview proxy support for videos'
    
      18            'perl-image-exiftool: supporting stripping location (GPS) data from uploaded images with Pleroma.Upload.Filters.Exiftool')
    
      19provides=(akkoma)
    
      20conflicts=(akkoma)
    
      21backup=('etc/akkoma/config.exs')
    
      22install=akkoma.install
    
      23source_x86_64=("akkoma-amd64-${pkgver}.zip::https://akkoma-updates.s3-website.fr-par.scw.cloud/stable/akkoma-amd64.zip")
    
      24source_aarch64=("akkoma-arm64-${pkgver}.zip::https://akkoma-updates.s3-website.fr-par.scw.cloud/stable/akkoma-arm64.zip")
    
      25source=('akkoma.sysusers'
    
      26        'akkoma.tmpfiles'
    
      27        'akkoma.service'
    
      28        'COPYING')
    
      29sha256sums=('0247ee5cc24049ebc37a00634aad8ed9a44d0f9a399a1373284375f5c861a089'
    
      30            '20715a673d70c3eafc160de98a325d1f253abc1dc89ff280d121c95ba5e9bb81'
    
      31            '83a90cf08dbe715a5c28545c85faba6fe9a76e0808ce8aa0aa7b54b718e35beb'
    
      32            '1da9737d28754b51adae10a6391c8e83c40fe052dc4b04438a1dd0587a5c9a41')
    
      33sha256sums_x86_64=('351278db9f709ac0a16b32c8a29ae41df79ab35e33406cf44a25a8349b9558e0')
    
      34sha256sums_aarch64=('5712957f30b90f83a1c19ba1563178e250630895fae813e5196acbfc627618a3')
    
      35
    
      36
    
      37
    
      38package() {
    
      39    cd "$srcdir"
    
      40
    
      41    mkdir -p "${pkgdir}/opt/akkoma"
    
      42    find release -executable -exec chmod a+rx {} \;
    
      43    cp -r release/* "${pkgdir}/opt/akkoma"
    
      44    install -Dm 644 akkoma.sysusers "${pkgdir}/usr/lib/sysusers.d/akkoma.conf"
    
      45    install -Dm 644 akkoma.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/akkoma.conf"
    
      46    install -Dm 644 akkoma.service "${pkgdir}/usr/lib/systemd/system/akkoma.service"
    
      47    install -Dm 644 COPYING "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2