authentik-agent-desktop-bin

LOW

maintainer jonathanio 0 votes base authentik-platform-bin scanned 2026-10-24 00:14:55.209548

View on AUR

Why flagged

Prebuilt .deb binaries are downloaded from pkg.goauthentik.io, which is the official package repository for the goauthentik project (matching the upstream GitHub URL), with sha256 checksums provided; the non-standard host is the project's own official distribution infrastructure, not an unrelated swappable source.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Prebuilt .deb binaries are downloaded from pkg.goauthentik.io, which is the official package repository for the goauthentik project (matching the upstream GitHub URL), with sha256 checksums provided; the non-standard host is the project's own official distribution infrastructure, not an unrelated swappable source.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=("authentik-agent.deb::https://pkg.goauthentik.io/pool/main/a/authentik-agent/authentik-agent_${pkgver}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jonathan Wright <jon@than.io>
    
      2# Built upon authentik-platform-git PKGBUILD by Matt Cuneo <m@cuneu.au>
    
      3
    
      4pkgbase="authentik-platform-bin"
    
      5pkgdesc='authentik Platform authentication, Agent, CLI and other components'
    
      6pkgname=('authentik-cli-bin' 
    
      7         'authentik-agent-bin' 
    
      8         'authentik-sysd-bin'
    
      9         'libpam-authentik-bin' 
    
      10         'libnss-authentik-bin')
    
      11pkgver=0.72.1
    
      12pkgrel=1
    
      13url="https://github.com/goauthentik/platform"
    
      14license=('MIT')
    
      15makedepends=()
    
      16arch=('x86_64'
    
      17      'aarch64')
    
      18options=('!strip')
    
      19
    
      20source=('authentik-nss.install'
    
      21        'authentik-pam.install'
    
      22        'authentik-sysd.install')
    
      23source_x86_64=("authentik-agent.deb::https://pkg.goauthentik.io/pool/main/a/authentik-agent/authentik-agent_${pkgver}_amd64.deb"
    
      24               "authentik-cli.deb::https://pkg.goauthentik.io/pool/main/a/authentik-cli/authentik-cli_${pkgver}_amd64.deb"
    
      25               "authentik-sysd.deb::https://pkg.goauthentik.io/pool/main/a/authentik-sysd/authentik-sysd_${pkgver}_amd64.deb"
    
      26               "libnss-authentik.deb::https://pkg.goauthentik.io/pool/main/libn/libnss-authentik/libnss-authentik_${pkgver}_amd64.deb"
    
      27               "libpam-authentik.deb::https://pkg.goauthentik.io/pool/main/libp/libpam-authentik/libpam-authentik_${pkgver}_amd64.deb")
    
      28
    
      29source_aarch64=("authentik-agent.deb::https://pkg.goauthentik.io/pool/main/a/authentik-agent/authentik-agent_${pkgver}_arm64.deb"
    
      30                "authentik-cli.deb::https://pkg.goauthentik.io/pool/main/a/authentik-cli/authentik-cli_${pkgver}_arm64.deb"
    
      31                "authentik-sysd.deb::https://pkg.goauthentik.io/pool/main/a/authentik-sysd/authentik-sysd_${pkgver}_arm64.deb"
    
      32                "libnss-authentik.deb::https://pkg.goauthentik.io/pool/main/libn/libnss-authentik/libnss-authentik_${pkgver}_arm64.deb"
    
      33                "libpam-authentik.deb::https://pkg.goauthentik.io/pool/main/libp/libpam-authentik/libpam-authentik_${pkgver}_arm64.deb")
    
      34
    
      35sha256sums=('16e52ff7d18c8aa97edc8f0b06da0ac0f45f4a87ca0ce3a8cf700b5477cfaf57'
    
      36            '1db5d2f9fb1d5d6e5f9cca34e58f1b3b9f55e161d478c76198a4889dfca9fada'
    
      37            'ce6e0895be72586d3944c2b1efdffc3ee16d9e8897690a07f44be733d19b77cf')
    
      38sha256sums_x86_64=('8addaff7f9e913911fc7efc3b065553d05d0e898a62e6d6ce213950a4942056a'
    
      39                   '746dc23ab7e785f093081667ba0a137948ebd13410f43075f3a5b751e491bf97'
    
      40                   'bb83912f2d8d09d22641c0f1122e48afc23ce820ea2b844b50436e0f121ee7e7'
    
      41                   '323bf9ddcc15d27d78dadc2d16bebcf957bad1b84de3cea1b05b4756c062ba0a'
    
      42                   'b0f0d4adee1a9a524d33dadfc062d0afe4d684d69a9fb98970a13e9d5b973d4a')
    
      43sha256sums_aarch64=('8addaff7f9e913911fc7efc3b065553d05d0e898a62e6d6ce213950a4942056a'
    
      44                    '746dc23ab7e785f093081667ba0a137948ebd13410f43075f3a5b751e491bf97'
    
      45                    'bb83912f2d8d09d22641c0f1122e48afc23ce820ea2b844b50436e0f121ee7e7'
    
      46                    '323bf9ddcc15d27d78dadc2d16bebcf957bad1b84de3cea1b05b4756c062ba0a'
    
      47                    'b0f0d4adee1a9a524d33dadfc062d0afe4d684d69a9fb98970a13e9d5b973d4a')
    
      48
    
      49noextract=('authentik-agent.deb'
    
      50           'authentik-cli.deb'
    
      51           'authentik-sysd.deb'
    
      52           'libnss-authentik.deb'
    
      53           'libpam-authentik.deb')
    
      54
    
      55prepare() {
    
      56  true # Do nothing
    
      57}
    
      58
    
      59package_authentik-sysd-bin() {
    
      60  pkgdesc="authentik System Agent"
    
      61  provides=(authentik-sysd)
    
      62  conflicts=(authentik-sysd)
    
      63  backup=(etc/authentik/config.json)
    
      64  install=authentik-sysd.install
    
      65
    
      66  optdepends=(
    
      67    'libnss-authentik: Make the system aware of Authentik users'
    
      68    'libpam-authentik: Allow logging in as an Authentik user'
    
      69  )
    
      70
    
      71  bsdtar -O -xf "authentik-sysd.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      72}
    
      73
    
      74package_authentik-agent-bin() {
    
      75  pkgdesc="authentik Agent"
    
      76  provides=(authentik-agent)
    
      77  conflicts=(authentik-agent)
    
      78  depends=(authentik-sysd authentik-cli)
    
      79
    
      80  bsdtar -O -xf "authentik-agent.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      81}
    
      82
    
      83package_authentik-cli-bin() {
    
      84  pkgdesc="authentik CLI"
    
      85  provides=(authentik-cli)
    
      86  conflicts=(authentik-cli)
    
      87  depends=(authentik-agent authentik-sysd)
    
      88
    
      89  bsdtar -O -xf "authentik-cli.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      90}
    
      91
    
      92package_libnss-authentik-bin() {
    
      93  depends=(authentik-sysd)
    
      94  provides=(libnss-authentik)
    
      95  conflicts=(libnss-authentik authentik-nss)
    
      96  pkgdesc="Authentik NSS module that makes the system aware of Authentik users"
    
      97  install=authentik-nss.install
    
      98
    
      99  bsdtar -O -xf "libnss-authentik.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      100}
    
      101
    
      102package_libpam-authentik-bin() {
    
      103  depends=(authentik-sysd)
    
      104  provides=(libpam-authentik)
    
      105  conflicts=(libpam-authentik authentik-pam)
    
      106  pkgdesc="Authentik PAM module to enable logging in with Authentik credentials"
    
      107  install=authentik-pam.install
    
      108
    
      109  bsdtar -O -xf "libnss-authentik.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      110}
    
      111

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 00:14:55	Low	2
2026-10-23 21:41:06	Low	2
2026-10-23 21:38:30	Medium	1