aws-ecs-cli

maintainer JulianXhokaxhiu · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary from Amazon's S3 bucket (amazon-ecs-cli) and executes it. Several real concerns exist: (1) The source URL uses '-latest' rather than a versioned/pinned URL, meaning the downloaded binary can change at any time without the PKGBUILD being updated. (2) The MD5 checksum is fetched at build time from the same host as the binary itself, so a compromised host could serve both a malicious binary and a matching MD5 — the checksum provides zero integrity guarantee against a compromised upstream. (3) The binary is executed during the build phase (pkgver() runs it) before any independent verification. However, the S3 bucket 'amazon-ecs-cli' is the official AWS distribution channel for the ECS CLI tool (documented in AWS official docs), so the host itself is not 'unofficial' or 'personal'. The real risk is the rolling '-latest' URL with a self-referential checksum pattern, which is a genuine supply-chain concern: any update AWS pushes (or any compromise of that S3 bucket) would be silently picked up and executed. This is a medium-severity supply-chain risk due to the executed binary with no independent integrity verification, even though the host is official.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:4 _md5sum=$(curl -s https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-linux-amd64-latest.md5)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:4 _md5sum=$(curl -s https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-linux-amd64-latest.md5)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads a prebuilt binary from Amazon's S3 bucket (amazon-ecs-cli) and executes it. Several real concerns exist: (1) The source URL uses '-latest' rather than a versioned/pinned URL, meaning the downloaded binary can change at any time without the PKGBUILD being updated. (2) The MD5 checksum is fetched at build time from the same host as the binary itself, so a compromised host could serve both a malicious binary and a matching MD5 — the checksum provides zero integrity guarantee against a compromised upstream. (3) The binary is executed during the build phase (pkgver() runs it) before any independent verification. However, the S3 bucket 'amazon-ecs-cli' is the official AWS distribution channel for the ECS CLI tool (documented in AWS official docs), so the host itself is not 'unofficial' or 'personal'. The real risk is the rolling '-latest' URL with a self-referential checksum pattern, which is a genuine supply-chain concern: any update AWS pushes (or any compromise of that S3 bucket) would be silently picked up and executed. This is a medium-severity supply-chain risk due to the executed binary with no independent integrity verification, even though the host is official.

PKGBUILD

1 offending line(s) highlighted

      1#Submitter: Ian Ker-Seymer <i.kerseymer@gmail.com>
    
      2#Maintainer: Julian Xhokaxhiu <info at julianxhokaxhiu dot com>
    
      3
    
      4_md5sum=$(curl -s https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-linux-amd64-latest.md5)
    
      5pkgname=aws-ecs-cli
    
      6pkgver=1.21.0
    
      7pkgrel=1
    
      8pkgdesc="The Amazon EC2 Container Service (Amazon ECS) command line interface (CLI) provides high-level commands to simplify creating, updating, and monitoring clusters and tasks from a local development environment."
    
      9makedepends=('curl')
    
      10arch=('x86_64')
    
      11options=(!strip)
    
      12source=("ecs-cli-$_md5sum::https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-linux-amd64-latest")
    
      13url="https://github.com/aws/amazon-ecs-cli"
    
      14license=("Apache")
    
      15md5sums=("$_md5sum")
    
      16
    
      17pkgver() {
    
      18  cd "$srcdir"
    
      19  chmod +x "ecs-cli-$_md5sum"
    
      20  ./ecs-cli-$_md5sum -v | sed -rn 's/ecs-cli version ([0-9\.]+) \(\w+\)/\1/p'
    
      21}
    
      22
    
      23package() {
    
      24  cd "$srcdir"
    
      25  chmod +x "ecs-cli-$_md5sum"
    
      26  install -Dm755 "ecs-cli-$_md5sum" "$pkgdir/usr/bin/ecs-cli"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3