aws-session-manager-plugin

maintainer ChrisLane · 22 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from AWS's official S3 bucket for a legitimate AWS tool; while the host is not whitelisted, it is plausibly official and the binary is from a trusted vendor, making the supply chain risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from AWS's official S3 bucket for a legitimate AWS tool; while the host is not whitelisted, it is plausibly official and the binary is from a trusted vendor, making the supply chain risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("${pkgname}-${pkgver}.deb"::https://s3.amazonaws.com/session-manager-downloads/plugin/${pkgver}/ubuntu_64bit/session-manager-plugin.deb)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chris Lane <aur at chrislane dot com>
    
      2# Contributor: Rene Benner <renebenner + arch at gmail dot com>
    
      3# Contributor: Troy Engel <troyengel + arch at gmail dot com>
    
      4# Contributor: Callum Denby <me@callumdenby.com>
    
      5pkgname=aws-session-manager-plugin
    
      6pkgver=1.2.835.0
    
      7pkgrel=1
    
      8pkgdesc="AWS Session Manager Plugin for aws-cli."
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html"
    
      11license=('Apache-2.0')
    
      12depends=('aws-cli')
    
      13backup=('usr/lib/systemd/system/session-manager-plugin.service' 'usr/sessionmanagerplugin/LICENSE' 'usr/sessionmanagerplugin/seelog.xml' 'usr/sessionmanagerplugin/VERSION')
    
      14options=('!strip' '!emptydirs')
    
      15source_x86_64=("${pkgname}-${pkgver}.deb"::https://s3.amazonaws.com/session-manager-downloads/plugin/${pkgver}/ubuntu_64bit/session-manager-plugin.deb)
    
      16source_aarch64=("${pkgname}-${pkgver}-aarch64.deb"::https://s3.amazonaws.com/session-manager-downloads/plugin/${pkgver}/ubuntu_arm64/session-manager-plugin.deb)
    
      17sha512sums_x86_64=('971613d4d937d356493b8469d8e442860a903c6c50313f308c5c87b6140d3873b8c345f6757636180ea18e3ae061b9df9cf19cd4541db8e238c527953d80addd')
    
      18sha512sums_aarch64=('eb7fa40a71e17094d750151154486871381668402b5f2f2415052d9a21382f03d752127eee979dff1daafeeaec95086b4a03af666b5c800914bae9c2c1e8834d')
    
      19
    
      20# Version history with new versions is here.
    
      21#  https://docs.aws.amazon.com/systems-manager/latest/userguide/plugin-version-history.html
    
      22
    
      23package(){
    
      24
    
      25	# Extract package data
    
      26	tar xzf data.tar.gz -C "${pkgdir}"
    
      27
    
      28	# Fix directories structure differencies
    
      29	cd "${pkgdir}"
    
      30	mkdir -p usr/bin
    
      31	mkdir -p usr/lib 2> /dev/null; mv lib/* usr/lib; rm -rf lib
    
      32	rm -rf etc/
    
      33	sed -i 's/usr\/local/usr/' usr/lib/systemd/system/session-manager-plugin.service
    
      34	mv usr/local/* usr; rm -rf usr/local
    
      35	ln -sf /usr/sessionmanagerplugin/bin/session-manager-plugin usr/bin/session-manager-plugin
    
      36	cd ..
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2