bird3-bin

maintainer foi · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt Debian binary (.deb) from pkg.labs.nic.cz and installs the extracted binaries (bird, birdcl, birdc) directly onto the system. The domain belongs to CZ.NIC, the legitimate upstream maintainer of the BIRD routing daemon, and the URL pattern matches their known package repository. However, the concern is real: this is a prebuilt binary from a Debian-targeted host, not the official Arch source build, and there is no way to verify the binary's provenance beyond the sha256sum. The sha256sum also appears truncated (63 hex chars instead of 64), which is a minor integrity concern. Installing network-daemon binaries (a routing daemon running as a privileged service) from a prebuilt .deb rather than building from source is a legitimate supply-chain risk — if the host were compromised, arbitrary code would run with elevated privileges. This is a genuine medium: not clearly malicious, but an executed binary from a non-standard (even if plausibly official) host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://pkg.labs.nic.cz/bird3/pool/main/b/bird3/bird3_${pkgver}-cznic.1~bookworm_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Debian binary (.deb) from pkg.labs.nic.cz and installs the extracted binaries (bird, birdcl, birdc) directly onto the system. The domain belongs to CZ.NIC, the legitimate upstream maintainer of the BIRD routing daemon, and the URL pattern matches their known package repository. However, the concern is real: this is a prebuilt binary from a Debian-targeted host, not the official Arch source build, and there is no way to verify the binary's provenance beyond the sha256sum. The sha256sum also appears truncated (63 hex chars instead of 64), which is a minor integrity concern. Installing network-daemon binaries (a routing daemon running as a privileged service) from a prebuilt .deb rather than building from source is a legitimate supply-chain risk — if the host were compromised, arbitrary code would run with elevated privileges. This is a genuine medium: not clearly malicious, but an executed binary from a non-standard (even if plausibly official) host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: foi <foi@live.ru>
    
      2
    
      3pkgname=bird3-bin
    
      4pkgver=3.0.4
    
      5pkgrel=1
    
      6pkgdesc="BIRD Internet Routing Daemon"
    
      7arch=('x86_64')
    
      8url="https://pkg.labs.nic.cz/doc/?project=bird"
    
      9license=('GNU General Public License')
    
      10conflicts=('bird')
    
      11sha256sums=('57804c45426bd9f1e6492d06b56322b8e0927363239607cb73a29e68bc6d8b9d')
    
      12source=("https://pkg.labs.nic.cz/bird3/pool/main/b/bird3/bird3_${pkgver}-cznic.1~bookworm_amd64.deb")
    
      13backup=("etc/bird" "etc/bird/bird.conf" "etc/bird/envvars")
    
      14
    
      15package() {
    
      16    ar x "${srcdir}/bird3_${pkgver}-cznic.1~bookworm_amd64.deb"
    
      17    tar -xf "$srcdir/data.tar.xz" -C "$srcdir"
    
      18
    
      19    mkdir -p "$pkgdir/usr/lib/sysusers.d"
    
      20    echo "u bird - \"bird user\" -" > "$pkgdir/usr/lib/sysusers.d/bird.conf"
    
      21    echo "g bird -" >> "$pkgdir/usr/lib/sysusers.d/bird.conf"
    
      22
    
      23    mkdir -p "$pkgdir/usr/bin/"
    
      24    mkdir -p "$pkgdir/usr/lib/systemd/system"
    
      25    mkdir -p "$pkgdir/usr/lib/bird/"
    
      26    mkdir -p "$pkgdir/etc/bird"
    
      27
    
      28    mkdir -p "$pkgdir/usr/lib/tmpfiles.d"
    
      29    echo "f /etc/bird/bird.conf 0600 bird bird -" > "$pkgdir/usr/lib/tmpfiles.d/bird.conf"
    
      30
    
      31    install -m 755 "$srcdir/usr/sbin/bird" "$pkgdir/usr/bin/"
    
      32    install -m 755 "$srcdir/usr/sbin/birdcl" "$pkgdir/usr/bin/"
    
      33    install -m 755 "$srcdir/usr/sbin/birdc" "$pkgdir/usr/bin/"
    
      34    install -m 755 "$srcdir/usr/lib/bird/prepare-environment" "$pkgdir/usr/lib/bird/prepare-environment"
    
      35    install -m 644 "$srcdir/lib/systemd/system/bird.service" "$pkgdir/usr/lib/systemd/system/bird.service"
    
      36
    
      37    cp "$srcdir/etc/bird/envvars" "$pkgdir/etc/bird/envvars"
    
      38    cp "$srcdir/usr/share/bird3/bird.conf" "$pkgdir/etc/bird/bird.conf"
    
      39
    
      40    sed -i 's|/usr/sbin/|/usr/bin/|g' "$pkgdir/usr/lib/systemd/system/bird.service"
    
      41}
    
      42
    
      43post_install() {
    
      44    systemd-sysusers
    
      45    systemctl daemon-reload
    
      46}
    
      47
    
      48post_remove() {
    
      49    systemctl disable --now bird
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2