caddy-l4-bin

maintainer meanlint · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary from caddyserver.com/api/download, which is the official Caddy download API used to build custom Caddy binaries with plugins on-demand. This is a legitimate official vendor endpoint, not a personal or unofficial host. However, the binary is fetched dynamically (the API compiles and returns a fresh binary each time), meaning the exact binary cannot be pinned to a known-good hash — hence all checksums are SKIP. This creates a genuine supply-chain concern: if caddyserver.com were compromised, or if the build service were subverted, a malicious binary would be installed with no integrity check. The binary is executed directly as a system service. While the source host is official, the inability to verify the binary's integrity (no checksum, no signature verification) combined with it being an executed binary rather than pure data keeps this at MEDIUM rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "caddy::https://caddyserver.com/api/download?os=linux&arch=amd64&p=github.com/mholt/caddy-l4"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary from caddyserver.com/api/download, which is the official Caddy download API used to build custom Caddy binaries with plugins on-demand. This is a legitimate official vendor endpoint, not a personal or unofficial host. However, the binary is fetched dynamically (the API compiles and returns a fresh binary each time), meaning the exact binary cannot be pinned to a known-good hash — hence all checksums are SKIP. This creates a genuine supply-chain concern: if caddyserver.com were compromised, or if the build service were subverted, a malicious binary would be installed with no integrity check. The binary is executed directly as a system service. While the source host is official, the inability to verify the binary's integrity (no checksum, no signature verification) combined with it being an executed binary rather than pure data keeps this at MEDIUM rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: meanlint <meanlint@outlook.com>
    
      2# Maintainer: 435qb <52435qb@gmail.com>
    
      3# Maintainer: Nicolas Stalder <n+archlinux@stalder.io>
    
      4# Maintainer: Shi Liang <shiliang2008@msn.com>
    
      5pkgname=caddy-l4-bin
    
      6pkgver=2.10.2
    
      7pkgrel=1
    
      8pkgdesc="Caddy web server with Layer4 module"
    
      9arch=("x86_64")
    
      10url="https://github.com/caddyserver/caddy"
    
      11license=('Apache-2.0')
    
      12provides=("caddy")
    
      13conflicts=("caddy")
    
      14source=(
    
      15  "caddy::https://caddyserver.com/api/download?os=linux&arch=amd64&p=github.com/mholt/caddy-l4"
    
      16  "Caddyfile"
    
      17  "caddy.service"
    
      18  "caddy.sysusers"
    
      19  "caddy.tmpfiles"
    
      20  "Caddyfile-example"
    
      21)
    
      22sha256sums=(
    
      23  "SKIP"
    
      24  "SKIP"
    
      25  "SKIP"
    
      26  "SKIP"
    
      27  "SKIP"
    
      28  "SKIP"
    
      29)
    
      30
    
      31package() {
    
      32  # Install the executables
    
      33  install -d "$pkgdir"/usr/bin/
    
      34  install -m 755 "$srcdir/caddy" "$pkgdir"/usr/bin/caddy
    
      35
    
      36  # Basic configuration with example
    
      37  install -Dm 644 "${srcdir}/Caddyfile" "${pkgdir}/etc/caddy/Caddyfile"
    
      38  install -d "${pkgdir}/etc/caddy/conf.d"
    
      39  install -Dm 644 "${srcdir}/Caddyfile-example" -t "${pkgdir}/etc/caddy/conf.d"
    
      40
    
      41  # Systemd service setup
    
      42  install -Dm 644 "${srcdir}/caddy.service" -t "${pkgdir}/usr/lib/systemd/system"
    
      43  install -Dm 644 "${srcdir}/caddy.sysusers" "${pkgdir}/usr/lib/sysusers.d/caddy.conf"
    
      44  install -Dm 644 "${srcdir}/caddy.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/caddy.conf"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2