cardano-node

maintainer simongeisler · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads configuration and genesis files from hydra.iohk.io, a non-whitelisted but project-official build host; these are static JSON data files, not executable code, and are used for blockchain network configuration, so the worst-case impact of a compromised source is limited to network misconfiguration, not code execution or system compromise.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads configuration and genesis files from hydra.iohk.io, a non-whitelisted but project-official build host; these are static JSON data files, not executable code, and are used for blockchain network configuration, so the worst-case impact of a compromised source is limited to network misconfiguration, not code execution or system compromise.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 "https://hydra.iohk.io/build/${_config_build}/download/1/mainnet-config.json"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Michał Sałaban <michal@salaban.info>
    
      2pkgname=cardano-node
    
      3pkgver=1.34.1
    
      4pkgrel=1
    
      5pkgdesc='The core component that is used to participate in a Cardano decentralised blockchain.'
    
      6license=('Apache')
    
      7arch=('any')
    
      8url='https://github.com/input-output-hk/cardano-node'
    
      9_ghc_version="`ghc-8.10 --numeric-version`"
    
      10# NOTE: The build process includes resolution, download and compilation of required libraries.
    
      11# However, if you have corresponding haskell-* packages present in the system, the build
    
      12# will most likely fail trying to use the installed lib.
    
      13# This is probably configurable but I'm not experienced in Haskell. Suggestions are welcome.
    
      14makedepends=('git' 'cabal-install' 'ghc8.10>=8.10.4')
    
      15depends=('libsodium')
    
      16#
    
      17# The latest build is reachable via the following redirection link:
    
      18# https://hydra.iohk.io/job/Cardano/cardano-node/cardano-deployment/latest-finished/download/1/index.html
    
      19_config_build="13695229"
    
      20#
    
      21backup=("etc/conf.d/cardano-node"
    
      22        "var/lib/cardano-node/config/mainnet-config.json"
    
      23        "var/lib/cardano-node/config/mainnet-topology.json"
    
      24        "var/lib/cardano-node/config/testnet-config.json"
    
      25        "var/lib/cardano-node/config/testnet-topology.json")
    
      26source=("git+https://github.com/input-output-hk/${pkgname}.git#tag=${pkgver}"
    
      27        "https://hydra.iohk.io/build/${_config_build}/download/1/mainnet-config.json"
    
      28        "https://hydra.iohk.io/build/${_config_build}/download/1/mainnet-byron-genesis.json"
    
      29        "https://hydra.iohk.io/build/${_config_build}/download/1/mainnet-shelley-genesis.json"
    
      30        "https://hydra.iohk.io/build/${_config_build}/download/1/mainnet-alonzo-genesis.json"
    
      31        "https://hydra.iohk.io/build/${_config_build}/download/1/mainnet-topology.json"
    
      32        "https://hydra.iohk.io/build/${_config_build}/download/1/testnet-config.json"
    
      33        "https://hydra.iohk.io/build/${_config_build}/download/1/testnet-byron-genesis.json"
    
      34        "https://hydra.iohk.io/build/${_config_build}/download/1/testnet-shelley-genesis.json"
    
      35        "https://hydra.iohk.io/build/${_config_build}/download/1/testnet-alonzo-genesis.json"
    
      36        "https://hydra.iohk.io/build/${_config_build}/download/1/testnet-topology.json"
    
      37        "cardano-node.sysusers"
    
      38        "cardano-node.tmpfiles"
    
      39        "cardano-node.service"
    
      40        "cardano-node.confd"
    
      41        "cardano-node-testnet.service"
    
      42        "cardano-node-testnet.confd"
    
      43        "ghc8.10.patch")
    
      44sha256sums=('SKIP'
    
      45            '1dc62fc62669e9c991d09e85c884f2aceaff486b6cb9037af8400a1bda950b68'
    
      46            '4f28b3b437b2c4f6ee26cc70964b3a5f1a274b0b3909c31535091c00316c13aa'
    
      47            '59cd3932c6dd792bc5020ca3336064a8faabde4e4a8dc7d143ff4df6eec36961'
    
      48            '7333bfafe311589fa09e8bf59a47ec0d85a1959f00748cc0800591d2c7646408'
    
      49            '7ac2184ff55d1272e87d579550501b7e4fc61b9cf016179ca026516fff365730'
    
      50            '2d19651f9abdcdc8b6f00e9e06e3f857b23fd73d0096a39df256e66807ad4380'
    
      51            'dca3139e907bb943bfeff5f186f3fc71217ff12cabde93a926277c6ddd647d87'
    
      52            '4e309ad1f7b19d5c442b9250326ef55a70581c5d1bc0f7a056d18ebff31bcfa6'
    
      53            '7333bfafe311589fa09e8bf59a47ec0d85a1959f00748cc0800591d2c7646408'
    
      54            'cbcf919b1d2d656ea7512f8ecb12e3c3e3a8db137925abff52d647427f2b154f'
    
      55            '703f9b033c299b652b2d3228ee6ef4a9c09b7e846ff4b366a2aca68960370234'
    
      56            '3212902b0d2bb0e6bacba0feeafd261516b9f6ab5f37f876a8c37239a1947542'
    
      57            '6db0b3bb81063f410499a6688a1abbbc5d63af165310ef709924985e5c0d1c4d'
    
      58            '7e2e7a8422b8da7b82919752ca96904e84d130425495e647d648793218644f38'
    
      59            'ec16edc07aa35dccd5fb6894b964ab304cd7a8c1cc65eed22aa569e9105c7982'
    
      60            '07a3dde7fb51f3f84bb51e7c15993dfefa337571ed509cc3588e73c54f606282'
    
      61            '67e938f286c2f7e01dc2be7031dca37b42f9ee98dccd4ec440422ce5faba4b14')
    
      62
    
      63prepare() {
    
      64  cd "${srcdir}/${pkgname}"
    
      65  patch -p1 < ${srcdir}/ghc8.10.patch
    
      66  cabal configure
    
      67  echo "package cardano-crypto-praos" >> ${srcdir}/${pkgname}/cabal.project.local
    
      68  echo "  flags: -external-libsodium-vrf" >> ${srcdir}/${pkgname}/cabal.project.local
    
      69  cabal clean
    
      70  cabal update
    
      71}
    
      72
    
      73build() {
    
      74  cd "${srcdir}/${pkgname}"
    
      75  cabal build all
    
      76}
    
      77
    
      78package() {
    
      79  install -D -m0644 "${srcdir}/${pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
    
      80  install -D -m0644 "${srcdir}/${pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
    
      81  install -D -m0644 "${srcdir}/${pkgname}.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
    
      82  install -D -m0644 "${srcdir}/${pkgname}.confd" "${pkgdir}/etc/conf.d/${pkgname}"
    
      83
    
      84  install -D -m0644 "mainnet-config.json" "${pkgdir}/var/lib/${pkgname}/config/mainnet-config.json"
    
      85  install -D -m0644 "mainnet-byron-genesis.json" "${pkgdir}/var/lib/${pkgname}/config/mainnet-byron-genesis.json"
    
      86  install -D -m0644 "mainnet-shelley-genesis.json" "${pkgdir}/var/lib/${pkgname}/config/mainnet-shelley-genesis.json"
    
      87  install -D -m0644 "mainnet-alonzo-genesis.json" "${pkgdir}/var/lib/${pkgname}/config/mainnet-alonzo-genesis.json"
    
      88  install -D -m0644 "mainnet-topology.json" "${pkgdir}/var/lib/${pkgname}/config/mainnet-topology.json"
    
      89  install -D -m0644 "testnet-config.json" "${pkgdir}/var/lib/${pkgname}/config/testnet-config.json"
    
      90  install -D -m0644 "testnet-byron-genesis.json" "${pkgdir}/var/lib/${pkgname}/config/testnet-byron-genesis.json"
    
      91  install -D -m0644 "testnet-shelley-genesis.json" "${pkgdir}/var/lib/${pkgname}/config/testnet-shelley-genesis.json"
    
      92  install -D -m0644 "testnet-alonzo-genesis.json" "${pkgdir}/var/lib/${pkgname}/config/testnet-alonzo-genesis.json"
    
      93  install -D -m0644 "testnet-topology.json" "${pkgdir}/var/lib/${pkgname}/config/testnet-topology.json"
    
      94
    
      95  install -D -m0644 "${srcdir}/${pkgname}-testnet.service" "${pkgdir}/usr/share/${pkgname}/${pkgname}-testnet-example.service"
    
      96  install -D -m0644 "${srcdir}/${pkgname}-testnet.confd" "${pkgdir}/usr/share/${pkgname}/${pkgname}-testnet-example.confd"
    
      97
    
      98  cd "${srcdir}/${pkgname}"
    
      99  install -D -m0755 "dist-newstyle/build/x86_64-linux/ghc-${_ghc_version}/cardano-cli-${pkgver}/x/cardano-cli/build/cardano-cli/cardano-cli" "${pkgdir}/usr/bin/cardano-cli"
    
      100  install -D -m0755 "dist-newstyle/build/x86_64-linux/ghc-${_ghc_version}/cardano-node-${pkgver}/x/cardano-node/build/cardano-node/cardano-node" "${pkgdir}/usr/bin/cardano-node"
    
      101}
    
      102

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2