cato-client-bin

LOW

maintainer mreschke 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from the vendor's official domain (clients.catonetworks.com), which is plausibly part of their release infrastructure; installing vendor-distributed binaries from their official domain is normal for proprietary software and not inherently dangerous.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the vendor's official domain (clients.catonetworks.com), which is plausibly part of their release infrastructure; installing vendor-distributed binaries from their official domain is normal for proprietary software and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("cato-client-install-${pkgver}.deb::https://clients.catonetworks.com/linux/${pkgver}/cato-client-install.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Didrole <Didrole@gmail.com>
    
      2
    
      3pkgname=cato-client-bin
    
      4pkgver=5.7.0.5525
    
      5pkgrel=1
    
      6pkgdesc='VPN client from Cato Networks to connect to the Cato Cloud.'
    
      7arch=('x86_64')
    
      8url='https://clientdownload.catonetworks.com/'
    
      9license=('custom')
    
      10depends=('glibc' 'gcc-libs' 'zlib')
    
      11makedepends=('libarchive')
    
      12
    
      13source=("cato-client-install-${pkgver}.deb::https://clients.catonetworks.com/linux/${pkgver}/cato-client-install.deb"
    
      14        "cato-client-bin.sysusers"
    
      15        "cato-client-bin.tmpfiles"
    
      16)
    
      17sha256sums=('50320375d564ed45e23a86464f3d7be7bc7ae8398e48e1aa3227a5490e56e73d'
    
      18            '3c51ce0ebde44edf062e2c9db69c95949ee2031f4e85156f2f401d6e8767f704'
    
      19            'd381f7126126f45ca36e43bd33772bfa0aa6d9cbc9a720e2485fc6061cdd9435')
    
      20
    
      21package() {
    
      22	bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}/"
    
      23	mv "${pkgdir}/lib/systemd" "${pkgdir}/usr/lib/"
    
      24	rmdir "${pkgdir}/lib/"
    
      25	mv "${pkgdir}/usr/sbin/cato-clientd" "${pkgdir}/usr/bin/"
    
      26	rmdir "${pkgdir}/usr/sbin/"
    
      27	rmdir "${pkgdir}/usr/local/lib/"
    
      28
    
      29	install -Dm644 "${srcdir}/../cato-client-bin.sysusers" "${pkgdir}/usr/lib/sysusers.d/cato-client-bin.conf"
    
      30	install -Dm644 "${srcdir}/../cato-client-bin.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/cato-client-bin.conf"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2