cato-client-bin

maintainer mreschke · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from clients.catonetworks.com, which is the official Cato Networks client distribution host (consistent with the package URL clientdownload.catonetworks.com). The sha256 checksum is pinned, so integrity is verified at build time. However, this is still a prebuilt binary blob (a VPN client daemon, cato-clientd, installed as a systemd service with its own sysuser) from a vendor-controlled but non-Arch-official host. If the vendor's distribution infrastructure were compromised or the URL were silently redirected, arbitrary code would execute with system privileges. This is a textbook medium-severity supply-chain concern: not clearly malicious, but an executed closed-source binary from an external vendor host with no source build option. The packaging itself is technically sound (correct checksum, proper FHS layout fixups).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("cato-client-install-${pkgver}.deb::https://clients.catonetworks.com/linux/${pkgver}/cato-client-install.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from clients.catonetworks.com, which is the official Cato Networks client distribution host (consistent with the package URL clientdownload.catonetworks.com). The sha256 checksum is pinned, so integrity is verified at build time. However, this is still a prebuilt binary blob (a VPN client daemon, cato-clientd, installed as a systemd service with its own sysuser) from a vendor-controlled but non-Arch-official host. If the vendor's distribution infrastructure were compromised or the URL were silently redirected, arbitrary code would execute with system privileges. This is a textbook medium-severity supply-chain concern: not clearly malicious, but an executed closed-source binary from an external vendor host with no source build option. The packaging itself is technically sound (correct checksum, proper FHS layout fixups).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Didrole <Didrole@gmail.com>
    
      2
    
      3pkgname=cato-client-bin
    
      4pkgver=5.6.0.4138
    
      5pkgrel=1
    
      6pkgdesc='VPN client from Cato Networks to connect to the Cato Cloud.'
    
      7arch=('x86_64')
    
      8url='https://clientdownload.catonetworks.com/'
    
      9license=('custom')
    
      10depends=('glibc' 'gcc-libs' 'zlib')
    
      11makedepends=('libarchive')
    
      12
    
      13source=("cato-client-install-${pkgver}.deb::https://clients.catonetworks.com/linux/${pkgver}/cato-client-install.deb"
    
      14        "cato-client-bin.sysusers"
    
      15        "cato-client-bin.tmpfiles"
    
      16)
    
      17sha256sums=('34c84b97241c90512f089d6c3d9f6c4dae4c853d446a19cd5361e4afe8e89cd8'
    
      18            '3c51ce0ebde44edf062e2c9db69c95949ee2031f4e85156f2f401d6e8767f704'
    
      19            'd381f7126126f45ca36e43bd33772bfa0aa6d9cbc9a720e2485fc6061cdd9435')
    
      20
    
      21package() {
    
      22	bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}/"
    
      23	mv "${pkgdir}/lib/systemd" "${pkgdir}/usr/lib/"
    
      24	rmdir "${pkgdir}/lib/"
    
      25	mv "${pkgdir}/usr/sbin/cato-clientd" "${pkgdir}/usr/bin/"
    
      26	rmdir "${pkgdir}/usr/sbin/"
    
      27	rmdir "${pkgdir}/usr/local/lib/"
    
      28
    
      29	install -Dm644 "${srcdir}/../cato-client-bin.sysusers" "${pkgdir}/usr/lib/sysusers.d/cato-client-bin.conf"
    
      30	install -Dm644 "${srcdir}/../cato-client-bin.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/cato-client-bin.conf"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2