cfengine
LOW
maintainer bidulock
20 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is downloaded from a project-associated S3 bucket, which is not on the whitelist but plausibly official; the package builds from source and does not execute untrusted binaries, limiting supply-chain risk to the source integrity, which is checksum-verified.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from a project-associated S3 bucket, which is not on the whitelist but plausibly official; the package builds from source and does not execute untrusted binaries, limiting supply-chain risk to the source integrity, which is checksum-verified.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source=("${pkgname}-${pkgver}.tar.gz::https://cfengine-package-repos.s3.amazonaws.com/tarballs/${pkgname}-${pkgver}.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Brian Bidulock <bidulock@openss7.org>
2
# Contributor: Vanush Misha Paturyan <ektich+cfengine-aur@gmail.com>
3
# Maintainer: Alexey Shpakovsky <alexey at shpakovsky dot ru>
4
# https://aur.archlinux.org/cfengine.git
5
#
6
# Contributor: Kuba Serafinowski <zizzfizzix AT gmail DOT com>
7
# Contributor: Phillip Smith <fukawi2@NO-SPAM.gmail.com>
8
# Contributor: Christian Berendt <christian@thorlin.de>
9
10
pkgname=cfengine
11
pkgver=3.15.2
12
pkgrel=1
13
pkgdesc='Automated suite of programs for configuring and maintaining Unix-like computers.'
14
url='https://cfengine.com'
15
license=('GPL3')
16
arch=('i686' 'x86_64')
17
depends=('lmdb' 'pcre' 'libxml2' 'pam' 'libyaml' 'curl' 'openssl')
18
makedepends=('which' 'inetutils')
19
optdepends=('libvirt' 'postgresql-libs' 'libmariadbclient' 'acl')
20
install=${pkgname}.install
21
source=("${pkgname}-${pkgver}.tar.gz::https://cfengine-package-repos.s3.amazonaws.com/tarballs/${pkgname}-${pkgver}.tar.gz"
22
"cfengine-masterfiles-${pkgver}.tar.gz::https://cfengine-package-repos.s3.amazonaws.com/tarballs/cfengine-masterfiles-${pkgver}.tar.gz"
23
'cf-execd.service'
24
'cf-monitord.service'
25
'cf-serverd.service'
26
'cfengine3.service'
27
'CFE-3302.patch')
28
29
md5sums=('be04030c007dacd69ad705059a906495'
30
'c5cd389a09e33e58e7d944e10013ea1e'
31
'6edac71eaac0a19fc5b8129f17d82bb2'
32
'199a7867b60a3e4013da4ac42343e22e'
33
'f8783637895f6f3dd19a6ba689181d41'
34
'4b89518da032b45073e46a993fd7fe26'
35
'fbdb0935f146efedb9dcc9f11b5b2ff7')
36
37
prepare() {
38
cd ${pkgname}-${pkgver}
39
autoreconf -fiv
40
cd ..
41
cd ${pkgname}-masterfiles-${pkgver}
42
patch -p1 <../CFE-3302.patch
43
autoreconf -fiv
44
}
45
46
build() {
47
cd ${pkgname}-${pkgver}
48
49
export CFLAGS="$CFLAGS -fcommon"
50
./configure \
51
--prefix=/usr \
52
--with-workdir=/var/${pkgname} \
53
--with-openssl \
54
--with-pcre \
55
--with-libacl=check \
56
--with-libxml2 \
57
--with-libvirt=check \
58
--with-lmdb \
59
--with-mysql=check \
60
--with-postgresql=check
61
62
make
63
cd ..
64
# now build masterfiles
65
cd ${pkgname}-masterfiles-${pkgver}
66
./configure \
67
--prefix=/usr/share/doc/cfengine/CoreBase \
68
--with-core=../cfengine-${pkgver}
69
}
70
71
check() {
72
cd ${pkgname}-${pkgver}
73
make check
74
cd ..
75
cd ${pkgname}-masterfiles-${pkgver}
76
make check
77
}
78
79
package() {
80
cd ${pkgname}-${pkgver}
81
make DESTDIR=$pkgdir install
82
cd ..
83
84
# masterfiles
85
cd ${pkgname}-masterfiles-${pkgver}
86
make DESTDIR=$pkgdir install
87
cd ..
88
89
install -D -m644 cf-execd.service \
90
${pkgdir}/usr/lib/systemd/system/cf-execd.service
91
install -D -m644 cf-serverd.service \
92
${pkgdir}/usr/lib/systemd/system/cf-serverd.service
93
install -D -m644 cf-monitord.service \
94
${pkgdir}/usr/lib/systemd/system/cf-monitord.service
95
install -D -m644 cfengine3.service \
96
${pkgdir}/usr/lib/systemd/system/cfengine3.service
97
98
99
install -d -m755 ${pkgdir}/var/cfengine/bin
100
install -d -m755 ${pkgdir}/var/cfengine/masterfiles
101
102
for f in $(ls ${pkgdir}/usr/bin); do
103
/bin/ln -s /usr/bin/$f ${pkgdir}/var/cfengine/bin
104
done
105
}
106
107
# vim:set ts=2 sw=2 et:
108
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |