cfengine

maintainer bidulock · 20 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from a project-associated S3 bucket, which is not on the whitelist but plausibly official; the package builds from source and does not execute untrusted binaries, limiting supply-chain risk to the source integrity, which is checksum-verified.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from a project-associated S3 bucket, which is not on the whitelist but plausibly official; the package builds from source and does not execute untrusted binaries, limiting supply-chain risk to the source integrity, which is checksum-verified.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("${pkgname}-${pkgver}.tar.gz::https://cfengine-package-repos.s3.amazonaws.com/tarballs/${pkgname}-${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Brian Bidulock <bidulock@openss7.org>
    
      2# Contributor: Vanush Misha Paturyan <ektich+cfengine-aur@gmail.com>
    
      3# Maintainer: Alexey Shpakovsky <alexey at shpakovsky dot ru>
    
      4# https://aur.archlinux.org/cfengine.git 
    
      5#
    
      6# Contributor: Kuba Serafinowski <zizzfizzix AT gmail DOT com>
    
      7# Contributor: Phillip Smith <fukawi2@NO-SPAM.gmail.com>
    
      8# Contributor: Christian Berendt <christian@thorlin.de>
    
      9
    
      10pkgname=cfengine
    
      11pkgver=3.15.2
    
      12pkgrel=1
    
      13pkgdesc='Automated suite of programs for configuring and maintaining Unix-like computers.'
    
      14url='https://cfengine.com'
    
      15license=('GPL3')
    
      16arch=('i686' 'x86_64')
    
      17depends=('lmdb' 'pcre' 'libxml2' 'pam' 'libyaml' 'curl' 'openssl')
    
      18makedepends=('which' 'inetutils')
    
      19optdepends=('libvirt' 'postgresql-libs' 'libmariadbclient' 'acl')
    
      20install=${pkgname}.install
    
      21source=("${pkgname}-${pkgver}.tar.gz::https://cfengine-package-repos.s3.amazonaws.com/tarballs/${pkgname}-${pkgver}.tar.gz"
    
      22        "cfengine-masterfiles-${pkgver}.tar.gz::https://cfengine-package-repos.s3.amazonaws.com/tarballs/cfengine-masterfiles-${pkgver}.tar.gz"
    
      23        'cf-execd.service'
    
      24        'cf-monitord.service'
    
      25        'cf-serverd.service'
    
      26        'cfengine3.service'
    
      27        'CFE-3302.patch')
    
      28
    
      29md5sums=('be04030c007dacd69ad705059a906495'
    
      30         'c5cd389a09e33e58e7d944e10013ea1e'
    
      31         '6edac71eaac0a19fc5b8129f17d82bb2'
    
      32         '199a7867b60a3e4013da4ac42343e22e'
    
      33         'f8783637895f6f3dd19a6ba689181d41'
    
      34         '4b89518da032b45073e46a993fd7fe26'
    
      35         'fbdb0935f146efedb9dcc9f11b5b2ff7')
    
      36
    
      37prepare() {
    
      38  cd ${pkgname}-${pkgver}
    
      39  autoreconf -fiv
    
      40  cd ..
    
      41  cd ${pkgname}-masterfiles-${pkgver}
    
      42  patch -p1 <../CFE-3302.patch
    
      43  autoreconf -fiv
    
      44}
    
      45
    
      46build() {
    
      47  cd ${pkgname}-${pkgver}
    
      48
    
      49  export CFLAGS="$CFLAGS -fcommon"
    
      50  ./configure \
    
      51    --prefix=/usr \
    
      52    --with-workdir=/var/${pkgname} \
    
      53    --with-openssl \
    
      54    --with-pcre \
    
      55    --with-libacl=check \
    
      56    --with-libxml2 \
    
      57    --with-libvirt=check \
    
      58    --with-lmdb \
    
      59    --with-mysql=check \
    
      60    --with-postgresql=check
    
      61
    
      62  make
    
      63  cd ..
    
      64  # now build masterfiles
    
      65  cd ${pkgname}-masterfiles-${pkgver}
    
      66  ./configure \
    
      67      --prefix=/usr/share/doc/cfengine/CoreBase \
    
      68      --with-core=../cfengine-${pkgver}
    
      69}
    
      70
    
      71check() {
    
      72  cd ${pkgname}-${pkgver}
    
      73  make check
    
      74  cd ..
    
      75  cd ${pkgname}-masterfiles-${pkgver}
    
      76  make check
    
      77}
    
      78
    
      79package() {
    
      80  cd ${pkgname}-${pkgver}
    
      81  make DESTDIR=$pkgdir install
    
      82  cd ..
    
      83
    
      84  # masterfiles
    
      85  cd ${pkgname}-masterfiles-${pkgver}
    
      86  make DESTDIR=$pkgdir install
    
      87  cd ..
    
      88
    
      89  install -D -m644 cf-execd.service \
    
      90	  ${pkgdir}/usr/lib/systemd/system/cf-execd.service
    
      91  install -D -m644 cf-serverd.service \
    
      92	  ${pkgdir}/usr/lib/systemd/system/cf-serverd.service
    
      93  install -D -m644 cf-monitord.service \
    
      94	  ${pkgdir}/usr/lib/systemd/system/cf-monitord.service
    
      95  install -D -m644 cfengine3.service \
    
      96	  ${pkgdir}/usr/lib/systemd/system/cfengine3.service
    
      97
    
      98
    
      99  install -d -m755 ${pkgdir}/var/cfengine/bin
    
      100  install -d -m755 ${pkgdir}/var/cfengine/masterfiles
    
      101
    
      102  for f in $(ls ${pkgdir}/usr/bin); do
    
      103    /bin/ln -s /usr/bin/$f ${pkgdir}/var/cfengine/bin
    
      104  done
    
      105}
    
      106
    
      107# vim:set ts=2 sw=2 et:
    
      108

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2