confluent-platform

maintainer orphaned · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary (confluent CLI) from an AWS S3 URL (s3-us-west-2.amazonaws.com/confluent.cloud/...) with 'SKIP' for its checksum, then installs it as an executable at /usr/bin/confluent. While the S3 bucket 'confluent.cloud' is plausibly operated by Confluent Inc. (the official vendor), it is not their primary package distribution channel (packages.confluent.io is), and the 'latest' path means the binary can change at any time without any integrity verification. The SKIP checksum means there is zero tamper detection. This is a genuine supply-chain concern: an executed binary from an unofficial/unverified host with no integrity check. The main Confluent platform tarball does have a proper sha256sum and comes from packages.confluent.io. The CLI binary concern alone is sufficient to maintain a medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 source=(https://packages.confluent.io/archive/7.7/confluent-7.7.0.tar.gz
PKGBUILD:46 https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/latest/confluent_latest_linux_amd64.tar.gz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary (confluent CLI) from an AWS S3 URL (s3-us-west-2.amazonaws.com/confluent.cloud/...) with 'SKIP' for its checksum, then installs it as an executable at /usr/bin/confluent. While the S3 bucket 'confluent.cloud' is plausibly operated by Confluent Inc. (the official vendor), it is not their primary package distribution channel (packages.confluent.io is), and the 'latest' path means the binary can change at any time without any integrity verification. The SKIP checksum means there is zero tamper detection. This is a genuine supply-chain concern: an executed binary from an unofficial/unverified host with no integrity check. The main Confluent platform tarball does have a proper sha256sum and comes from packages.confluent.io. The CLI binary concern alone is sufficient to maintain a medium rating.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Damien GASPARINA <dgasparina at gmail dot com>
    
      2pkgname=confluent-platform
    
      3pkgver=7.7.0
    
      4pkgrel=0
    
      5pkgdesc='Confluent, founded by the creators of Apache Kafka, delivers a complete execution of Kafka for the Enterprise, to help you run your business in real time.'
    
      6arch=('any')
    
      7url='https://www.confluent.io/'
    
      8license=('Commercial')
    
      9depends=('java-runtime')
    
      10backup=(etc/confluent-control-center/log4j.properties
    
      etc/confluent-control-center/control-center-dev.properties
    
      etc/confluent-control-center/propertyfile.conf
    
      etc/confluent-control-center/log4j-rolling.properties
    
      etc/confluent-control-center/control-center-production.properties
    
      etc/confluent-control-center/ldap.conf
    
      etc/confluent-control-center/log4j-silent.properties
    
      etc/confluent-control-center/control-center.properties
    
      etc/schema-registry/schema-registry.properties
    
      etc/schema-registry/log4j.properties
    
      etc/schema-registry/connect-avro-distributed.properties
    
      etc/schema-registry/connect-avro-standalone.properties
    
      etc/kafka/log4j.properties
    
      etc/kafka/connect-log4j.properties
    
      etc/kafka/connect-distributed.properties
    
      etc/kafka/connect-console-source.properties
    
      etc/kafka/connect-standalone.properties
    
      etc/kafka/producer.properties
    
      etc/kafka/tools-log4j.properties
    
      etc/kafka/consumer.properties
    
      etc/kafka/server.properties
    
      etc/kafka/zookeeper.properties
    
      etc/kafka-rest/log4j.properties
    
      etc/kafka-rest/kafka-rest.properties
    
      etc/ksql/log4j.properties
    
      etc/ksql/log4j-rolling.properties
    
      etc/ksql/log4j-file.properties
    
      etc/ksql/datagen.properties
    
      etc/ksql/ksql-server.properties
    
      etc/ksql/log4j-silent.properties
    
      etc/confluent-rebalancer/log4j.properties
    
      )
    
      42install=install_confluent.sh
    
      43
    
      44source=(https://packages.confluent.io/archive/7.7/confluent-7.7.0.tar.gz
    
      systemd_sysusers.d_confluent.conf
    
      https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/latest/confluent_latest_linux_amd64.tar.gz
    
     )
    
      48
    
      49sha256sums=('c3975ace34994efff3a8d70e726c9452ef33e707edb09b41794ddb3b55a143a9'
    
          '6f5dfdbaf6ef405117482413b376e55148f75423bc6b8681cd8f91cdb7d96a99'
    
          'SKIP')
    
      52
    
      53
    
      54package() {
    
cd "${srcdir}/confluent-${pkgver}"
    
      56
    
# Installing and copying all required files
    
install -d "${pkgdir}"{/usr/,/usr/bin,/etc/,/usr/lib/,/usr/share/,/usr/src/,/var/log/kafka}
    
      59
    
cp -rf  ${srcdir}/confluent-${pkgver}/bin/* ${pkgdir}/usr/bin/
    
cp -rf  ${srcdir}/confluent-${pkgver}/src/* ${pkgdir}/usr/src/
    
cp -rf  ${srcdir}/confluent-${pkgver}/lib/* ${pkgdir}/usr/lib
    
cp -rf  ${srcdir}/confluent-${pkgver}/share/* ${pkgdir}/usr/share/
    
cp -rf  ${srcdir}/confluent-${pkgver}/etc/* ${pkgdir}/etc/
    
      65
    
cp ${srcdir}/systemd_sysusers.d_confluent.conf ${pkgdir}/confluent.conf
    
      67
    
# Additional configuration to systemm.d 
    
# TO CONSIDER Should tmpfile be used for the default values? 
    
install -D -m 644 ${srcdir}/systemd_sysusers.d_confluent.conf "${pkgdir}/usr/lib/sysusers.d/confluent.conf"
    
      71
    
# We probably don't need binaries for Windows
    
rm -rf ${pkgdir}/usr/bin/windows/
    
      74
    
# Configure a development environment 
    
# Ensure that localhost is use as default value
    
_c3_etc=${pkgdir}/etc/confluent-control-center/control-center.properties
    
_c3_system=${pkgdir}/usr/lib/systemd/system/confluent-control-center.service  
    
_kafka_etc=${pkgdir}/etc/kafka/server.properties
    
_zookeeper_etc=${pkgdir}/etc/kafka/zookeeper.properties
    
      81
    
# Configure Apache kafka 
    
sed -i 's#log.dirs=/tmp/kafka-logs#log.dirs=/var/lib/confluent/kafka#g' $_kafka_etc
    
sed -i 's#dataDir=/tmp/zookeeper#dataDir=/var/lib/confluent/zookeeper#g' $_zookeeper_etc 
    
      85
    
# Configure Confluent Control Center
    
# Required directories for Confluent Control Center 
    
sed -i 's/#bootstrap.servers=kafka1:9092/bootstrap.servers=localhost:9092/g' $_c3_etc
    
sed -i 's/#zookeeper.connect=zookeeper1:2181/zookeeper.connect=localhost:2181/g' $_c3_etc 
    
sed -i 's/#confluent.controlcenter.connect.cluster=connect1:8083/confluent.controlcenter.connect.cluster=localhost:8083/g' $_c3_etc 
    
      91
    
# Configure replication factor to 1 for internal topics 
    
sed -i 's/#confluent.controlcenter.internal.topics.replication=3/confluent.controlcenter.internal.topics.replication=1/g' $_c3_etc
    
sed -i 's/#confluent.monitoring.interceptor.topic.replication=3/confluent.monitoring.interceptor.topic.replication=1/g' $_c3_etc 
    
sed -i 's/#confluent.controlcenter.command.topic.replication=3/confluent.controlcenter.command.topic.replication=1/g' $_c3_etc
    
sed -i 's/#confluent.metrics.topic.replication=3/confluent.metrics.topic.replication=1/g' $_c3_etc
    
      97
    
# Use a persistent folder for control center data directory
    
sed -i 's#confluent.controlcenter.data.dir=/tmp/confluent/control-center#confluent.controlcenter.data.dir=/var/lib/confluent/control-center#g' $_c3_etc
    
      100
    
# Configure local kafka for monitoring
    
echo '' >> $_kafka_etc 
    
echo 'metric.reporters=io.confluent.metrics.reporter.ConfluentMetricsReporter' >> $_kafka_etc
    
echo 'confluent.metrics.reporter.bootstrap.servers=localhost:9092' >> $_kafka_etc 
    
      105
    
# Configure systemd to use control-center.properties instead of default production one
    
sed -i 's#ExecStart=/usr/bin/control-center-start /etc/confluent-control-center/control-center-production.properties#ExecStart=/usr/bin/control-center-start /etc/confluent-control-center/control-center.properties#g' $_c3_system
    
      108
    
# Configure logging to /var/log
    
ln -s /var/log/confluent/kafka ${pkgdir}/usr/logs
    
      111
    
# Removing unneeded file
    
rm ${pkgdir}/confluent.conf
    
      114
    
# Installing Confluent CLI
    
install -D -m 755 ${srcdir}/confluent/confluent "${pkgdir}/usr/bin/confluent"
    
      117}
    
      118

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2