ec2-metadata

maintainer alerque · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary (a shell script named 'ec2-metadata') directly from an AWS S3 bucket (s3.amazonaws.com/ec2metadata/) which is the official AWS-provided distribution point for this tool, as referenced by the official AWS documentation page listed in the url field. The sha256sum is pinned, which mitigates silent substitution risk. However, this is still a prebuilt executable from an S3 bucket with no versioned path (the URL has no version component, meaning the same URL could theoretically serve different content for different versions), and S3 buckets can be misconfigured or taken over. The binary is executed directly (install -m755). This is a genuine but low-probability supply-chain concern: the host is plausibly official, the checksum is pinned, but the unversioned S3 URL and lack of GPG signature keep this at medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://s3.amazonaws.com/ec2metadata/$pkgname")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary (a shell script named 'ec2-metadata') directly from an AWS S3 bucket (s3.amazonaws.com/ec2metadata/) which is the official AWS-provided distribution point for this tool, as referenced by the official AWS documentation page listed in the url field. The sha256sum is pinned, which mitigates silent substitution risk. However, this is still a prebuilt executable from an S3 bucket with no versioned path (the URL has no version component, meaning the same URL could theoretically serve different content for different versions), and S3 buckets can be misconfigured or taken over. The binary is executed directly (install -m755). This is a genuine but low-probability supply-chain concern: the host is plausibly official, the checksum is pinned, but the unversioned S3 URL and lack of GPG signature keep this at medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Caleb Maclennan <caleb@alerque.com>
    
      2
    
      3pkgname=ec2-metadata
    
      4pkgver=0.1.1
    
      5pkgrel=1
    
      6pkgdesc="Query the EC2 instance Metadata from within a running instance"
    
      7arch=('any')
    
      8url='https://aws.amazon.com/code/ec2-instance-metadata-query-tool/'
    
      9license=('Apache')
    
      10depends=('curl')
    
      11source=("https://s3.amazonaws.com/ec2metadata/$pkgname")
    
      12sha256sums=('e320585b2455a879f201c6a0cc381a5b645ce1bd851c7946e12dc6513c07769d')
    
      13
    
      14package() {
    
      15    install -Dm755 -t "$pkgdir/usr/bin/" $pkgname
    
      16}
    
      17

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2