envoyproxy-bin

MEDIUM

maintainer atriix 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary from a non-standard host (archive.tetratelabs.io), which is not the project's primary domain, creating a supply-chain risk if the host were compromised or spoofed.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "https://archive.tetratelabs.io/envoy/download/v$pkgver/envoy-v$pkgver-linux-amd64.tar.xz"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from a non-standard host (archive.tetratelabs.io), which is not the project's primary domain, creating a supply-chain risk if the host were compromised or spoofed.

PKGBUILD

1 offending line(s) highlighted

      1# vim: ts=2 sts=2 sw=2 et ft=sh
    
      2# Maintainer: atriix <aur a snilius d com>
    
      3pkgname=envoyproxy-bin
    
      4provides=(envoyproxy)
    
      5conflicts=(envoyproxy)
    
      6pkgver=1.40.2
    
      7pkgrel=1
    
      8pkgdesc="An open source edge and service proxy, designed for cloud-native applications"
    
      9arch=('x86_64')
    
      10url="https://envoyproxy.io"
    
      11license=('Apache-2.0')
    
      12depends=(glibc)
    
      13source=(
    
      14  "https://archive.tetratelabs.io/envoy/download/v$pkgver/envoy-v$pkgver-linux-amd64.tar.xz"
    
      15)
    
      16sha512sums=('37ac6810aa26f94aca07ab0699dea00b5c6b2420a84a8c8e0670bb462053be069d602f5b8b3179c23e07883ab1901fa3e77804f735f19bbfc7d701676e73b3f0')
    
      17
    
      18
    
      19check() {
    
      20   "$srcdir/envoy-v$pkgver-linux-amd64/bin/envoy" --version > /dev/null
    
      21}
    
      22
    
      23package() {
    
      24  install -Dm755 "$srcdir/envoy-v$pkgver-linux-amd64/bin/envoy" "$pkgdir/usr/bin/envoy"
    
      25}
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -3,7 +3,7 @@
 pkgname=envoyproxy-bin
 provides=(envoyproxy)
 conflicts=(envoyproxy)
-pkgver=1.40.1
+pkgver=1.40.2
 pkgrel=1
 pkgdesc="An open source edge and service proxy, designed for cloud-native applications"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 source=(
   "https://archive.tetratelabs.io/envoy/download/v$pkgver/envoy-v$pkgver-linux-amd64.tar.xz"
 )
-sha512sums=('c4f2c11ea2459c2c9f59013247ff5eb298bb626920160e035071c319086101b667a168af94ca71459316afbb58a8108a5fc040cfb804df468c4670287a595384')
+sha512sums=('37ac6810aa26f94aca07ab0699dea00b5c6b2420a84a8c8e0670bb462053be069d602f5b8b3179c23e07883ab1901fa3e77804f735f19bbfc7d701676e73b3f0')
 
 
 check() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 21:48:49	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 21:43:05	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2