evebox-bin

LOW

maintainer pohl7589 0 votes scanned 2026-11-05 18:12:24.444152

View on AUR

Why flagged

Prebuilt binary downloaded from evebox.org, the project's own official domain, with a pinned sha256 checksum; the flagged non-standard host is simply the upstream project's own release server, not an unrelated swappable third-party host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Prebuilt binary downloaded from evebox.org, the project's own official domain, with a pinned sha256 checksum; the flagged non-standard host is simply the upstream project's own release server, not an unrelated swappable third-party host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 source_x86_64=("https://evebox.org/files/release/${pkgver}/${_pkgname}-${pkgver}-linux-x64.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexander Pohl <alex@ahpohl.com>
    
      2
    
      3pkgname=evebox-bin
    
      4_pkgname=evebox
    
      5pkgver=0.31.0
    
      6pkgrel=2
    
      7pkgdesc="Web based Suricata EVE event viewer and alert management (static upstream binary)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://evebox.org"
    
      10license=('MIT')
    
      11depends=()                       # static musl binary, web UI is embedded
    
      12optdepends=(
    
      13  'suricata: produce EVE logs on this host (server with local input, or agent)'
    
      14  'suricata-nfqueue: same, Suricata built with NFQUEUE inline IPS support'
    
      15  'geoipupdate: download the GeoLite2 City database for GeoIP enrichment'  
    
      16  'elasticsearch: alternative event store instead of the built-in SQLite'
    
      17)
    
      18provides=("${_pkgname}")
    
      19conflicts=("${_pkgname}")
    
      20backup=(
    
      21  'etc/evebox/evebox.yaml'
    
      22  'etc/evebox/agent.yaml'
    
      23)
    
      24options=('!strip' '!debug')
    
      25install=evebox.install
    
      26
    
      27source=(
    
      28  "LICENSE-${pkgver}.txt::https://raw.githubusercontent.com/jasonish/evebox/${pkgver}/LICENSE.txt"
    
      29  'evebox.service'
    
      30  'evebox-agent.service'
    
      31  'evebox.sysusers'
    
      32  'evebox.tmpfiles'
    
      33  'evebox.yaml'
    
      34  'agent.yaml'
    
      35)
    
      36source_x86_64=("https://evebox.org/files/release/${pkgver}/${_pkgname}-${pkgver}-linux-x64.zip")
    
      37source_aarch64=("https://evebox.org/files/release/${pkgver}/${_pkgname}-${pkgver}-linux-arm64.zip")
    
      38
    
      39# Run `updpkgsums` before the first build: upstream publishes no checksum
    
      40# for the zip archives, so the arch-specific SKIP entries are placeholders.
    
      41sha256sums=('cc40a3ad6421ffc194b8cede0bfc34f1354f4345b700c2362f2e96625608f97a'
    
      42            'eb0ff43a308d900f19c7317fcea5c58dd6cbbe0639a4f117d28489f259c30836'
    
      43            '6eb35fbedd62343666fb38536975c235770482270d1853e786fedfab5fe61e45'
    
      44            'ebf1a86bf867286e1fcbbcf66ae80021bcb9aaafb3b70ff22f7c51da83f9a44b'
    
      45            'c5ec1f6e991ee4f3bedc3b4cfcdafe5b42a331da5eca515cb8506e513dd4c889'
    
      46            'f4e4b161f15627d02fe0fd4c2f28b75fb0e151bc27e9c430b28482d5ed8ae043'
    
      47            '9ef5635c9c79f3b371c87af9825343f3d94960241cae81ced0dbed15de9cc47d')
    
      48sha256sums_x86_64=('bccdf368a8246a34902565785eab5e9e7b44a67d079c1f08ac096e1b68a1b6c9')
    
      49sha256sums_aarch64=('606027ef6517009a32e84a749b7bff7afe02fa94c01194dcbb6b189bf63b5803')
    
      50
    
      51_distdir() {
    
      52  case "${CARCH}" in
    
      53    x86_64)  echo "${_pkgname}-${pkgver}-linux-x64" ;;
    
      54    aarch64) echo "${_pkgname}-${pkgver}-linux-arm64" ;;
    
      55  esac
    
      56}
    
      57
    
      58package() {
    
      59  local _dist
    
      60  _dist="$(_distdir)"
    
      61
    
      62  install -Dm755 "${_dist}/evebox" "${pkgdir}/usr/bin/evebox"
    
      63
    
      64  # Configuration (permissions on these are fixed up by tmpfiles, since the
    
      65  # evebox group does not exist at build time)
    
      66  install -Dm644 evebox.yaml "${pkgdir}/etc/evebox/evebox.yaml"
    
      67  install -Dm644 agent.yaml  "${pkgdir}/etc/evebox/agent.yaml"
    
      68
    
      69  # systemd integration
    
      70  install -Dm644 evebox.service       "${pkgdir}/usr/lib/systemd/system/evebox.service"
    
      71  install -Dm644 evebox-agent.service "${pkgdir}/usr/lib/systemd/system/evebox-agent.service"
    
      72  install -Dm644 evebox.sysusers      "${pkgdir}/usr/lib/sysusers.d/evebox.conf"
    
      73  install -Dm644 evebox.tmpfiles      "${pkgdir}/usr/lib/tmpfiles.d/evebox.conf"
    
      74
    
      75  # Upstream example configurations shipped in the zip
    
      76  install -Dm644 -t "${pkgdir}/usr/share/doc/${_pkgname}/examples" \
    
      77    "${_dist}/examples/evebox.yaml" "${_dist}/examples/agent.yaml"
    
      78
    
      79  install -Dm644 "LICENSE-${pkgver}.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 18:12:24	Low	3
2026-11-05 18:10:06	Medium	2