f5epi

MEDIUM

maintainer fallst4r 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt x86_64 RPM containing executables (f5epi, f5PolicyServer) from vpn.brown.edu, which is Brown University's VPN portal rather than an official F5 Networks distribution host. While Brown University is a legitimate institution running F5 VPN infrastructure, this is still a third-party host redistributing F5's proprietary binary software — not the canonical F5 download server. The RPM is installed directly into /opt and symlinked into /usr/bin, meaning the binaries execute with user privileges. The checksums (MD5+SHA256) are pinned, which mitigates silent substitution risk somewhat, but the source host could change the file at any time since the URL does not include a version-pinned path (the RPM URL lacks the version number, only the PKGBUILD pkgver tracks it). This is a genuine medium-severity supply-chain concern: executed proprietary binaries from a non-canonical third-party institutional host with no way to verify authenticity against F5's official distribution channel.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source_x86_64=("linux_${pkgname}-${pkgver}-${pkgrel}.x86_64.rpm::https://vpn.brown.edu/public/download/linux_${pkgname}.x86_64.rpm")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 RPM containing executables (f5epi, f5PolicyServer) from vpn.brown.edu, which is Brown University's VPN portal rather than an official F5 Networks distribution host. While Brown University is a legitimate institution running F5 VPN infrastructure, this is still a third-party host redistributing F5's proprietary binary software — not the canonical F5 download server. The RPM is installed directly into /opt and symlinked into /usr/bin, meaning the binaries execute with user privileges. The checksums (MD5+SHA256) are pinned, which mitigates silent substitution risk somewhat, but the source host could change the file at any time since the URL does not include a version-pinned path (the RPM URL lacks the version number, only the PKGBUILD pkgver tracks it). This is a genuine medium-severity supply-chain concern: executed proprietary binaries from a non-canonical third-party institutional host with no way to verify authenticity against F5's official distribution channel.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lucas Declercq <lucas.declercq@hoohoot.org>
    
      2pkgname=f5epi
    
      3pkgver=7183.2020.0826.1
    
      4pkgrel=1
    
      5pkgdesc='Endpoint inspection application. It provide capabilities to check machines software processes and files'
    
      6arch=('x86_64')
    
      7source=('LICENSE')
    
      8source_x86_64=("linux_${pkgname}-${pkgver}-${pkgrel}.x86_64.rpm::https://vpn.brown.edu/public/download/linux_${pkgname}.x86_64.rpm")
    
      9md5sums=('2508fc5e24d46163844dba9534fe7924')
    
      10md5sums_x86_64=('ceb72a2b1a0a7857da61a23f7c004f22')
    
      11sha256sums=('a8f4b5d965dc0279dd5173109892251ce5d107d9912836e6d83a9b6896eb19a1')
    
      12sha256sums_x86_64=('c1f755ba00e16ea61ec137b1c2f6bad1d0f56e53a88c885691922e88746ffa2d')
    
      13depends=()
    
      14url='https://support.f5.com/csp/article/K32311645#link_04_05'
    
      15license=('commercial')
    
      16
    
      17package() {
    
      18    (
    
      19    cd "${srcdir}/opt/f5/epi"
    
      20
    
      21    install -Dm644 "com.f5.${pkgname}.desktop" "${pkgdir}/usr/share/applications/com.f5.${pkgname}.desktop"
    
      22    install -Dm644 "com.f5.${pkgname}.service" "${pkgdir}/usr/share/dbus-1/services/com.f5.${pkgname}.service"
    
      23    install -dm755 "${pkgdir}/usr/bin/"
    
      24
    
      25    for executable in $pkgname f5PolicyServer; do
    
      26        ln -s "/opt/f5/epi/${executable}" "${pkgdir}"/usr/bin/${executable}
    
      27    done
    
      28
    
      29    # Use system Qt libraries
    
      30    for library in lib/*.so.*; do
    
      31        ln -sf "/usr/${library%%.so.*}.so" "$library"
    
      32    done
    
      33
    
      34    for resolution in 16 24 32 48 64 96 128 256 512 1024; do
    
      35        install -Dm644 "logos/${resolution}x${resolution}.png" \
    
      36                        "${pkgdir}/usr/share/icons/hicolor/${resolution}x${resolution}/apps/${pkgname}.png"
    
      37    done
    
      38    )
    
      39    install -Dm644 'LICENSE' "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      40    cp -a opt "${pkgdir}"
    
      41
    
      42}
    
      43
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2