f5epi

maintainer fallst4r · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 RPM containing executables (f5epi, f5PolicyServer) from vpn.brown.edu, which is Brown University's VPN portal rather than an official F5 Networks distribution host. While Brown University is a legitimate institution running F5 VPN infrastructure, this is still a third-party host redistributing F5's proprietary binary software — not the canonical F5 download server. The RPM is installed directly into /opt and symlinked into /usr/bin, meaning the binaries execute with user privileges. The checksums (MD5+SHA256) are pinned, which mitigates silent substitution risk somewhat, but the source host could change the file at any time since the URL does not include a version-pinned path (the RPM URL lacks the version number, only the PKGBUILD pkgver tracks it). This is a genuine medium-severity supply-chain concern: executed proprietary binaries from a non-canonical third-party institutional host with no way to verify authenticity against F5's official distribution channel.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source_x86_64=("linux_${pkgname}-${pkgver}-${pkgrel}.x86_64.rpm::https://vpn.brown.edu/public/download/linux_${pkgname}.x86_64.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 RPM containing executables (f5epi, f5PolicyServer) from vpn.brown.edu, which is Brown University's VPN portal rather than an official F5 Networks distribution host. While Brown University is a legitimate institution running F5 VPN infrastructure, this is still a third-party host redistributing F5's proprietary binary software — not the canonical F5 download server. The RPM is installed directly into /opt and symlinked into /usr/bin, meaning the binaries execute with user privileges. The checksums (MD5+SHA256) are pinned, which mitigates silent substitution risk somewhat, but the source host could change the file at any time since the URL does not include a version-pinned path (the RPM URL lacks the version number, only the PKGBUILD pkgver tracks it). This is a genuine medium-severity supply-chain concern: executed proprietary binaries from a non-canonical third-party institutional host with no way to verify authenticity against F5's official distribution channel.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lucas Declercq <lucas.declercq@hoohoot.org>
    
      2pkgname=f5epi
    
      3pkgver=7183.2020.0826.1
    
      4pkgrel=1
    
      5pkgdesc='Endpoint inspection application. It provide capabilities to check machines software processes and files'
    
      6arch=('x86_64')
    
      7source=('LICENSE')
    
      8source_x86_64=("linux_${pkgname}-${pkgver}-${pkgrel}.x86_64.rpm::https://vpn.brown.edu/public/download/linux_${pkgname}.x86_64.rpm")
    
      9md5sums=('2508fc5e24d46163844dba9534fe7924')
    
      10md5sums_x86_64=('ceb72a2b1a0a7857da61a23f7c004f22')
    
      11sha256sums=('a8f4b5d965dc0279dd5173109892251ce5d107d9912836e6d83a9b6896eb19a1')
    
      12sha256sums_x86_64=('c1f755ba00e16ea61ec137b1c2f6bad1d0f56e53a88c885691922e88746ffa2d')
    
      13depends=()
    
      14url='https://support.f5.com/csp/article/K32311645#link_04_05'
    
      15license=('commercial')
    
      16
    
      17package() {
    
      18    (
    
      19    cd "${srcdir}/opt/f5/epi"
    
      20
    
      21    install -Dm644 "com.f5.${pkgname}.desktop" "${pkgdir}/usr/share/applications/com.f5.${pkgname}.desktop"
    
      22    install -Dm644 "com.f5.${pkgname}.service" "${pkgdir}/usr/share/dbus-1/services/com.f5.${pkgname}.service"
    
      23    install -dm755 "${pkgdir}/usr/bin/"
    
      24
    
      25    for executable in $pkgname f5PolicyServer; do
    
      26        ln -s "/opt/f5/epi/${executable}" "${pkgdir}"/usr/bin/${executable}
    
      27    done
    
      28
    
      29    # Use system Qt libraries
    
      30    for library in lib/*.so.*; do
    
      31        ln -sf "/usr/${library%%.so.*}.so" "$library"
    
      32    done
    
      33
    
      34    for resolution in 16 24 32 48 64 96 128 256 512 1024; do
    
      35        install -Dm644 "logos/${resolution}x${resolution}.png" \
    
      36                        "${pkgdir}/usr/share/icons/hicolor/${resolution}x${resolution}/apps/${pkgname}.png"
    
      37    done
    
      38    )
    
      39    install -Dm644 'LICENSE' "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      40    cp -a opt "${pkgdir}"
    
      41
    
      42}
    
      43
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2