ferronweb

maintainer r1sk · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary from dl.ferron.sh, which is the project's own download subdomain (matching the upstream URL ferron.sh). This is a common pattern for projects distributing official release binaries. However, it is still a prebuilt binary from a non-GitHub/non-PyPI/non-official-distro host, and there is no way to verify the build provenance or reproducibility. The sha256sums are hardcoded per-architecture, which provides integrity checking but not authenticity. The binary is installed as an executable web server running as a dedicated system user with CAP_NET_BIND_SERVICE. The risk is real but not clearly malicious: if dl.ferron.sh were compromised or if the project itself were malicious, arbitrary code would execute on the system. This fits the medium category: executed binary from a non-standard (though plausibly official) host with no GPG signature verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 source=("https://dl.ferron.sh/${pkgver}/ferron-${pkgver}-${_arch}-unknown-linux-gnu${abi}.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary from dl.ferron.sh, which is the project's own download subdomain (matching the upstream URL ferron.sh). This is a common pattern for projects distributing official release binaries. However, it is still a prebuilt binary from a non-GitHub/non-PyPI/non-official-distro host, and there is no way to verify the build provenance or reproducibility. The sha256sums are hardcoded per-architecture, which provides integrity checking but not authenticity. The binary is installed as an executable web server running as a dedicated system user with CAP_NET_BIND_SERVICE. The risk is real but not clearly malicious: if dl.ferron.sh were compromised or if the project itself were malicious, arbitrary code would execute on the system. This fits the medium category: executed binary from a non-standard (though plausibly official) host with no GPG signature verification.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=ferronweb
    
      2pkgver=2.6.0
    
      3pkgrel=1
    
      4pkgdesc="Ferron web server"
    
      5arch=('x86_64' 'i686' 'armv7h' 'aarch64' 'riscv64')
    
      6url="https://ferron.sh"
    
      7license=('custom')
    
      8depends=('libcap' 'unzip')
    
      9backup=('etc/ferron.kdl')
    
      10install=ferron.install
    
      11_sha256sums_x86_64='f5f37850e289e6831a0f7ba3043c37b1026ea6027b0b8640017452fa351887a7'
    
      12_sha256sums_i686='d69a389fc5821f148b838dd2fdf016b864c5c238c52ea65f800a2f6ce8bbf9a4'
    
      13_sha256sums_armv7='fde1f27fca0e75a8525c27489b73a41b1dd4425bda8f1287a6d48df950ddb64e'
    
      14_sha256sums_aarch64='efff2bf7358c99578d7acb969a0ae68e2b817250e81a9fd89e78fdfde3b71f82'
    
      15_sha256sums_riscv64='bc322aadb79b67c8b3a3ea0e10515aac6c5976c4e842b7451b9f5df2d96ea6e4'
    
      16case "$CARCH" in
    
      17    x86_64) 
    
      18        _arch="x86_64" 
    
      19        _checksum="$_sha256sums_x86_64"
    
      20        ;;
    
      21    i386 | i486 | i586 | i686) 
    
      22        _arch="i686" 
    
      23        _checksum="$_sha256sums_i686"
    
      24        ;;
    
      25    armv7h) 
    
      26        _arch="armv7" 
    
      27        _checksum="$_sha256sums_armv7"
    
      28        abi="eabihf"
    
      29        ;;
    
      30    aarch64) 
    
      31        _arch="aarch64" 
    
      32        _checksum="$_sha256sums_aarch64"
    
      33        ;;
    
      34    riscv64) 
    
      35        _arch="riscv64gc"
    
      36        _checksum="$_sha256sums_riscv64"
    
      37        ;;
    
      38    *) error "Unsupported architecture: $CARCH"; exit 1 ;;
    
      39esac
    
      40source=("https://dl.ferron.sh/${pkgver}/ferron-${pkgver}-${_arch}-unknown-linux-gnu${abi}.zip")
    
      41sha256sums=("$_checksum")
    
      42provides=('ferron')
    
      43conflicts=('ferron')
    
      44
    
      45prepare() {
    
      46    cd "$srcdir"
    
      47    unzip -qo "ferron-$pkgver-${_arch}-unknown-linux-gnu${abi}.zip"
    
      48}
    
      49
    
      50package() {
    
      51    case "$CARCH" in
    
      52        x86_64) _arch="x86_64" ;;
    
      53        i686) _arch="i686" ;;
    
      54        armv7h) _arch="armv7" ;;
    
      55        aarch64) _arch="aarch64" ;;
    
      56        riscv64) _arch="riscv64gc" ;;
    
      57        *) error "Unsupported architecture: $CARCH"; exit 1 ;;
    
      58    esac
    
      59    cd "$srcdir"
    
      60    install -dm755 "$pkgdir/var/log/ferron"
    
      61    install -dm755 "$pkgdir/var/www/ferron"
    
      62    install -dm755 "$pkgdir/usr/bin"
    
      63    install -dm755 "$pkgdir/etc"
    
      64    install -dm755 "$pkgdir/usr/lib/systemd/system"
    
      65    cp -r wwwroot/* "$pkgdir/var/www/ferron/"
    
      66    install -Dm755 ferron "$pkgdir/usr/bin/ferron"
    
      67    for binary in ferron-*; do
    
      68        if [[ -f "$binary" && "$binary" != *.zip ]]; then
    
      69                install -Dm755 "$binary" "$pkgdir/usr/bin/$binary"
    
      70        fi
    
      71    done
    
      72    cat > "$pkgdir/etc/ferron.kdl" << 'EOF'
    
      73// Global-only configuration
    
      74* {
    
      75    default_http_port 80
    
      76    default_https_port #null
    
      77    auto_tls #false
    
      78    protocols h1 h2
    
      79    log "/var/log/ferron/access.log"
    
      80    error_log "/var/log/ferron/error.log"
    
      81}
    
      82// Global configuration
    
      83* {
    
      84    root "/var/www/ferron"
    
      85}
    
      86EOF
    
      87    cat > "$pkgdir/usr/lib/systemd/system/ferron.service" << 'EOF'
    
      88[Unit]
    
      89Description=Ferron web server
    
      90After=network.target
    
      91
    
      92[Service]
    
      93Type=simple
    
      94User=ferron
    
      95ExecStart=/usr/sbin/ferron -c /etc/ferron.kdl
    
      96ExecReload=kill -HUP $MAINPID
    
      97Restart=on-failure
    
      98AmbientCapabilities=CAP_NET_BIND_SERVICE
    
      99
    
      100[Install]
    
      101WantedBy=multi-user.target
    
      102EOF
    
      103    install -Dm644 /dev/null "$pkgdir/usr/lib/tmpfiles.d/ferron.conf"
    
      104    cat > "$pkgdir/usr/lib/tmpfiles.d/ferron.conf" << 'EOF'
    
      105d /var/log/ferron 0755 ferron ferron -
    
      106EOF
    
      107    install -Dm644 /dev/null "$pkgdir/usr/lib/sysusers.d/ferron.conf"
    
      108    cat > "$pkgdir/usr/lib/sysusers.d/ferron.conf" << 'EOF'
    
      109u ferron - "Ferron web server" /nonexistent /usr/sbin/nologin
    
      110EOF
    
      111}
    
      112

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2