kathara

maintainer skazza94 · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD sources the main tarball from the official GitHub release tag, which is legitimate. However, the build process installs unversioned/unpinned pip packages (pyinstaller, pytest, setuptools) and installs from requirements.txt files whose contents are not verified by the PKGBUILD itself (no checksums on the requirements files beyond what's in the tarball). The primary concern is that pyinstaller bundles all Python dependencies into a compiled binary that gets installed system-wide — this means whatever pip resolves at build time (including transitive dependencies from PyPI) ends up as executed code in /usr/lib/kathara/_internal. Since the requirements.txt is inside the verified tarball this partially mitigates the risk, but pyinstaller and pytest are pulled from PyPI without version pinning, creating a real (if modest) supply-chain window. The md5sums='SKIP' also means the tarball itself is not integrity-checked. This is a genuine medium-risk pattern: unverified PyPI packages are compiled into and installed as an executed binary bundle, not merely data.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:25 $srcdir/venv/bin/pip install --upgrade "setuptools<81"
PKGBUILD:26 $srcdir/venv/bin/pip install -r $srcdir/Kathara-$pkgver/src/requirements.txt
PKGBUILD:27 $srcdir/venv/bin/pip install -r $srcdir/Kathara-$pkgver/scripts/autocompletion/requirements.txt
PKGBUILD:28 $srcdir/venv/bin/pip install pyinstaller
PKGBUILD:29 $srcdir/venv/bin/pip install pytest

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:55 install -p -m 2755 -g 962 $srcdir/Kathara-$pkgver/src/kathara.dist/kathara/kathara $pkgdir/usr/lib/$pkgname/

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD sources the main tarball from the official GitHub release tag, which is legitimate. However, the build process installs unversioned/unpinned pip packages (pyinstaller, pytest, setuptools) and installs from requirements.txt files whose contents are not verified by the PKGBUILD itself (no checksums on the requirements files beyond what's in the tarball). The primary concern is that pyinstaller bundles all Python dependencies into a compiled binary that gets installed system-wide — this means whatever pip resolves at build time (including transitive dependencies from PyPI) ends up as executed code in /usr/lib/kathara/_internal. Since the requirements.txt is inside the verified tarball this partially mitigates the risk, but pyinstaller and pytest are pulled from PyPI without version pinning, creating a real (if modest) supply-chain window. The md5sums='SKIP' also means the tarball itself is not integrity-checked. This is a genuine medium-risk pattern: unverified PyPI packages are compiled into and installed as an executed binary bundle, not merely data.

PKGBUILD

6 offending line(s) highlighted

      1pkgname=kathara
    
      2pkgver=3.8.3
    
      3pkgrel=1
    
      4pkgdesc="A lightweight container-based network emulation tool."
    
      5arch=('any')
    
      6url="https://www.kathara.org/"
    
      7license=('GPL3')
    
      8install="kathara.install"
    
      9changelog="kathara.changelog"
    
      10makedepends=(
    
      11	'python'
    
      12    'chrpath'
    
      13    'ruby-ronn-ng'
    
      14)
    
      15optdepends=(
    
      16    'docker: for running network scenarios in a local environment'
    
      17    'xterm: for opening devices terminals'
    
      18    'tmux: for devices terminals multiplexing'
    
      19)
    
      20source=("https://github.com/KatharaFramework/Kathara/archive/refs/tags/$pkgver.tar.gz")
    
      21md5sums=('SKIP')
    
      22
    
      23prepare() {
    
      24  python3 -m venv $srcdir/venv
    
      25  $srcdir/venv/bin/pip install --upgrade "setuptools<81"
    
      26  $srcdir/venv/bin/pip install -r $srcdir/Kathara-$pkgver/src/requirements.txt
    
      27  $srcdir/venv/bin/pip install -r $srcdir/Kathara-$pkgver/scripts/autocompletion/requirements.txt
    
      28  $srcdir/venv/bin/pip install pyinstaller
    
      29  $srcdir/venv/bin/pip install pytest
    
      30}
    
      31
    
      32build() {
    
      33  cd $srcdir/Kathara-$pkgver/docs && make roff-build
    
      34  cd $srcdir/Kathara-$pkgver/scripts/autocompletion/ && $srcdir/venv/bin/python generate_autocompletion.py $srcdir/Kathara-$pkgver/scripts/autocompletion/kathara.bash-completion
    
      35  cd $srcdir/Kathara-$pkgver/ && $srcdir/venv/bin/python -m pytest tests
    
      36  cp $srcdir/Kathara-$pkgver/scripts/Linux-Pkg/kathara.spec $srcdir/Kathara-$pkgver/src/
    
      37  cd $srcdir/Kathara-$pkgver/src/ && $srcdir/venv/bin/pyinstaller --distpath=./kathara.dist --workpath=./kathara.build kathara.spec
    
      38}
    
      39
    
      40package() {
    
      41  for man_file in $srcdir/Kathara-$pkgver/docs/Roff/*; do \
    
      42	man_file_dir="man${man_file: -1}"; \
    
      43	[[ -d $srcdir/Kathara-$pkgver/docs/Roff/$man_file_dir ]] || mkdir $srcdir/Kathara-$pkgver/docs/Roff/$man_file_dir; \
    
      44	mv -f $man_file $srcdir/Kathara-$pkgver/docs/Roff/$man_file_dir; \
    
      45  done;
    
      46  install -d -m 755 $pkgdir/usr/share/man
    
      47  cp -r $srcdir/Kathara-$pkgver/docs/Roff/* $pkgdir/usr/share/man/
    
      48
    
      49  install -d -m 755 $pkgdir/etc/bash_completion.d/
    
      50  install -p -m 644 $srcdir/Kathara-$pkgver/scripts/autocompletion/kathara.bash-completion $pkgdir/etc/bash_completion.d/
    
      51
    
      52  install -d $pkgdir/usr/lib/$pkgname
    
      53  cp -r $srcdir/Kathara-$pkgver/src/kathara.dist/kathara/_internal $pkgdir/usr/lib/$pkgname/_internal
    
      54  find $pkgdir/usr/lib/$pkgname/_internal -type f -exec chmod 644 {} \;
    
      55  install -p -m 2755 -g 962 $srcdir/Kathara-$pkgver/src/kathara.dist/kathara/kathara $pkgdir/usr/lib/$pkgname/
    
      56  install -d -m 755 $pkgdir/usr/bin
    
      57  ln -sf /usr/lib/$pkgname/kathara $pkgdir/usr/bin/$pkgname
    
      58}
    
      59
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3