kiro-cli

maintainer AlphaLynx · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt executable from a non-whitelisted, project-specific domain (prod.download.cli.kiro.dev) without a source URL or version control reference, creating a supply-chain risk if the host is compromised or maliciously redirected, despite checksums being provided.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=($pkgname-$pkgver-x86_64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-x86_64-linux.tar.zst)

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt executable from a non-whitelisted, project-specific domain (prod.download.cli.kiro.dev) without a source URL or version control reference, creating a supply-chain risk if the host is compromised or maliciously redirected, despite checksums being provided.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
    
      2
    
      3pkgname=kiro-cli
    
      4pkgver=2.15.1
    
      5pkgrel=1
    
      6pkgdesc='Prompt to code to deployment in your terminal'
    
      7arch=(aarch64 x86_64)
    
      8url='https://kiro.dev/cli/'
    
      9# By downloading and using Kiro CLI, you agree to the following:
    
      10#   AWS Customer Agreement: https://aws.amazon.com/agreement/
    
      11#   AWS Intellectual Property License: https://aws.amazon.com/legal/aws-ip-license-terms/
    
      12#   Service Terms: https://aws.amazon.com/service-terms/
    
      13#   Privacy Notice: https://aws.amazon.com/privacy/
    
      14license=(LicenseRef-Kiro)
    
      15depends=(glibc libgcc sh)
    
      16conflicts=(amazon-q)
    
      17options=(!debug)
    
      18source=(Kiro-LICENSE.txt)
    
      19source_x86_64=($pkgname-$pkgver-x86_64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-x86_64-linux.tar.zst)
    
      20source_aarch64=($pkgname-$pkgver-aarch64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-aarch64-linux.tar.zst)
    
      21sha256sums=('1840298f83a857294aa3f5adfc85835127499df54c557d8c3df76f04a56acf55')
    
      22sha256sums_aarch64=('ae477a97a98dc484e4849a9599c91f05a534c7747016e3d9fac4073ee0ff9ddb')
    
      23sha256sums_x86_64=('a1f89b0b66caae8fe685310c9b0dd4fb76071fa280d69b0c4c23acff6a558143')
    
      24b2sums=('67ddcca288e9f92ee33d5f1e56dd66164542f4f85421a0c6004f55ff94b961b8db6908b249dea65c68c048925acf11c82d0f6c24f7da3948249ecf2aa4ce3880')
    
      25b2sums_aarch64=('f849b53d5a77879f9f52eae79284b744b7e93f6b5fda1d746379f52b913e208cea7d972be78b85911c8b9e401b811b698125de91da60ff76ec4dc4734a671cd3')
    
      26b2sums_x86_64=('4b032d6a475f30151962b400ce7c2e57a9fcc0fb988008b3867355d4878592ae1b3161ba356a82b72f7c42658518b0566ce31323781d52f39ef7c66a5392d7ff')
    
      27
    
      28prepare() {
    
      29    cd kirocli/bin
    
      30    sed -i 's|\$HOME/.local/bin/kiro-cli|/usr/bin/kiro-cli|g' q qchat
    
      31}
    
      32
    
      33build() {
    
      34    cd kirocli
    
      35    mkdir completions
    
      36    ./bin/kiro-cli completion bash > completions/kiro-cli
    
      37    ./bin/kiro-cli completion zsh > completions/_kiro-cli
    
      38    ./bin/kiro-cli completion fish > completions/kiro-cli.fish
    
      39}
    
      40
    
      41package() {
    
      42    cd kirocli
    
      43    install -Dm755 bin/kiro-cli -t "$pkgdir/usr/bin"
    
      44    install -Dm755 bin/kiro-cli-chat -t "$pkgdir/usr/bin"
    
      45    install -Dm755 bin/kiro-cli-term -t "$pkgdir/usr/bin"
    
      46    install -Dm755 bin/q -t "$pkgdir/usr/bin"
    
      47    install -Dm755 bin/q -t "$pkgdir/usr/bin"
    
      48
    
      49    install -Dm644 completions/kiro-cli -t "$pkgdir/usr/share/bash-completion/completions"
    
      50    install -Dm644 completions/_kiro-cli -t "$pkgdir/usr/share/zsh/site-functions"
    
      51    install -Dm644 completions/kiro-cli.fish -t "$pkgdir/usr/share/fish/vendor_completions.d"
    
      52
    
      53    install -Dm644 "$srcdir/Kiro-LICENSE.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
    
      54}
    
      55

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
 
 pkgname=kiro-cli
-pkgver=2.14.1
+pkgver=2.15.1
 pkgrel=1
 pkgdesc='Prompt to code to deployment in your terminal'
 arch=(aarch64 x86_64)
@@ -19,11 +19,11 @@
 source_x86_64=($pkgname-$pkgver-x86_64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-x86_64-linux.tar.zst)
 source_aarch64=($pkgname-$pkgver-aarch64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-aarch64-linux.tar.zst)
 sha256sums=('1840298f83a857294aa3f5adfc85835127499df54c557d8c3df76f04a56acf55')
-sha256sums_aarch64=('5b2765def6adf2db9bc99e0a428b1b8d9b6e14927ca610077dfdae7d206ec3cf')
-sha256sums_x86_64=('2027e33de7b1e4172047037d313d84982b2d35dd7174376ac17f55150fb9e4c1')
+sha256sums_aarch64=('ae477a97a98dc484e4849a9599c91f05a534c7747016e3d9fac4073ee0ff9ddb')
+sha256sums_x86_64=('a1f89b0b66caae8fe685310c9b0dd4fb76071fa280d69b0c4c23acff6a558143')
 b2sums=('67ddcca288e9f92ee33d5f1e56dd66164542f4f85421a0c6004f55ff94b961b8db6908b249dea65c68c048925acf11c82d0f6c24f7da3948249ecf2aa4ce3880')
-b2sums_aarch64=('d7db07d4266748ee88b34f6b25084ae45ebc247c83520906b6b9f829d78d7ce00264a3746c6d3a95ec75e8b51e2511a9f2655c6d3c30758a40a689b58c5362b4')
-b2sums_x86_64=('997326d4947a72d7b798af0ea8627a51aa1056051020e6be21932b88a3ebc6267414959fe717fd95387ecca29fe4958e80945d494d6ac7393f52f836988507ea')
+b2sums_aarch64=('f849b53d5a77879f9f52eae79284b744b7e93f6b5fda1d746379f52b913e208cea7d972be78b85911c8b9e401b811b698125de91da60ff76ec4dc4734a671cd3')
+b2sums_x86_64=('4b032d6a475f30151962b400ce7c2e57a9fcc0fb988008b3867355d4878592ae1b3161ba356a82b72f7c42658518b0566ce31323781d52f39ef7c66a5392d7ff')
 
 prepare() {
     cd kirocli/bin

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 05:17:13	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 05:10:22	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 05:27:22	MEDIUM	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2