kiro-cli

LOW

maintainer AlphaLynx 8 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt binaries from a project-owned domain (kiro.dev), which is a plausible official source; the worst case of a supply-chain compromise is binary tampering, but the domain and context suggest legitimate use, and no active malicious behavior is present.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads prebuilt binaries from a project-owned domain (kiro.dev), which is a plausible official source; the worst case of a supply-chain compromise is binary tampering, but the domain and context suggest legitimate use, and no active malicious behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=($pkgname-$pkgver-x86_64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-x86_64-linux.tar.zst)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
    
      2
    
      3pkgname=kiro-cli
    
      4pkgver=2.34.2
    
      5pkgrel=1
    
      6pkgdesc='Prompt to code to deployment in your terminal'
    
      7arch=(aarch64 x86_64)
    
      8url='https://kiro.dev/cli/'
    
      9# By downloading and using Kiro CLI, you agree to the following:
    
      10#   AWS Customer Agreement: https://aws.amazon.com/agreement/
    
      11#   AWS Intellectual Property License: https://aws.amazon.com/legal/aws-ip-license-terms/
    
      12#   Service Terms: https://aws.amazon.com/service-terms/
    
      13#   Privacy Notice: https://aws.amazon.com/privacy/
    
      14license=(LicenseRef-Kiro)
    
      15depends=(glibc libgcc sh)
    
      16conflicts=(amazon-q)
    
      17options=(!debug)
    
      18source=(Kiro-LICENSE.txt)
    
      19source_x86_64=($pkgname-$pkgver-x86_64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-x86_64-linux.tar.zst)
    
      20source_aarch64=($pkgname-$pkgver-aarch64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-aarch64-linux.tar.zst)
    
      21sha256sums=('1840298f83a857294aa3f5adfc85835127499df54c557d8c3df76f04a56acf55')
    
      22sha256sums_aarch64=('64106154e12d13d57f65cf3b42a74850bc0e5b0c18443ac24abf519c40e5a6de')
    
      23sha256sums_x86_64=('be39795ab17f52db489256a675c3d78dc6a738ab58874df1f90b3f6f6964bb9f')
    
      24b2sums=('67ddcca288e9f92ee33d5f1e56dd66164542f4f85421a0c6004f55ff94b961b8db6908b249dea65c68c048925acf11c82d0f6c24f7da3948249ecf2aa4ce3880')
    
      25b2sums_aarch64=('bfbb4d3501d3014be8f32812d34229cbd317f71bb349ce4cb6ee44fd4d7df94e2b50a8f6b4de4a0a12d5ea0338370ba50031a79900929e6610f7dba1446757f1')
    
      26b2sums_x86_64=('f24784a349349a27b93d8a2c987a6297e0691be0325fb76ad0b152de704752101332e620d59b3e6ccd2ad7a180cb1c6e58e6793b017d32b3ef9db5c89df41799')
    
      27
    
      28prepare() {
    
      29    cd kirocli/bin
    
      30    sed -i 's|\$HOME/.local/bin/kiro-cli|/usr/bin/kiro-cli|g' q qchat
    
      31}
    
      32
    
      33build() {
    
      34    cd kirocli
    
      35    mkdir completions
    
      36    ./bin/kiro-cli completion bash > completions/kiro-cli
    
      37    ./bin/kiro-cli completion zsh > completions/_kiro-cli
    
      38    ./bin/kiro-cli completion fish > completions/kiro-cli.fish
    
      39}
    
      40
    
      41package() {
    
      42    cd kirocli
    
      43    install -Dm755 bin/kiro-cli -t "$pkgdir/usr/bin"
    
      44    install -Dm755 bin/kiro-cli-chat -t "$pkgdir/usr/bin"
    
      45    install -Dm755 bin/kiro-cli-term -t "$pkgdir/usr/bin"
    
      46    install -Dm755 bin/q -t "$pkgdir/usr/bin"
    
      47    install -Dm755 bin/q -t "$pkgdir/usr/bin"
    
      48
    
      49    install -Dm644 completions/kiro-cli -t "$pkgdir/usr/share/bash-completion/completions"
    
      50    install -Dm644 completions/_kiro-cli -t "$pkgdir/usr/share/zsh/site-functions"
    
      51    install -Dm644 completions/kiro-cli.fish -t "$pkgdir/usr/share/fish/vendor_completions.d"
    
      52
    
      53    install -Dm644 "$srcdir/Kiro-LICENSE.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
    
      54}
    
      55

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
 
 pkgname=kiro-cli
-pkgver=2.34.0
+pkgver=2.34.2
 pkgrel=1
 pkgdesc='Prompt to code to deployment in your terminal'
 arch=(aarch64 x86_64)
@@ -19,11 +19,11 @@
 source_x86_64=($pkgname-$pkgver-x86_64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-x86_64-linux.tar.zst)
 source_aarch64=($pkgname-$pkgver-aarch64.tar.zst::https://prod.download.cli.kiro.dev/stable/$pkgver/kirocli-aarch64-linux.tar.zst)
 sha256sums=('1840298f83a857294aa3f5adfc85835127499df54c557d8c3df76f04a56acf55')
-sha256sums_aarch64=('684d75084f47682295e9944a7eae24a489a3b178e727017c28494a6e78493128')
-sha256sums_x86_64=('1b6728868843f70185d323f9bc88041f4a6341a5c0ac0427ac4c1a381aab6d02')
+sha256sums_aarch64=('64106154e12d13d57f65cf3b42a74850bc0e5b0c18443ac24abf519c40e5a6de')
+sha256sums_x86_64=('be39795ab17f52db489256a675c3d78dc6a738ab58874df1f90b3f6f6964bb9f')
 b2sums=('67ddcca288e9f92ee33d5f1e56dd66164542f4f85421a0c6004f55ff94b961b8db6908b249dea65c68c048925acf11c82d0f6c24f7da3948249ecf2aa4ce3880')
-b2sums_aarch64=('c3b3843489dbdd283382c9cba428569e45dc5f26a3eef71ba1bc970b2119f855984f7d0965e56436b11d8c5d95f72dabb9758513275b6291a466f8782988f762')
-b2sums_x86_64=('352e874d4e4184c81e8e1f90de8ca67d0bb93d499bf69ce92697f83aebd821f9dbbd11b5178032849b74c115fb4321c29fb0b237b8bc4adc48e5518d8317e578')
+b2sums_aarch64=('bfbb4d3501d3014be8f32812d34229cbd317f71bb349ce4cb6ee44fd4d7df94e2b50a8f6b4de4a0a12d5ea0338370ba50031a79900929e6610f7dba1446757f1')
+b2sums_x86_64=('f24784a349349a27b93d8a2c987a6297e0691be0325fb76ad0b152de704752101332e620d59b3e6ccd2ad7a180cb1c6e58e6793b017d32b3ef9db5c89df41799')
 
 prepare() {
     cd kirocli/bin

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 15:52:51	Medium	1
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 03:46:34	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 19:43:04	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 05:34:05	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 05:21:06	Medium	2
2026-10-18 00:06:55	Medium	2