kr-bin

maintainer kryptco · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt RPM containing executed binaries (kr, krd, krgpg, krssh, kr-pkcs11.so) from kryptco.github.io (GitHub Pages), which is the vendor's own distribution channel for their yum repository — not a random personal host. However, GitHub Pages is not a cryptographically secured release channel like GitHub Releases with checksums verified by the project's signing key. The binaries are installed directly and executed on the user's system. There are no GPG signatures verified. The sha256sums provide integrity against accidental corruption but not against a compromised GitHub Pages deployment. The kr-pkcs11.so library is particularly sensitive as it hooks into SSH authentication. This is a legitimate vendor distribution pattern (many projects host yum/apt repos on GitHub Pages), but the combination of prebuilt binaries + no GPG verification + a security-sensitive SSH tool warrants a medium rating. The cheaper model's assessment is correct in substance, though the host is the vendor's own GitHub Pages rather than a truly random third-party host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://kryptco.github.io/yum/kr-$pkgver-1.el7.centos.x86_64.rpm"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads a prebuilt RPM containing executed binaries (kr, krd, krgpg, krssh, kr-pkcs11.so) from kryptco.github.io (GitHub Pages), which is the vendor's own distribution channel for their yum repository — not a random personal host. However, GitHub Pages is not a cryptographically secured release channel like GitHub Releases with checksums verified by the project's signing key. The binaries are installed directly and executed on the user's system. There are no GPG signatures verified. The sha256sums provide integrity against accidental corruption but not against a compromised GitHub Pages deployment. The kr-pkcs11.so library is particularly sensitive as it hooks into SSH authentication. This is a legitimate vendor distribution pattern (many projects host yum/apt repos on GitHub Pages), but the combination of prebuilt binaries + no GPG verification + a security-sensitive SSH tool warrants a medium rating. The cheaper model's assessment is correct in substance, though the host is the vendor's own GitHub Pages rather than a truly random third-party host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Simon Legner <Simon.Legner@gmail.com>
    
      2pkgname=kr-bin
    
      3pkgver=2.4.13
    
      4pkgrel=2
    
      5pkgdesc="SSH using a key stored in Krypton (binary)"
    
      6arch=('x86_64')
    
      7url="https://github.com/kryptco/kr"
    
      8license=('custom')
    
      9provides=('kr')
    
      10conflicts=('kr')
    
      11source=("https://kryptco.github.io/yum/kr-$pkgver-1.el7.centos.x86_64.rpm"
    
      12        "https://raw.githubusercontent.com/kryptco/kr/$pkgver/LICENSE")
    
      13
    
      14package() {
    
      15  install -Dm644 "$srcdir/usr/lib/kr-pkcs11.so" "$pkgdir/usr/lib/kr-pkcs11.so"
    
      16  install -Dm755 "$srcdir/usr/bin/kr" "$pkgdir/usr/bin/kr"
    
      17  install -Dm755 "$srcdir/usr/bin/krd" "$pkgdir/usr/bin/krd"
    
      18  install -Dm755 "$srcdir/usr/bin/krgpg" "$pkgdir/usr/bin/krgpg"
    
      19  install -Dm755 "$srcdir/usr/bin/krssh" "$pkgdir/usr/bin/krssh"
    
      20  install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      21}
    
      22
    
      23sha256sums=('e808ce3dbbe8ba80158c86c9e5b6dcb7834445024cb7f3369c95cdf70d077d6b'
    
      24            '11c7dc3a4be1cb3ba298e63f902c5ddd60fed026e4c608fe2458b871971f261d')
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2