kth-node

maintainer fran-dv · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD has several real supply-chain concerns beyond just the pip install: (1) kthbuild is installed from PyPI without any version pin or hash verification, and it is then executed as part of the build process; (2) conan config is pulled from a GitHub raw URL (https://github.com/k-nuth/ci-utils/raw/master/conan/config2023.zip) without any integrity check — this zip is executed by conan and could contain arbitrary scripts; (3) the actual binary being installed is built via conan from a third-party package registry (https://packages.kth.cash/api), not from a verified upstream source tarball, meaning the compiled binary's provenance is entirely dependent on that external registry; (4) source=() is empty with no checksums, so there is nothing for makepkg to verify. Taken together, the build fetches and executes code from three separate external, unofficial sources (PyPI kthbuild, GitHub raw zip, kth.cash conan registry) with no integrity verification at any step. This is a genuine medium-severity supply-chain risk: not clearly malicious, but any of these sources could be compromised to deliver a backdoored binary or build tool.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:27 pip install kthbuild --target="$srcdir/pip-tools" --no-warn-script-location

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD has several real supply-chain concerns beyond just the pip install: (1) kthbuild is installed from PyPI without any version pin or hash verification, and it is then executed as part of the build process; (2) conan config is pulled from a GitHub raw URL (https://github.com/k-nuth/ci-utils/raw/master/conan/config2023.zip) without any integrity check — this zip is executed by conan and could contain arbitrary scripts; (3) the actual binary being installed is built via conan from a third-party package registry (https://packages.kth.cash/api), not from a verified upstream source tarball, meaning the compiled binary's provenance is entirely dependent on that external registry; (4) source=() is empty with no checksums, so there is nothing for makepkg to verify. Taken together, the build fetches and executes code from three separate external, unofficial sources (PyPI kthbuild, GitHub raw zip, kth.cash conan registry) with no integrity verification at any step. This is a genuine medium-severity supply-chain risk: not clearly malicious, but any of these sources could be compromised to deliver a backdoored binary or build tool.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fran-dv <franciscodellav@gmail.com>
    
      2pkgname=kth-node
    
      3pkgver=0.75.0
    
      4pkgrel=1
    
      5pkgdesc="High-performance Bitcoin Cash node written in C++23"
    
      6arch=(x86_64)
    
      7url="https://kth.cash/"
    
      8license=('MIT')
    
      9depends=('gcc-libs' 'glibc')
    
      10makedepends=('conan' 'cmake' 'git' 'python-pip')
    
      11options=('!strip')
    
      12source=()
    
      13sha256sums=()
    
      14
    
      15# installation instructions from https://kth.cash/#content-a-executable
    
      16build() {
    
      17    export CC=gcc
    
      18    export CXX=g++
    
      19
    
      20    export CONAN_HOME="$srcdir/conan_home"
    
      21    mkdir -p "$CONAN_HOME"
    
      22
    
      23
    
      24    echo "Installing build helper (kthbuild) locally..."
    
      25
    
      26    mkdir -p "$srcdir/pip-tools"
    
      27    pip install kthbuild --target="$srcdir/pip-tools" --no-warn-script-location
    
      28    
    
      29    export PYTHONPATH="$srcdir/pip-tools:$PYTHONPATH"
    
      30
    
      31    echo "Configuring Conan sandbox..."
    
      32
    
      33    conan profile detect --force
    
      34    
    
      35    if ! conan remote list | grep -q "kth"; then
    
      36        conan remote add kth https://packages.kth.cash/api
    
      37    fi
    
      38
    
      39    conan config install https://github.com/k-nuth/ci-utils/raw/master/conan/config2023.zip
    
      40
    
      41    echo "Installing Knuth Node executable..."
    
      42
    
      43   conan install --requires=kth/${pkgver} \
    
      44        --build=missing \
    
      45        --update \
    
      46        --deployer=direct_deploy \
    
      47        -s compiler.cppstd=23
    
      48}
    
      49
    
      50package() {
    
      51    cd "$srcdir"
    
      52    
    
      53    install -d "$pkgdir/usr/bin"
    
      54    
    
      55    install -m755 "direct_deploy/kth/bin/kth" "$pkgdir/usr/bin/kth"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2