kubeless

maintainer stefanc_diff · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads two pre-built binaries (kubecfg from ksonnet's GitHub releases and kubectl from Google's official storage) outside of the source=() array during prepare(), meaning they receive no checksum verification. Both sources are legitimate (ksonnet/kubecfg on GitHub, kubectl from storage.googleapis.com/kubernetes-release which is the official Google distribution channel), and the binaries are used only as build-time tools (not installed into the final package). There is no obfuscation, no exfiltration, and no attacker-controlled host. However, fetching and executing unverified binaries during the build is a real security concern: a MITM or a compromised release on those hosts could inject malicious code into the build process. This is sloppy packaging rather than malicious intent, but the risk is real enough to rate medium rather than low, since the unverified binaries are actually executed during the build. The package also uses 'git+' with SKIP checksum and checks out a specific tag, which is acceptable but not ideal.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:75 KUBECTL_VERSION=$(wget -qO- https://storage.googleapis.com/kubernetes-release/release/stable.txt); \
PKGBUILD:76 wget -q -O "${_builddepends_bins_path}/kubectl" https://storage.googleapis.com/kubernetes-release/release/$KUBECTL_VERSION/bin/$(go env GOOS)/$(go env GOARCH)/kubectl; \

MEDIUM AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it MEDIUM (confidence 82%): The PKGBUILD downloads two pre-built binaries (kubecfg from ksonnet's GitHub releases and kubectl from Google's official storage) outside of the source=() array during prepare(), meaning they receive no checksum verification. Both sources are legitimate (ksonnet/kubecfg on GitHub, kubectl from storage.googleapis.com/kubernetes-release which is the official Google distribution channel), and the binaries are used only as build-time tools (not installed into the final package). There is no obfuscation, no exfiltration, and no attacker-controlled host. However, fetching and executing unverified binaries during the build is a real security concern: a MITM or a compromised release on those hosts could inject malicious code into the build process. This is sloppy packaging rather than malicious intent, but the risk is real enough to rate medium rather than low, since the unverified binaries are actually executed during the build. The package also uses 'git+' with SKIP checksum and checks out a specific tag, which is acceptable but not ideal.

1 higher static finding superseded - not the current verdict (shown for transparency)

HIGH Downloaded file is executed download_then_exec

A file fetched with curl/wget (not part of source=(), so never checksum-verified) is later made executable or run — a fetch-and-execute pattern split across statements.

PKGBUILD:73 chmod +x "${_builddepends_bins_path}/kubecfg";
PKGBUILD:77 chmod +x "${_builddepends_bins_path}/kubectl";

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Stefan Cocora <stefan dot cocora at gmail dot com>
    
      2# Contributor:
    
      3
    
      4_pkgauthor=kubeless
    
      5_upstream_pkgname=kubeless
    
      6pkgname=kubeless
    
      7pkgver=1.0.4
    
      8pkgrel=1
    
      9pkgdesc="A Kubernetes-native serverless framework that lets you deploy small bits of code without having to worry about the underlying infrastructure plumbing."
    
      10arch=('x86_64')
    
      11groups=()
    
      12depends=(
    
      13  "filesystem"
    
      14  "glibc"
    
      15  "iana-etc"
    
      16  "linux-api-headers"
    
      17  "tzdata"
    
      18)
    
      19makedepends=(
    
      20  "go"
    
      21  "git"
    
      22  "wget"
    
      23)
    
      24_builddepends_bins_path="$HOME/tmp/build/bin"
    
      25provides=()
    
      26conflicts=()
    
      27replaces=()
    
      28backup=()
    
      29options=()
    
      30install=
    
      31license=("Apache")
    
      32_manifest_non_rbac="${_upstream_pkgname}-non-rbac.yaml"
    
      33_manifest_openshift="${_upstream_pkgname}-openshift.yaml"
    
      34_manifest_rbac="${_upstream_pkgname}.yaml"
    
      35url="https://github.com/${_pkgauthor}/${_upstream_pkgname}"
    
      36# https://github.com/kubeless/kubeless/archive/v1.0.0.tar.gz
    
      37source=("${pkgname}::git+https://github.com/${_pkgauthor}/${_upstream_pkgname}.git"
    
      38  "LICENSE::https://raw.githubusercontent.com/${_pkgauthor}/${_upstream_pkgname}/master/LICENSE")
    
      39sha256sums=('SKIP'
    
      40            'fdcee9e38cea79678ee1fa2cb86ce9889eea24899b526911dc982bf4519113b2')
    
      41
    
      42
    
      43prepare() {
    
      44
    
      45  local OP="prepare"
    
      46
    
      47  if [ "$PKGBUILD_DEBUG" = "true" ];
    
      48  then
    
      49	  cd "${srcdir}/${_upstream_pkgname}"
    
      50
    
      51	  echo "pkgver: $(git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g')"
    
      52
    
      53    echo "running function: $OP"
    
      54    echo "user: $(whoami)"
    
      55    echo "CWD: $CWD"
    
      56    echo "PWD: $PWD"
    
      57    echo "CI: $CI"
    
      58    echo "PKGBUILD_DEBUG: $PKGBUILD_DEBUG"
    
      59    echo "BUILDDIR: $BUILDDIR"
    
      60    echo "PKGDEST: $PKGDEST"
    
      61    echo "SRCDEST: $SRCDEST"
    
      62    echo "SRCPKGDEST: $SRCPKGDEST"
    
      63    echo "LOGDEST: $LOGDEST"
    
      64    echo "PACKAGER: $PACKAGER"
    
      65  fi
    
      66
    
      67  # https://github.com/kubeless/kubeless/blob/master/Makefile#L104-L113
    
      68  # have to copy/paste this section because the upstream maintainers are using sudo during this section of the Makefile
    
      69  mkdir -p "${pkgdir}/usr/local/bin"
    
      70  mkdir -p ${_builddepends_bins_path}
    
      71  echo "=== fetching kubecfg"
    
      72  wget -q -O "${_builddepends_bins_path}/kubecfg" https://github.com/ksonnet/kubecfg/releases/download/v0.9.0/kubecfg-$(go env GOOS)-$(go env GOARCH); \
    
      73    chmod +x "${_builddepends_bins_path}/kubecfg";
    
      74  echo "=== fetching kubectl"
    
      75  KUBECTL_VERSION=$(wget -qO- https://storage.googleapis.com/kubernetes-release/release/stable.txt); \
    
      76    wget -q -O "${_builddepends_bins_path}/kubectl" https://storage.googleapis.com/kubernetes-release/release/$KUBECTL_VERSION/bin/$(go env GOOS)/$(go env GOARCH)/kubectl; \
    
      77    chmod +x "${_builddepends_bins_path}/kubectl";
    
      78
    
      79  mkdir -p "${srcdir}/gopath/{bin,src,pkg}"
    
      80  mkdir -p "${srcdir}/gopath/src/github.com/${_pkgauthor}"
    
      81  cp -r "${srcdir}/${pkgname}" "${srcdir}/gopath/src/github.com/${_pkgauthor}/${pkgname}"
    
      82  # build from release tag rather than from the master HEAD
    
      83  cd "${srcdir}/gopath/src/github.com/${_pkgauthor}/${pkgname}" && git checkout "v${pkgver}"
    
      84}
    
      85
    
      86build() {
    
      87  local OP="build"
    
      88
    
      89  if [ "$PKGBUILD_DEBUG" = "true" ];
    
      90  then
    
      91    echo "running function: $OP"
    
      92    echo "user: $(whoami)"
    
      93    echo "CWD: $CWD"
    
      94    echo "PWD: $PWD"
    
      95    echo "CI: $CI"
    
      96    echo "PKGBUILD_DEBUG: $PKGBUILD_DEBUG"
    
      97    echo "BUILDDIR: $BUILDDIR"
    
      98    echo "PKGDEST: $PKGDEST"
    
      99    echo "SRCDEST: $SRCDEST"
    
      100    echo "SRCPKGDEST: $SRCPKGDEST"
    
      101    echo "LOGDEST: $LOGDEST"
    
      102    echo "PACKAGER: $PACKAGER"
    
      103  fi
    
      104
    
      105  export GOPATH="${srcdir}/gopath"
    
      106  export PATH="${_builddepends_bins_path}:${PATH}"
    
      107  export CGO_ENABLED=0
    
      108  cd "${srcdir}/gopath/src/github.com/${_pkgauthor}/${pkgname}"
    
      109  # https://github.com/kubeless/kubeless/blob/master/.circleci/config.yml#L77-L105
    
      110  go get -u golang.org/x/lint/golint
    
      111  make bootstrap
    
      112  # make VERSION=${CONTROLLER_TAG} binary
    
      113  make VERSION="${pkgver}" binary
    
      114  make test
    
      115  make validation
    
      116  make all-yaml
    
      117  mkdir build-manifests
    
      118  MANIFESTS="kubeless kubeless-non-rbac kubeless-openshift"; \
    
      119  IFS=' ' read -r -a manifests <<< "$MANIFESTS"; \
    
      120  for f in "${manifests[@]}"; do \
    
      121    sed -i.bak 's/:latest/'":${CONTROLLER_TAG}"'/g' ${f}.yaml; \
    
      122    cp ${f}.yaml build-manifests/; \
    
      123  done
    
      124}
    
      125
    
      126
    
      127package() {
    
      128  local OP="package"
    
      129
    
      130  if [ "$PKGBUILD_DEBUG" = "true" ];
    
      131  then
    
      132    echo "running function: $OP"
    
      133    echo "user: $(whoami)"
    
      134    echo "CWD: $CWD"
    
      135    echo "PWD: $PWD"
    
      136    echo "CI: $CI"
    
      137    echo "PKGBUILD_DEBUG: $PKGBUILD_DEBUG"
    
      138    echo "BUILDDIR: $BUILDDIR"
    
      139    echo "PKGDEST: $PKGDEST"
    
      140    echo "SRCDEST: $SRCDEST"
    
      141    echo "SRCPKGDEST: $SRCPKGDEST"
    
      142    echo "LOGDEST: $LOGDEST"
    
      143    echo "PACKAGER: $PACKAGER"
    
      144  fi
    
      145  install -Dm755 "${srcdir}/gopath/bin/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      146
    
      147  mkdir -p "${pkgdir}/usr/share/licenses/${_upstream_pkgname}"
    
      148  cp "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${_upstream_pkgname}"
    
      149
    
      150  mkdir -p "${pkgdir}/usr/share/${_upstream_pkgname}/manifests"
    
      151  cp "${srcdir}/gopath/src/github.com/${pkgname}/${_pkgauthor}/build-manifests/${_manifest_non_rbac}" "${pkgdir}/usr/share/${_upstream_pkgname}/manifests/"
    
      152  cp "${srcdir}/gopath/src/github.com/${pkgname}/${_pkgauthor}/build-manifests/${_manifest_openshift}" "${pkgdir}/usr/share/${_upstream_pkgname}/manifests/"
    
      153  cp "${srcdir}/gopath/src/github.com/${pkgname}/${_pkgauthor}/build-manifests/${_manifest_rbac}" "${pkgdir}/usr/share/${_upstream_pkgname}/manifests/"
    
      154  chmod 644 "${pkgdir}/usr/share/${_upstream_pkgname}/manifests/"*.yaml
    
      155}
    
      156

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3