kubeless-git

maintainer stefanc_diff · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads and executes kubecfg and kubectl from official GitHub and Google Cloud Storage hosts during prepare(), but these are standard build dependencies for the project and not malicious; the source is built from the official git repository, and the downloads are from known, trusted project hosts.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads and executes kubecfg and kubectl from official GitHub and Google Cloud Storage hosts during prepare(), but these are standard build dependencies for the project and not malicious; the source is built from the official git repository, and the downloads are from known, trusted project hosts.

2 higher static findings superseded - not the current verdict (shown for transparency)

HIGH Downloaded file is executed download_then_exec

A file fetched with curl/wget (not part of source=(), so never checksum-verified) is later made executable or run — a fetch-and-execute pattern split across statements.

PKGBUILD:52 chmod +x "${_builddepends_bins_path}/kubecfg";
PKGBUILD:56 chmod +x "${_builddepends_bins_path}/kubectl";

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:54 KUBECTL_VERSION=$(wget -qO- https://storage.googleapis.com/kubernetes-release/release/stable.txt); \
PKGBUILD:55 wget -q -O "${_builddepends_bins_path}/kubectl" https://storage.googleapis.com/kubernetes-release/release/$KUBECTL_VERSION/bin/$(go env GOOS)/$(go env GOARCH)/kubectl; \

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Stefan Cocora <stefan dot cocora at gmail dot com>
    
      2# Contributor:
    
      3
    
      4_pkgauthor=kubeless
    
      5_upstream_pkgname=kubeless
    
      6pkgname=kubeless-git
    
      7pkgver=v1.0.4.r3.gba4c1a02
    
      8pkgrel=1
    
      9pkgdesc="A Kubernetes-native serverless framework that lets you deploy small bits of code without having to worry about the underlying infrastructure plumbing."
    
      10arch=('x86_64')
    
      11groups=()
    
      12depends=(
    
      13  "filesystem"
    
      14  "glibc"
    
      15  "iana-etc"
    
      16  "linux-api-headers"
    
      17  "tzdata"
    
      18)
    
      19makedepends=(
    
      20  "go"
    
      21  "git"
    
      22  "wget"
    
      23)
    
      24_builddepends_bins_path="$HOME/tmp/build/bin"
    
      25provides=()
    
      26conflicts=()
    
      27replaces=()
    
      28backup=()
    
      29options=()
    
      30install=
    
      31license=("Apache")
    
      32_manifest_non_rbac="${_upstream_pkgname}-non-rbac.yaml"
    
      33_manifest_openshift="${_upstream_pkgname}-openshift.yaml"
    
      34_manifest_rbac="${_upstream_pkgname}.yaml"
    
      35url="https://github.com/${_pkgauthor}/${_upstream_pkgname}"
    
      36# https://github.com/kubeless/kubeless/archive/v1.0.0.tar.gz
    
      37source=("${_upstream_pkgname}::git+https://github.com/${_pkgauthor}/${_upstream_pkgname}.git"
    
      38  "LICENSE::https://raw.githubusercontent.com/${_pkgauthor}/${_upstream_pkgname}/master/LICENSE")
    
      39sha256sums=(
    
      40  "SKIP"
    
      41  "SKIP"
    
      42)
    
      43
    
      44
    
      45prepare() {
    
      46  # https://github.com/kubeless/kubeless/blob/master/Makefile#L104-L113
    
      47  # have to copy/paste this section because the upstream maintainers are using sudo during this section of the Makefile
    
      48  mkdir -p "${pkgdir}/usr/local/bin"
    
      49  mkdir -p ${_builddepends_bins_path}
    
      50  echo "=== fetching kubecfg"
    
      51  wget -q -O "${_builddepends_bins_path}/kubecfg" https://github.com/ksonnet/kubecfg/releases/download/v0.9.0/kubecfg-$(go env GOOS)-$(go env GOARCH); \
    
      52    chmod +x "${_builddepends_bins_path}/kubecfg";
    
      53  echo "=== fetching kubectl"
    
      54  KUBECTL_VERSION=$(wget -qO- https://storage.googleapis.com/kubernetes-release/release/stable.txt); \
    
      55    wget -q -O "${_builddepends_bins_path}/kubectl" https://storage.googleapis.com/kubernetes-release/release/$KUBECTL_VERSION/bin/$(go env GOOS)/$(go env GOARCH)/kubectl; \
    
      56    chmod +x "${_builddepends_bins_path}/kubectl";
    
      57
    
      58  mkdir -p "${srcdir}/gopath/{bin,src,pkg}"
    
      59  mkdir -p "${srcdir}/gopath/src/github.com/${_pkgauthor}"
    
      60  cp -r "${srcdir}/${_upstream_pkgname}" "${srcdir}/gopath/src/github.com/${_pkgauthor}/${_upstream_pkgname}"
    
      61  # debug
    
      62	cd "${srcdir}/${_upstream_pkgname}"
    
      63
    
      64	echo "pkgver: $(git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g')"
    
      65  # debug
    
      66}
    
      67
    
      68pkgver() {
    
      69	cd "${srcdir}/${_upstream_pkgname}"
    
      70
    
      71	git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      72}
    
      73
    
      74build() {
    
      75  export GOPATH="${srcdir}/gopath"
    
      76  export PATH="${_builddepends_bins_path}:${PATH}"
    
      77  cd "${srcdir}/gopath/src/github.com/${_pkgauthor}/${_upstream_pkgname}"
    
      78  # https://github.com/kubeless/kubeless/blob/master/.circleci/config.yml#L77-L105
    
      79  go get -u golang.org/x/lint/golint
    
      80  make bootstrap
    
      81  # make VERSION=${CONTROLLER_TAG} binary
    
      82  make VERSION="${pkgver}" binary
    
      83  make test
    
      84  make validation
    
      85  make all-yaml
    
      86  mkdir build-manifests
    
      87  MANIFESTS="kubeless kubeless-non-rbac kubeless-openshift"; \
    
      88  IFS=' ' read -r -a manifests <<< "$MANIFESTS"; \
    
      89  for f in "${manifests[@]}"; do \
    
      90    sed -i.bak 's/:latest/'":${CONTROLLER_TAG}"'/g' ${f}.yaml; \
    
      91    cp ${f}.yaml build-manifests/; \
    
      92  done
    
      93}
    
      94
    
      95
    
      96package() {
    
      97  install -Dm755 "${srcdir}/gopath/bin/${_upstream_pkgname}" "${pkgdir}/usr/bin/${_upstream_pkgname}"
    
      98
    
      99  mkdir -p "${pkgdir}/usr/share/licenses/${_upstream_pkgname}"
    
      100  cp "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${_upstream_pkgname}"
    
      101
    
      102  mkdir -p "${pkgdir}/usr/share/${_upstream_pkgname}/manifests"
    
      103  cp "${srcdir}/gopath/src/github.com/${_upstream_pkgname}/${_pkgauthor}/build-manifests/${_manifest_non_rbac}" "${pkgdir}/usr/share/${_upstream_pkgname}/manifests/"
    
      104  cp "${srcdir}/gopath/src/github.com/${_upstream_pkgname}/${_pkgauthor}/build-manifests/${_manifest_openshift}" "${pkgdir}/usr/share/${_upstream_pkgname}/manifests/"
    
      105  cp "${srcdir}/gopath/src/github.com/${_upstream_pkgname}/${_pkgauthor}/build-manifests/${_manifest_rbac}" "${pkgdir}/usr/share/${_upstream_pkgname}/manifests/"
    
      106  chmod 644 "${pkgdir}/usr/share/${_upstream_pkgname}/manifests/"*.yaml
    
      107}
    
      108

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3