libpam-authentik-bin

maintainer jonathanio · 0 votes · base authentik-platform-bin · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt .deb files from the official project's domain (pkg.goauthentik.io), which is plausibly controlled by the software vendor; the binaries are extracted and installed without further modification, and all checksums are verified, limiting supply-chain risk to the trustworthiness of the upstream vendor.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb files from the official project's domain (pkg.goauthentik.io), which is plausibly controlled by the software vendor; the binaries are extracted and installed without further modification, and all checksums are verified, limiting supply-chain risk to the trustworthiness of the upstream vendor.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=("authentik-agent.deb::https://pkg.goauthentik.io/pool/main/a/authentik-agent/authentik-agent_${pkgver}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jonathan Wright <jon@than.io>
    
      2# Built upon authentik-platform-git PKGBUILD by Matt Cuneo <m@cuneu.au>
    
      3
    
      4pkgbase="authentik-platform-bin"
    
      5pkgdesc='authentik Platform authentication, Agent, CLI and other components'
    
      6pkgname=('authentik-cli-bin' 
    
      7         'authentik-agent-bin' 
    
      8         'authentik-sysd-bin'
    
      9         'libpam-authentik-bin' 
    
      10         'libnss-authentik-bin')
    
      11pkgver=0.50.5
    
      12pkgrel=1
    
      13url="https://github.com/goauthentik/platform"
    
      14license=('MIT')
    
      15makedepends=()
    
      16arch=('x86_64'
    
      17      'aarch64')
    
      18options=('!strip')
    
      19
    
      20source=('authentik-nss.install'
    
      21        'authentik-pam.install'
    
      22        'authentik-sysd.install')
    
      23source_x86_64=("authentik-agent.deb::https://pkg.goauthentik.io/pool/main/a/authentik-agent/authentik-agent_${pkgver}_amd64.deb"
    
      24               "authentik-cli.deb::https://pkg.goauthentik.io/pool/main/a/authentik-cli/authentik-cli_${pkgver}_amd64.deb"
    
      25               "authentik-sysd.deb::https://pkg.goauthentik.io/pool/main/a/authentik-sysd/authentik-sysd_${pkgver}_amd64.deb"
    
      26               "libnss-authentik.deb::https://pkg.goauthentik.io/pool/main/libn/libnss-authentik/libnss-authentik_${pkgver}_amd64.deb"
    
      27               "libpam-authentik.deb::https://pkg.goauthentik.io/pool/main/libp/libpam-authentik/libpam-authentik_${pkgver}_amd64.deb")
    
      28
    
      29source_aarch64=("authentik-agent.deb::https://pkg.goauthentik.io/pool/main/a/authentik-agent/authentik-agent_${pkgver}_arm64.deb"
    
      30                "authentik-cli.deb::https://pkg.goauthentik.io/pool/main/a/authentik-cli/authentik-cli_${pkgver}_arm64.deb"
    
      31                "authentik-sysd.deb::https://pkg.goauthentik.io/pool/main/a/authentik-sysd/authentik-sysd_${pkgver}_arm64.deb"
    
      32                "libnss-authentik.deb::https://pkg.goauthentik.io/pool/main/libn/libnss-authentik/libnss-authentik_${pkgver}_arm64.deb"
    
      33                "libpam-authentik.deb::https://pkg.goauthentik.io/pool/main/libp/libpam-authentik/libpam-authentik_${pkgver}_arm64.deb")
    
      34
    
      35sha256sums=('16e52ff7d18c8aa97edc8f0b06da0ac0f45f4a87ca0ce3a8cf700b5477cfaf57'
    
      36            '1db5d2f9fb1d5d6e5f9cca34e58f1b3b9f55e161d478c76198a4889dfca9fada'
    
      37            'ce6e0895be72586d3944c2b1efdffc3ee16d9e8897690a07f44be733d19b77cf')
    
      38sha256sums_x86_64=('846e32ad5d645e56ea03f5e6035a4f821a60d22c0d021353251c0db4c0c83222'
    
      39                   '38b63d0150ae7dbc93dcfbd510c0ab2098860b786a74cc8d111a95e72b63f1ef'
    
      40                   '98f6de439139fdb9a5f4919db98b840c5d8a2dd0ea6871af28e3fb2486e31c7d'
    
      41                   '3e1a6c2d7821beeb4793f4e6077572ea3c9262b344e5cd9b449b3c765882cb9a'
    
      42                   '11da5b4f94f74e7643a3523a48918193df2a6d81ec3b8a7802595ccc728b47c6')
    
      43sha256sums_aarch64=('846e32ad5d645e56ea03f5e6035a4f821a60d22c0d021353251c0db4c0c83222'
    
      44                    '38b63d0150ae7dbc93dcfbd510c0ab2098860b786a74cc8d111a95e72b63f1ef'
    
      45                    '98f6de439139fdb9a5f4919db98b840c5d8a2dd0ea6871af28e3fb2486e31c7d'
    
      46                    '3e1a6c2d7821beeb4793f4e6077572ea3c9262b344e5cd9b449b3c765882cb9a'
    
      47                    '11da5b4f94f74e7643a3523a48918193df2a6d81ec3b8a7802595ccc728b47c6')
    
      48
    
      49noextract=('authentik-agent.deb'
    
      50           'authentik-cli.deb'
    
      51           'authentik-sysd.deb'
    
      52           'libnss-authentik.deb'
    
      53           'libpam-authentik.deb')
    
      54
    
      55prepare() {
    
      56  true # Do nothing
    
      57}
    
      58
    
      59package_authentik-sysd-bin() {
    
      60  pkgdesc="authentik System Agent"
    
      61  provides=(authentik-sysd)
    
      62  conflicts=(authentik-sysd)
    
      63  backup=(etc/authentik/config.json)
    
      64  install=authentik-sysd.install
    
      65
    
      66  optdepends=(
    
      67    'libnss-authentik: Make the system aware of Authentik users'
    
      68    'libpam-authentik: Allow logging in as an Authentik user'
    
      69  )
    
      70
    
      71  bsdtar -O -xf "authentik-sysd.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      72}
    
      73
    
      74package_authentik-agent-bin() {
    
      75  pkgdesc="authentik Agent"
    
      76  provides=(authentik-agent)
    
      77  conflicts=(authentik-agent)
    
      78  depends=(authentik-sysd authentik-cli)
    
      79
    
      80  bsdtar -O -xf "authentik-agent.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      81}
    
      82
    
      83package_authentik-cli-bin() {
    
      84  pkgdesc="authentik CLI"
    
      85  provides=(authentik-cli)
    
      86  conflicts=(authentik-cli)
    
      87  depends=(authentik-agent authentik-sysd)
    
      88
    
      89  bsdtar -O -xf "authentik-cli.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      90}
    
      91
    
      92package_libnss-authentik-bin() {
    
      93  depends=(authentik-sysd)
    
      94  provides=(libnss-authentik)
    
      95  conflicts=(libnss-authentik authentik-nss)
    
      96  pkgdesc="Authentik NSS module that makes the system aware of Authentik users"
    
      97  install=authentik-nss.install
    
      98
    
      99  bsdtar -O -xf "libnss-authentik.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      100}
    
      101
    
      102package_libpam-authentik-bin() {
    
      103  depends=(authentik-sysd)
    
      104  provides=(libpam-authentik)
    
      105  conflicts=(libpam-authentik authentik-pam)
    
      106  pkgdesc="Authentik PAM module to enable logging in with Authentik credentials"
    
      107  install=authentik-pam.install
    
      108
    
      109  bsdtar -O -xf "libnss-authentik.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      110}
    
      111

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,7 +8,7 @@
          'authentik-sysd-bin'
          'libpam-authentik-bin' 
          'libnss-authentik-bin')
-pkgver=0.50.3
+pkgver=0.50.5
 pkgrel=1
 url="https://github.com/goauthentik/platform"
 license=('MIT')
@@ -35,16 +35,16 @@
 sha256sums=('16e52ff7d18c8aa97edc8f0b06da0ac0f45f4a87ca0ce3a8cf700b5477cfaf57'
             '1db5d2f9fb1d5d6e5f9cca34e58f1b3b9f55e161d478c76198a4889dfca9fada'
             'ce6e0895be72586d3944c2b1efdffc3ee16d9e8897690a07f44be733d19b77cf')
-sha256sums_x86_64=('0fed25a31e598b3c7355d5917ba6684119cf6af1c483b7be863f2a7b78aa99cf'
-                   'd51c9d8a2d104bbab34ab90e09014285304fa052d3979eca761cfbe3013bb62c'
-                   '2411b67d0581c1545997c0744122b677dc3ebfefd344a6518ce2d6b38552ea79'
-                   '7d512a1ee2aa18e0541e110abf2d06a0ac809dfa2e9434bd3025749620d71220'
-                   'd061c809a524c643a1a7f47febb4201409e9665ba1872737b27cc8466aa869e5')
-sha256sums_aarch64=('0fed25a31e598b3c7355d5917ba6684119cf6af1c483b7be863f2a7b78aa99cf'
-                    'd51c9d8a2d104bbab34ab90e09014285304fa052d3979eca761cfbe3013bb62c'
-                    '2411b67d0581c1545997c0744122b677dc3ebfefd344a6518ce2d6b38552ea79'
-                    '7d512a1ee2aa18e0541e110abf2d06a0ac809dfa2e9434bd3025749620d71220'
-                    'd061c809a524c643a1a7f47febb4201409e9665ba1872737b27cc8466aa869e5')
+sha256sums_x86_64=('846e32ad5d645e56ea03f5e6035a4f821a60d22c0d021353251c0db4c0c83222'
+                   '38b63d0150ae7dbc93dcfbd510c0ab2098860b786a74cc8d111a95e72b63f1ef'
+                   '98f6de439139fdb9a5f4919db98b840c5d8a2dd0ea6871af28e3fb2486e31c7d'
+                   '3e1a6c2d7821beeb4793f4e6077572ea3c9262b344e5cd9b449b3c765882cb9a'
+                   '11da5b4f94f74e7643a3523a48918193df2a6d81ec3b8a7802595ccc728b47c6')
+sha256sums_aarch64=('846e32ad5d645e56ea03f5e6035a4f821a60d22c0d021353251c0db4c0c83222'
+                    '38b63d0150ae7dbc93dcfbd510c0ab2098860b786a74cc8d111a95e72b63f1ef'
+                    '98f6de439139fdb9a5f4919db98b840c5d8a2dd0ea6871af28e3fb2486e31c7d'
+                    '3e1a6c2d7821beeb4793f4e6077572ea3c9262b344e5cd9b449b3c765882cb9a'
+                    '11da5b4f94f74e7643a3523a48918193df2a6d81ec3b8a7802595ccc728b47c6')
 
 noextract=('authentik-agent.deb'
            'authentik-cli.deb'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 21:35:42	MEDIUM	1
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 15:27:57	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2