local-by-flywheel-bin

maintainer peddamax · 24 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt proprietary RPM binary from cdn.localwp.com (the official CDN for the Local by Flywheel/WP Engine product) and installs it directly. While cdn.localwp.com is the legitimate vendor distribution host for this commercial application, it is not an official distro mirror and the binary is not reproducible from source. The sha1sums check provides some integrity protection, but SHA-1 is weak and the binary blob is a full Electron application with a chrome-sandbox setuid binary — meaning a compromised or substituted upstream artifact would result in privileged code execution. This is a textbook medium-severity supply-chain concern: a real executed binary from a non-distro host with weak integrity verification and a setuid component, but no evidence of actual malice or substitution.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://cdn.localwp.com/releases-stable/$pkgver+$pkgrel/local-$pkgver-linux.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt proprietary RPM binary from cdn.localwp.com (the official CDN for the Local by Flywheel/WP Engine product) and installs it directly. While cdn.localwp.com is the legitimate vendor distribution host for this commercial application, it is not an official distro mirror and the binary is not reproducible from source. The sha1sums check provides some integrity protection, but SHA-1 is weak and the binary blob is a full Electron application with a chrome-sandbox setuid binary — meaning a compromised or substituted upstream artifact would result in privileged code execution. This is a textbook medium-severity supply-chain concern: a real executed binary from a non-distro host with weak integrity verification and a setuid component, but no evidence of actual malice or substitution.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Evangelos Athanasiadis <dyrer@yandex.com>
    
      2# Maintainer: Peter Kerschl <git@pmke.de>
    
      3pkgname=local-by-flywheel-bin
    
      4_pkgname=local-by-flywheel
    
      5pkgver=10.0.0
    
      6pkgrel=6907
    
      7pkgdesc="A program to create a local WordPress development environment."
    
      8arch=('x86_64')
    
      9url="https://localbyflywheel.com/"
    
      10license=('custom:proprietary')
    
      11depends=(
    
      12  'libxcrypt-compat'
    
      13  'numactl'
    
      14  'ncurses5-compat-libs'
    
      15  'libaio'
    
      16  'gtk3'
    
      17  'nss'
    
      18  'libjpeg-turbo'
    
      19  'libxss'
    
      20  'libxslt'
    
      21)
    
      22options=('emptydirs')
    
      23source=("https://cdn.localwp.com/releases-stable/$pkgver+$pkgrel/local-$pkgver-linux.rpm")
    
      24sha1sums=('b0bd84bc8daca147a275ff659c783ba261299755')
    
      25
    
      26package() {
    
      27  mv $srcdir/usr $pkgdir/ # /usr & /opt are top-level dirs in the package
    
      28  mv $srcdir/opt $pkgdir/
    
      29
    
      30  #Create symlink the executable to /usr/bin
    
      31  mkdir "$pkgdir"/usr/bin
    
      32  ln -s /opt/Local/local "$pkgdir"/usr/bin/$_pkgname
    
      33
    
      34  #Setuid on chrome-sandbox
    
      35  chmod u+s "$pkgdir"/opt/Local/chrome-sandbox
    
      36
    
      37  cd $pkgdir/
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2