ntopng-data

maintainer AlphaJack · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD dynamically fetches the Packages index from packages.ntop.org at build time and extracts both the version string and the sha512 checksum from it. This means the checksum is not pinned in the PKGBUILD itself — it is whatever the remote server says it is at the moment of build. If packages.ntop.org is compromised or serves a malicious Packages file, both the downloaded .deb and its 'verification' checksum would be attacker-controlled, making the integrity check meaningless. The host (packages.ntop.org) is the official ntop project APT repository, so it is not a random personal host, which reduces (but does not eliminate) the risk. However, the pattern of dynamically fetching and trusting a remote checksum is a genuine supply-chain concern: the PKGBUILD provides no static, reviewer-auditable integrity guarantee. A prebuilt binary .deb is also being installed directly. This is a real medium-severity supply-chain risk due to the dynamic checksum extraction, not a false positive.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:6 curl -s https://packages.ntop.org/apt/trixie/all/Packages |\

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://packages.ntop.org/apt/trixie/all/ntopng-data_${pkgver}_all.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD dynamically fetches the Packages index from packages.ntop.org at build time and extracts both the version string and the sha512 checksum from it. This means the checksum is not pinned in the PKGBUILD itself — it is whatever the remote server says it is at the moment of build. If packages.ntop.org is compromised or serves a malicious Packages file, both the downloaded .deb and its 'verification' checksum would be attacker-controlled, making the integrity check meaningless. The host (packages.ntop.org) is the official ntop project APT repository, so it is not a random personal host, which reduces (but does not eliminate) the risk. However, the pattern of dynamically fetching and trusting a remote checksum is a genuine supply-chain concern: the PKGBUILD provides no static, reviewer-auditable integrity guarantee. A prebuilt binary .deb is also being installed directly. This is a real medium-severity supply-chain risk due to the dynamic checksum extraction, not a false positive.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2
    
      3pkgname="ntopng-data"
    
      4# to update visit https://packages.ntop.org/apt/trixie/all/ and keep track of the latest pkgver, date and build
    
      5_pkgmeta=("$(
    
      6  curl -s https://packages.ntop.org/apt/trixie/all/Packages |\
    
      7  pcregrep -Mo 'Package: ntopng-data(.+|(\n.)+)+\n\n'
    
      8)")
    
      9_pkgverAmd=6.7
    
      10_dateAmd=260121
    
      11# updated automatically
    
      12pkgver="$(echo $_pkgmeta | grep -Po '(?<= )[0-9]+\.[0-9]+\.[0-9]{6}')"
    
      13pkgrel=1
    
      14pkgdesc="Web-based traffic monitoring"
    
      15url="Geolocation databases for ntopng and other ntop software packaged from https://db-ip.com"
    
      16license=("GPL3")
    
      17arch=("any")
    
      18depends=("ntopng")
    
      19source=("https://packages.ntop.org/apt/trixie/all/ntopng-data_${pkgver}_all.deb")
    
      20# the sha512 sums are present in https://packages.ntop.org/apt/trixie/all/Packages
    
      21sha512sums=("$(echo $_pkgmeta | grep -Po '[0-9a-f]{128}')")
    
      22options=("!strip")
    
      23
    
      24pkgver(){
    
      25  echo $_pkgmeta | grep -Po '(?<= )[0-9]+\.[0-9]+\.[0-9]{6}'
    
      26}
    
      27
    
      28prepare(){
    
      29 tar -xf "data.tar.xz"
    
      30}
    
      31
    
      32package(){
    
      33 # program files
    
      34 cp -r "usr" "$pkgdir"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3