oneleet-agent

MEDIUM

maintainer sbernard 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a non-whitelisted but project-specific host (downloads.oneleet.com), which are then extracted and installed; if compromised, these could deliver malicious code, but they are from the official vendor's domain and checksummed.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:47 source_x86_64=("https://downloads.oneleet.com/agent/linux/Oneleet_${pkgver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted but project-specific host (downloads.oneleet.com), which are then extracted and installed; if compromised, these could deliver malicious code, but they are from the official vendor's domain and checksummed.

PKGBUILD

1 offending line(s) highlighted

      1# SPDX-License-Identifier: 0BSD
    
      2# Maintainer: Samuel Bernard <samuel.bernard@gmail.com>
    
      3
    
      4pkgname=oneleet-agent
    
      5pkgver=2.4.1
    
      6pkgrel=1
    
      7pkgdesc='Endpoint security and compliance agent by Oneleet'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://www.oneleet.com/'
    
      10license=('LicenseRef-Proprietary')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'at-spi2-core'
    
      14  'cairo'
    
      15  'dbus'
    
      16  'expat'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'gtk3'
    
      20  'libcups'
    
      21  'libgcc'
    
      22  'libnotify'
    
      23  'libsecret'
    
      24  'libx11'
    
      25  'libxcb'
    
      26  'libxcomposite'
    
      27  'libxdamage'
    
      28  'libxext'
    
      29  'libxfixes'
    
      30  'libxkbcommon'
    
      31  'libxrandr'
    
      32  'libxss'
    
      33  'libxtst'
    
      34  'mesa'
    
      35  'nspr'
    
      36  'nss'
    
      37  'pango'
    
      38  'systemd-libs'
    
      39  'util-linux-libs'
    
      40  'xdg-utils'
    
      41)
    
      42optdepends=('libappindicator-gtk3: legacy system tray support')
    
      43# Preserve vendor binaries byte-for-byte for Oneleet's signed update mechanism.
    
      44options=('!strip' '!debug')
    
      45install='oneleet-agent.install'
    
      46source=('oneleet-daemon.service' 'oneleet-agent.sysusers' 'osquery.conf' 'LICENSE.oneleet')
    
      47source_x86_64=("https://downloads.oneleet.com/agent/linux/Oneleet_${pkgver}_amd64.deb")
    
      48source_aarch64=("https://downloads.oneleet.com/agent/linux/Oneleet_${pkgver}_arm64.deb")
    
      49sha512sums=('a6b526737d54bd6ce96ba42882cd3733daad8af217da946447e2deeae857aedf12428b3c47f1feb1939b1fac044fa5e8ce2930c781fc89a82e6152f263478979'
    
      50            '69218b100ac240d112a99676d3f91de32bada71c5bf5d24ac112e74fdec1ac04243f567d5ee5c2d1cf90e75283b47be5a46520091498cb9c4ff098ac48f1cb9e'
    
      51            'ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a'
    
      52            '028763481b30f2f134d15837cfac9dc14543e5322ef6c0fbae9f8a20d6854c88b6693739bb5d75b1234d39b96c76c0babf2a229eabe11dcdd014e194a19fdcdd')
    
      53sha512sums_x86_64=('28ede6dd29d42dadf8d6982dd7bee2fec1f31804072e7ee75afd8294b82db0acb4ec422e7b9613738c48bb039c3b9dae7b5bc79ae7715dcd15a7a096cfc35a56')
    
      54sha512sums_aarch64=('7041bfd370d1b7652b3b4558f87714b50f27881d706fe392f658648e7e2c0800c5a1ab3344276b0900348b245cbd15f07a51ddb144d696a312f54ef114648b09')
    
      55
    
      56package() {
    
      57  bsdtar --no-same-owner -xf data.tar.xz -C "$pkgdir"
    
      58
    
      59  install -Dm644 oneleet-daemon.service \
    
      60    "$pkgdir/usr/lib/systemd/system/oneleet-daemon.service"
    
      61  install -Dm644 oneleet-agent.sysusers \
    
      62    "$pkgdir/usr/lib/sysusers.d/oneleet-agent.conf"
    
      63  install -Dm644 osquery.conf \
    
      64    "$pkgdir/usr/share/oneleet-agent/osquery.conf"
    
      65  install -Dm644 LICENSE.oneleet \
    
      66    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      67
    
      68  install -d "$pkgdir/usr/bin"
    
      69  ln -s /opt/Oneleet/oneleet-agent "$pkgdir/usr/bin/oneleet-agent"
    
      70  ln -s /opt/Oneleet/oneleet-daemon "$pkgdir/usr/bin/oneleet-cli"
    
      71
    
      72  # Chromium requires its fallback sandbox to be owned by root and setuid.
    
      73  chmod 4755 "$pkgdir/opt/Oneleet/chrome-sandbox"
    
      74}
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,8 +2,8 @@
 # Maintainer: Samuel Bernard <samuel.bernard@gmail.com>
 
 pkgname=oneleet-agent
-pkgver=2.3.1
-pkgrel=2
+pkgver=2.4.1
+pkgrel=1
 pkgdesc='Endpoint security and compliance agent by Oneleet'
 arch=('x86_64' 'aarch64')
 url='https://www.oneleet.com/'
@@ -50,8 +50,8 @@
             '69218b100ac240d112a99676d3f91de32bada71c5bf5d24ac112e74fdec1ac04243f567d5ee5c2d1cf90e75283b47be5a46520091498cb9c4ff098ac48f1cb9e'
             'ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a'
             '028763481b30f2f134d15837cfac9dc14543e5322ef6c0fbae9f8a20d6854c88b6693739bb5d75b1234d39b96c76c0babf2a229eabe11dcdd014e194a19fdcdd')
-sha512sums_x86_64=('2892b4617306522ccac7cc7320f6a1456e4c308e9edca5a7af87ecce451d615a4561c2d99ad10c27913e8e9320cacc2f5b984575c3d47c9a9456377fa8ac38b5')
-sha512sums_aarch64=('974d9ba6dfc93d0520270d53269e3a6231230a527fe8478cc3ade9fa6dd508f77aca2b17d144bbf3b1d7c1773a04d96146e60e8dc51357cf6f0451d6489dfe43')
+sha512sums_x86_64=('28ede6dd29d42dadf8d6982dd7bee2fec1f31804072e7ee75afd8294b82db0acb4ec422e7b9613738c48bb039c3b9dae7b5bc79ae7715dcd15a7a096cfc35a56')
+sha512sums_aarch64=('7041bfd370d1b7652b3b4558f87714b50f27881d706fe392f658648e7e2c0800c5a1ab3344276b0900348b245cbd15f07a51ddb144d696a312f54ef114648b09')
 
 package() {
   bsdtar --no-same-owner -xf data.tar.xz -C "$pkgdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 11:16:06	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2
2026-10-10 00:11:52	Medium	2
2026-10-09 00:05:33	Medium	2
2026-10-08 00:28:03	Medium	2
2026-10-07 00:21:34	Medium	2
2026-10-06 00:13:36	Medium	2
2026-10-05 00:08:03	Medium	2
2026-10-04 00:18:08	Medium	2
2026-10-03 00:23:04	Medium	2
2026-10-02 00:00:32	Medium	2
2026-10-01 00:02:06	Medium	2
2026-09-30 00:20:07	Medium	2
2026-09-29 00:07:46	Medium	2