openhab-beta

MEDIUM

maintainer orphaned 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads prebuilt binary artifacts (a ZIP runtime and two KAR plugin bundles) from ci.openhab.org's 'lastSuccessfulBuild' CI endpoint with sha256sums=SKIP for all three binaries. While ci.openhab.org is the official openHAB project CI server (not a personal or third-party host), the use of 'lastSuccessfulBuild' means the URL is not pinned to a specific build — it resolves to whatever the latest successful build is at download time. Combined with SKIP checksums, there is no integrity verification whatsoever. Any compromise of the CI server, a MITM, or a malicious artifact pushed to CI would result in execution of untrusted code on the user's system. The service file has a proper checksum. This is a genuine supply-chain concern (mutable CI artifact URL + no integrity check on executed binaries), though not clearly malicious — the host is the official project CI, not a personal server.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab/target/openhab-${_pkgver}-SNAPSHOT.zip"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt binary artifacts (a ZIP runtime and two KAR plugin bundles) from ci.openhab.org's 'lastSuccessfulBuild' CI endpoint with sha256sums=SKIP for all three binaries. While ci.openhab.org is the official openHAB project CI server (not a personal or third-party host), the use of 'lastSuccessfulBuild' means the URL is not pinned to a specific build — it resolves to whatever the latest successful build is at download time. Combined with SKIP checksums, there is no integrity verification whatsoever. Any compromise of the CI server, a MITM, or a malicious artifact pushed to CI would result in execution of untrusted code on the user's system. The service file has a proper checksum. This is a genuine supply-chain concern (mutable CI artifact URL + no integrity check on executed binaries), though not clearly malicious — the host is the official project CI, not a personal server.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daniel Hillenbrand <codeworkx@bbqlinux.org>
    
      2pkgname=openhab-beta
    
      3_pkgver=2.5.0
    
      4pkgver=2.5.0_20190203
    
      5pkgrel=1
    
      6pkgdesc="openHAB2 open source home automation software"
    
      7arch=('any')
    
      8url="http://www.openhab.org/"
    
      9license=('EPL')
    
      10depends=('java-runtime-headless>=8')
    
      11makedepends=('unzip')
    
      12
    
      13conflicts=('openhab-runtime' 'openhab-addons' 'openhab2')
    
      14
    
      15backup=('etc/openhab/conf/services/addons.cfg'
    
      16        'etc/openhab/conf/services/runtime.cfg')
    
      17
    
      18source=("https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab/target/openhab-${_pkgver}-SNAPSHOT.zip"
    
      19        "https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab-addons/target/openhab-addons-${_pkgver}-SNAPSHOT.kar"
    
      20        "https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab-addons-legacy/target/openhab-addons-legacy-${_pkgver}-SNAPSHOT.kar"
    
      21        "openhab.service")
    
      22
    
      23noextract=("openhab-${_pkgver}-SNAPSHOT.zip")
    
      24
    
      25sha256sums=('SKIP'
    
      26            'SKIP'
    
      27            'SKIP'
    
      28            '79b57f9f6b6e832f1bc60649990c147825a36e76858c43d3f1464f6b98530bdb')
    
      29
    
      30pkgver() {
    
      31    printf "${_pkgver}_%s" "$(date +%Y%m%d)"
    
      32}
    
      33
    
      34prepare() {
    
      35    mkdir -p "$srcdir/openhab"
    
      36    cd "$srcdir/openhab"
    
      37    unzip "$srcdir/openhab-${_pkgver}-SNAPSHOT.zip"
    
      38    cp "$srcdir/openhab-addons-${_pkgver}-SNAPSHOT.kar" "$srcdir/openhab/addons"
    
      39    cp "$srcdir/openhab-addons-legacy-${_pkgver}-SNAPSHOT.kar" "$srcdir/openhab/addons"
    
      40}
    
      41
    
      42package() {
    
      43    cd $pkgdir
    
      44
    
      45    mkdir -p etc/openhab
    
      46    mkdir -p opt
    
      47    mkdir -p usr/lib/systemd/system
    
      48
    
      49    cp $srcdir/openhab.service usr/lib/systemd/system
    
      50    cp -r $srcdir/openhab opt/
    
      51
    
      52    mv opt/openhab/conf etc/openhab/conf
    
      53    ln -s /etc/openhab/conf opt/openhab/conf
    
      54
    
      55    mv opt/openhab/addons etc/openhab/addons
    
      56    ln -s /etc/openhab/addons opt/openhab/addons
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2