openhab-beta

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binary artifacts (a ZIP runtime and two KAR plugin bundles) from ci.openhab.org's 'lastSuccessfulBuild' CI endpoint with sha256sums=SKIP for all three binaries. While ci.openhab.org is the official openHAB project CI server (not a personal or third-party host), the use of 'lastSuccessfulBuild' means the URL is not pinned to a specific build — it resolves to whatever the latest successful build is at download time. Combined with SKIP checksums, there is no integrity verification whatsoever. Any compromise of the CI server, a MITM, or a malicious artifact pushed to CI would result in execution of untrusted code on the user's system. The service file has a proper checksum. This is a genuine supply-chain concern (mutable CI artifact URL + no integrity check on executed binaries), though not clearly malicious — the host is the official project CI, not a personal server.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab/target/openhab-${_pkgver}-SNAPSHOT.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt binary artifacts (a ZIP runtime and two KAR plugin bundles) from ci.openhab.org's 'lastSuccessfulBuild' CI endpoint with sha256sums=SKIP for all three binaries. While ci.openhab.org is the official openHAB project CI server (not a personal or third-party host), the use of 'lastSuccessfulBuild' means the URL is not pinned to a specific build — it resolves to whatever the latest successful build is at download time. Combined with SKIP checksums, there is no integrity verification whatsoever. Any compromise of the CI server, a MITM, or a malicious artifact pushed to CI would result in execution of untrusted code on the user's system. The service file has a proper checksum. This is a genuine supply-chain concern (mutable CI artifact URL + no integrity check on executed binaries), though not clearly malicious — the host is the official project CI, not a personal server.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daniel Hillenbrand <codeworkx@bbqlinux.org>
    
      2pkgname=openhab-beta
    
      3_pkgver=2.5.0
    
      4pkgver=2.5.0_20190203
    
      5pkgrel=1
    
      6pkgdesc="openHAB2 open source home automation software"
    
      7arch=('any')
    
      8url="http://www.openhab.org/"
    
      9license=('EPL')
    
      10depends=('java-runtime-headless>=8')
    
      11makedepends=('unzip')
    
      12
    
      13conflicts=('openhab-runtime' 'openhab-addons' 'openhab2')
    
      14
    
      15backup=('etc/openhab/conf/services/addons.cfg'
    
      16        'etc/openhab/conf/services/runtime.cfg')
    
      17
    
      18source=("https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab/target/openhab-${_pkgver}-SNAPSHOT.zip"
    
      19        "https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab-addons/target/openhab-addons-${_pkgver}-SNAPSHOT.kar"
    
      20        "https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab-addons-legacy/target/openhab-addons-legacy-${_pkgver}-SNAPSHOT.kar"
    
      21        "openhab.service")
    
      22
    
      23noextract=("openhab-${_pkgver}-SNAPSHOT.zip")
    
      24
    
      25sha256sums=('SKIP'
    
      26            'SKIP'
    
      27            'SKIP'
    
      28            '79b57f9f6b6e832f1bc60649990c147825a36e76858c43d3f1464f6b98530bdb')
    
      29
    
      30pkgver() {
    
      31    printf "${_pkgver}_%s" "$(date +%Y%m%d)"
    
      32}
    
      33
    
      34prepare() {
    
      35    mkdir -p "$srcdir/openhab"
    
      36    cd "$srcdir/openhab"
    
      37    unzip "$srcdir/openhab-${_pkgver}-SNAPSHOT.zip"
    
      38    cp "$srcdir/openhab-addons-${_pkgver}-SNAPSHOT.kar" "$srcdir/openhab/addons"
    
      39    cp "$srcdir/openhab-addons-legacy-${_pkgver}-SNAPSHOT.kar" "$srcdir/openhab/addons"
    
      40}
    
      41
    
      42package() {
    
      43    cd $pkgdir
    
      44
    
      45    mkdir -p etc/openhab
    
      46    mkdir -p opt
    
      47    mkdir -p usr/lib/systemd/system
    
      48
    
      49    cp $srcdir/openhab.service usr/lib/systemd/system
    
      50    cp -r $srcdir/openhab opt/
    
      51
    
      52    mv opt/openhab/conf etc/openhab/conf
    
      53    ln -s /etc/openhab/conf opt/openhab/conf
    
      54
    
      55    mv opt/openhab/addons etc/openhab/addons
    
      56    ln -s /etc/openhab/addons opt/openhab/addons
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2