pktriot

maintainer silencer · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary RPM from download.packetriot.com (the vendor's own download server, not a personal/unofficial host) and extracts it directly into the package directory. While this is the official vendor host, the concern is real: (1) a prebuilt binary is installed without source compilation, meaning the binary's contents cannot be audited; (2) only an MD5 checksum is used, which is cryptographically weak and provides minimal integrity assurance; (3) there is no GPG signature verification of the RPM. The host appears to be the legitimate Packetriot vendor distribution server, so this is not clearly malicious, but installing an unverified prebuilt binary from any host — even the vendor's — constitutes a genuine supply-chain risk if the host is compromised or the binary is swapped. This pattern (prebuilt binary, weak checksum, no signature) warrants a medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("https://download.packetriot.com/linux/RPM/packages/pktriot-$pkgver-$pkgrel.x86_64.rpm");

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary RPM from download.packetriot.com (the vendor's own download server, not a personal/unofficial host) and extracts it directly into the package directory. While this is the official vendor host, the concern is real: (1) a prebuilt binary is installed without source compilation, meaning the binary's contents cannot be audited; (2) only an MD5 checksum is used, which is cryptographically weak and provides minimal integrity assurance; (3) there is no GPG signature verification of the RPM. The host appears to be the legitimate Packetriot vendor distribution server, so this is not clearly malicious, but installing an unverified prebuilt binary from any host — even the vendor's — constitutes a genuine supply-chain risk if the host is compromised or the binary is swapped. This pattern (prebuilt binary, weak checksum, no signature) warrants a medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rodrigo Pelorosso <rodrigo.pelorosso@gmail.com>
    
      2pkgname=pktriot
    
      3pkgver=0.15.2
    
      4pkgrel=1
    
      5license=('unknown')
    
      6arch=('x86_64')
    
      7pkgdesc="The official Packetriot command line tool."
    
      8url="https://packetriot.com"
    
      9source=("https://download.packetriot.com/linux/RPM/packages/pktriot-$pkgver-$pkgrel.x86_64.rpm");
    
      10package() {
    
      11    cd ${srcdir}
    
      12    bsdtar -xf pktriot-${pkgver}-${pkgrel}.x86_64.rpm -C ${pkgdir}
    
      13
    
      14}
    
      15md5sums=('29d909e6e9d34f7a9987dbce9fa4fec4')
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2