prtcl-bin

maintainer nrobinson2000 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from an S3 bucket (prtcl.s3.amazonaws.com) that is controlled by Particle IoT (the upstream vendor) and used as their official APT distribution channel. This is a legitimate vendor-operated S3 bucket, not a random personal host. However, S3 buckets can be misconfigured, taken over, or silently replaced, and there is no GPG signature verification — only a sha256sum. The sha256sum does pin the specific binary, which mitigates silent replacement risk significantly. The more notable concern is that the package() function actually EXECUTES the extracted binary at build time ('$pkgdir/usr/bin/prtcl' autocomplete) to generate bash completions. Running an untrusted prebuilt binary during the build process is a genuine code-execution concern in the packaging context, even if the binary is from the vendor's own S3 bucket. This execution happens in the build environment, not the target system, but it is still a real supply-chain risk pattern. Overall this is a medium-risk package: prebuilt binary from a vendor S3 bucket with sha256 pinning, but executed at build time without GPG verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://prtcl.s3.amazonaws.com/apt/prtcl_$pkgver-1_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from an S3 bucket (prtcl.s3.amazonaws.com) that is controlled by Particle IoT (the upstream vendor) and used as their official APT distribution channel. This is a legitimate vendor-operated S3 bucket, not a random personal host. However, S3 buckets can be misconfigured, taken over, or silently replaced, and there is no GPG signature verification — only a sha256sum. The sha256sum does pin the specific binary, which mitigates silent replacement risk significantly. The more notable concern is that the package() function actually EXECUTES the extracted binary at build time ('$pkgdir/usr/bin/prtcl' autocomplete) to generate bash completions. Running an untrusted prebuilt binary during the build process is a genuine code-execution concern in the packaging context, even if the binary is from the vendor's own S3 bucket. This execution happens in the build environment, not the target system, but it is still a real supply-chain risk pattern. Overall this is a medium-risk package: prebuilt binary from a vendor S3 bucket with sha256 pinning, but executed at build time without GPG verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nathan Robinson <nrobinson2000 at me dot com>
    
      2# Contributor: particle-iot (https://github.com/particle-iot)
    
      3
    
      4pkgname=prtcl-bin
    
      5pkgver=1.7.14
    
      6pkgrel=1
    
      7pkgdesc="The new Particle CLI"
    
      8arch=("x86_64")
    
      9url="https://github.com/particle-iot/particle-cli"
    
      10license=("Apache")
    
      11source=("https://prtcl.s3.amazonaws.com/apt/prtcl_$pkgver-1_amd64.deb")
    
      12noextract=("prtcl_$pkgver-1_amd64.deb")
    
      13sha256sums=('e8f12d3cbbb849e2e2c2e6ab92d3670d066bc1c277c49e1184bb92bb41b8bc71')
    
      14
    
      15depends=()
    
      16optdepends=("bash-completion: Bash completion for prtcl")
    
      17
    
      18package() {
    
      19    # Extract .deb    
    
      20    bsdtar -O -xf "prtcl_$pkgver-1_amd64.deb" data.tar.xz | bsdtar -C "${pkgdir}" -xJf -
    
      21
    
      22    # Correct update instructions
    
      23    sed -i 's/export PRTCL_UPDATE_INSTRUCTIONS=.*$/export PRTCL_UPDATE_INSTRUCTIONS="update with \\"yay -S prtcl-bin\\""/' "$pkgdir/usr/lib/@particle/cli/bin/prtcl"
    
      24
    
      25    # Bash completion
    
      26    HOME="$srcdir" "$pkgdir/usr/bin/prtcl" autocomplete &> /dev/null
    
      27    install -D "$srcdir/.cache/@particle/cli/autocomplete/functions/bash/prtcl.bash" \
    
      28        "$pkgdir/usr/share/bash-completion/completions/prtcl"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2