qwarp

maintainer ashutoshtiwari · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs prebuilt Cloudflare WARP binaries (warp-svc, warp-cli) extracted from an official Cloudflare .deb package at pkg.cloudflareclient.com. While this is Cloudflare's official package repository (the same one used by their official Linux installation instructions), these are closed-source, privileged binaries: warp-svc runs as a system daemon with elevated privileges. The sha256 checksum is pinned, which mitigates the risk of in-transit tampering, but the host is not a standard distro mirror and the binaries are not reproducible. The supply-chain risk is real: if Cloudflare's package server were compromised or the maintainer updates the checksum to a malicious version, users would execute arbitrary privileged code. This is a legitimate medium-severity concern — not a false positive — because executed closed-source binaries from a third-party host with a system daemon component represent a genuine supply-chain risk, even if the host is the official vendor. The Python GUI wrapper itself (from GitHub with checksum) is lower risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "cloudflare-warp-${_warpver}.deb::https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${_warpver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and installs prebuilt Cloudflare WARP binaries (warp-svc, warp-cli) extracted from an official Cloudflare .deb package at pkg.cloudflareclient.com. While this is Cloudflare's official package repository (the same one used by their official Linux installation instructions), these are closed-source, privileged binaries: warp-svc runs as a system daemon with elevated privileges. The sha256 checksum is pinned, which mitigates the risk of in-transit tampering, but the host is not a standard distro mirror and the binaries are not reproducible. The supply-chain risk is real: if Cloudflare's package server were compromised or the maintainer updates the checksum to a malicious version, users would execute arbitrary privileged code. This is a legitimate medium-severity concern — not a false positive — because executed closed-source binaries from a third-party host with a system daemon component represent a genuine supply-chain risk, even if the host is the official vendor. The Python GUI wrapper itself (from GitHub with checksum) is lower risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ashutosh Tiwari <contact@ashutoshtiwari.dev>
    
      2pkgname=qwarp
    
      3pkgver=0.8.2
    
      4pkgrel=1
    
      5_warpver=2026.4.1350.0
    
      6pkgdesc="A lightweight, Wayland-native Qt6 wrapper for Cloudflare WARP"
    
      7arch=('x86_64')
    
      8url="https://github.com/iashutoshtiwari/qwarp"
    
      9license=('MIT')
    
      10depends=('python' 'python-pyqt6')
    
      11makedepends=('python-build' 'python-installer' 'python-wheel' 'python-setuptools' 'qt6-tools')
    
      12conflicts=('cloudflare-warp-bin')
    
      13install=qwarp.install
    
      14
    
      15# Bash substitution converts "0.6.0_alpha" to "0.6.0-alpha" for GitHub tags
    
      16source=("$pkgname-$pkgver.tar.gz::https://github.com/iashutoshtiwari/qwarp/archive/refs/tags/v${pkgver/_/-}.tar.gz"
    
      17        "cloudflare-warp-${_warpver}.deb::https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${_warpver}_amd64.deb")
    
      18sha256sums=('b6ee275298e4c5e142bfe710b9de546045a43505b7f1740ca3ac504e602f8d27'
    
      19            'f35ae16dd97e8a78dd970341cb6ae3e8131af1962f79cb7b9d698a874eab7f2a')
    
      20noextract=("cloudflare-warp-${_warpver}.deb")
    
      21
    
      22prepare() {
    
      23  # Extract only the core binaries and systemd service from the deb package
    
      24  mkdir -p "${srcdir}/warp-extract"
    
      25  bsdtar -xf "${srcdir}/cloudflare-warp-${_warpver}.deb" -C "${srcdir}/warp-extract"
    
      26  bsdtar -xf "${srcdir}/warp-extract/data.tar.gz" -C "${srcdir}/warp-extract" \
    
      27    ./bin/warp-svc ./bin/warp-cli ./lib/systemd/system/warp-svc.service
    
      28}
    
      29
    
      30build() {
    
      31  # Enter the directory extracted from the GitHub tarball
    
      32  cd "$pkgname-${pkgver/_/-}"
    
      33
    
      34  # Gather PyQt translation files before generating the wheel so they are grabbed by setup.py
    
      35  bash scripts/build_locales.sh
    
      36
    
      37  # Build the wheel
    
      38  python -m build --wheel --no-isolation
    
      39}
    
      40
    
      41package() {
    
      42  # Enter the directory extracted from the GitHub tarball
    
      43  cd "$pkgname-${pkgver/_/-}"
    
      44
    
      45  local _wheels=(dist/*.whl)
    
      46
    
      47  if [ ! -f "${_wheels[0]}" ]; then
    
      48      echo "Error: No wheel found in dist/"
    
      49      exit 1
    
      50  fi
    
      51
    
      52  # Install the Python package
    
      53  python -m installer --destdir="$pkgdir" "${_wheels[0]}"
    
      54
    
      55  # Install the desktop entry
    
      56  install -Dm644 qwarp.desktop "$pkgdir/usr/share/applications/qwarp.desktop"
    
      57
    
      58  # Install the SVG icon
    
      59  install -Dm644 "src/qwarp/assets/app-icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/qwarp.svg"
    
      60
    
      61  # Install the license
    
      62  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      63
    
      64  # Install core Cloudflare WARP binaries (extracted from the official .deb)
    
      65  install -Dm755 "${srcdir}/warp-extract/bin/warp-svc" "${pkgdir}/usr/bin/warp-svc"
    
      66  install -Dm755 "${srcdir}/warp-extract/bin/warp-cli" "${pkgdir}/usr/bin/warp-cli"
    
      67
    
      68  # Install and patch the systemd service (fix binary path for Arch)
    
      69  install -Dm644 "${srcdir}/warp-extract/lib/systemd/system/warp-svc.service" \
    
      70    "${pkgdir}/usr/lib/systemd/system/warp-svc.service"
    
      71  sed -e "s%ExecStart=/bin/warp-svc%ExecStart=/usr/bin/warp-svc%" \
    
      72    -i "${pkgdir}/usr/lib/systemd/system/warp-svc.service"
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2