riot-web-develop-bin

maintainer devplayer0 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source tarball is fetched from buildkite.com via a pipeline artifact URL (a CI/CD build artifact, not an official upstream release). While Buildkite is a legitimate CI service used by Matrix/vector-im, this specific artifact URL references an internal pipeline job artifact by UUID rather than a tagged release from the official GitHub repository. The artifact is a pre-built web application bundle (static files served by a web server), so there is no compiled native code executed on the host system — it is installed under /usr/share/webapps and served as web content. However, the supply-chain concern is real: the artifact URL is opaque (UUID-based), tied to a specific CI job, and could in principle be replaced or tampered with without any versioned release guarantee. The sha256sum provides some integrity protection, but the provenance chain is weaker than an official GitHub release. This is a genuine medium-risk pattern: pre-built content from a non-release CI artifact host, mitigated by the fact that the content is static web assets rather than executed native binaries.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("${_src}.tar.gz::https://buildkite.com/organizations/matrix-dot-org/pipelines/riot-web/builds/${_pkgver}/jobs/250aea95-79d7-4043-b256-67e1341b9539/artifacts/47c9b22f-70fc-4842-8c3d-8c1b265fc4ca")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source tarball is fetched from buildkite.com via a pipeline artifact URL (a CI/CD build artifact, not an official upstream release). While Buildkite is a legitimate CI service used by Matrix/vector-im, this specific artifact URL references an internal pipeline job artifact by UUID rather than a tagged release from the official GitHub repository. The artifact is a pre-built web application bundle (static files served by a web server), so there is no compiled native code executed on the host system — it is installed under /usr/share/webapps and served as web content. However, the supply-chain concern is real: the artifact URL is opaque (UUID-based), tied to a specific CI job, and could in principle be replaced or tampered with without any versioned release guarantee. The sha256sum provides some integrity protection, but the provenance chain is weaker than an official GitHub release. This is a genuine medium-risk pattern: pre-built content from a non-release CI artifact host, mitigated by the fact that the content is static web assets rather than executed native binaries.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jack O'Sullivan <jackos1998 at gmail dot com>
    
      2
    
      3_pkgbase=riot
    
      4_pkgver=323
    
      5_src=riot-6f8c6bf13e1d-react-0e3d4fbc0c88-js-fbf53524ed26
    
      6pkgname=riot-web-develop-bin
    
      7pkgver=b323
    
      8pkgrel=1
    
      9pkgdesc="A glossy Matrix collaboration client for the web (develop branch)."
    
      10arch=('any')
    
      11url="https://riot.im"
    
      12_url="https://github.com/vector-im/riot-web"
    
      13license=('Apache')
    
      14makedepends=('npm' 'git')
    
      15source=("${_src}.tar.gz::https://buildkite.com/organizations/matrix-dot-org/pipelines/riot-web/builds/${_pkgver}/jobs/250aea95-79d7-4043-b256-67e1341b9539/artifacts/47c9b22f-70fc-4842-8c3d-8c1b265fc4ca")
    
      16sha256sums=('fc85fa9fc56cd93e2c3a397998c0568790d9d84adbeb2fdc6316ee1babaefdd8')
    
      17provides=('vector-web')  # @vith
    
      18replaces=('vector-web')  # @vith
    
      19conflicts=('vector-web')
    
      20
    
      21package() {
    
      22  cd ${_src}
    
      23
    
      24  install -d "${pkgdir}"/{usr/share/webapps,etc/webapps}/${_pkgbase}
    
      25
    
      26  cp -r * "${pkgdir}"/usr/share/webapps/${_pkgbase}/
    
      27  install -Dm644 config.sample.json -t "${pkgdir}"/etc/webapps/${_pkgbase}/
    
      28  ln -s /etc/webapps/${_pkgbase}/config.json "${pkgdir}"/usr/share/webapps/${_pkgbase}/
    
      29  echo "${pkgver}" > "${pkgdir}"/usr/share/webapps/${_pkgbase}/version
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2