rmmagent

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary Debian package (.deb) from repos.systemmonitor.us, which is not the official GFI/Languard distribution infrastructure (languard.gfi.com). The package is then extracted and installed directly into the system. The integrity check uses only MD5 (cryptographically broken, trivially collisable), providing no meaningful tamper protection. The host repos.systemmonitor.us appears to be a third-party mirror or repackaging site, not an official vendor host. If this host were compromised or the package substituted, arbitrary binaries would be executed with system privileges. This is a genuine supply-chain concern: executed binary content from an unofficial/unverifiable host with weak integrity verification. Not clearly malicious, but a real medium-severity risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source_x86_64=("http://repos.systemmonitor.us/rmmagent/Debian_8.0/amd64/rmmagent_1.0.4-1_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary Debian package (.deb) from repos.systemmonitor.us, which is not the official GFI/Languard distribution infrastructure (languard.gfi.com). The package is then extracted and installed directly into the system. The integrity check uses only MD5 (cryptographically broken, trivially collisable), providing no meaningful tamper protection. The host repos.systemmonitor.us appears to be a third-party mirror or repackaging site, not an official vendor host. If this host were compromised or the package substituted, arbitrary binaries would be executed with system privileges. This is a genuine supply-chain concern: executed binary content from an unofficial/unverifiable host with weak integrity verification. Not clearly malicious, but a real medium-severity risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sean Snell <ssnell at cmhsol dot com>
    
      2
    
      3pkgname=rmmagent
    
      4pkgver=1.0.4.1
    
      5pkgrel=1
    
      6pkgdesc='Remote Monitoring Agent for GFI Languard Dashboard'
    
      7arch=('x86_64')
    
      8url='http://languard.gfi.com/'
    
      9license=('custom')
    
      10options=('!strip')
    
      11provides=('rmmagent')
    
      12depends_x86_64=(
    
      13	'openssl-1.0'
    
      14	'ethtool'
    
      15	'smartmontools'
    
      16	'gcc-libs'
    
      17	'glibc'
    
      18	'openssl'
    
      19	'unzip')
    
      20
    
      21install=.INSTALL
    
      22source_x86_64=("http://repos.systemmonitor.us/rmmagent/Debian_8.0/amd64/rmmagent_1.0.4-1_amd64.deb")
    
      23source=("rmmagentd.service")
    
      24md5sums_x86_64=('36821c2fd73f86fd9e5870029605289a')
    
      25md5sums=('28e9171b39f6eafcca88d70aea08195a')
    
      26
    
      27prepare() {
    
      28	tar -xf $srcdir/data.tar.xz
    
      29	tar -xf control.tar.gz
    
      30	mv usr/local/lib/ usr/lib
    
      31	mv usr/local/rmmagent usr/rmmagent
    
      32	mkdir -p "$srcdir"/etc/systemd/system	
    
      33	cp rmmagentd.service "$srcdir"/etc/systemd/system/rmmagentd.service
    
      34}
    
      35
    
      36package() {
    
      37	# Install
    
      38	cp -dr --no-preserve=ownership {etc,usr} "${pkgdir}"/
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2