rudder-agent
LOW
maintainer petaramesh
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from official project sources on GitHub and rudder.io, which are legitimate but not on the analyzer's whitelist; the source is not executed remotely and the build process is standard, posing no real risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official project sources on GitHub and rudder.io, which are legitimate but not on the analyzer's whitelist; the source is not executed remotely and the build process is standard, posing no real risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
"rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}/rudder-sources-${pkgver}.tar.bz2")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Swâmi Petaramesh <swami AT petaramesh DOT org>
2
3
pkgname=rudder-agent
4
pkgver="9.1.4"
5
# pkgver="9.1.3~git202607090118"
6
pkgrel=1
7
pkgdesc='Configuration management and audit tool - agent for Rudder managed systems'
8
arch=('x86_64' 'aarch64')
9
url='https://www.rudder.io'
10
license=('GPL-3.0-or-later')
11
depends=('acl' 'glibc' 'curl' 'gcc-libs' 'pam' 'pcre2' 'readline' 'openssl' 'systemd'
12
'systemd-libs' 'libxml2' 'libyaml' 'util-linux' 'dmidecode' 'cronie' 'net-tools'
13
'diffutils' 'perl' 'perl-xml-treepp' 'jq' 'libvirt' 'augeas' 'python' 'lmdb')
14
makedepends=('base-devel' 'gcc' 'rust' 'unzip' 'git' 'clang' 'patchelf')
15
install='.install'
16
17
# For released sources
18
source=("rudder-packages-${pkgver}::git+https://github.com/Normation/rudder-packages.git#branch=branches/rudder/${pkgver%.*}"
19
"rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}/rudder-sources-${pkgver}.tar.bz2")
20
21
# For nightly sources
22
# source=("rudder-packages-${pkgver}::git+https://github.com/Normation/rudder-packages.git#branch=branches/rudder/${pkgver%.*}"
23
# "rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}-nightly/rudder-sources-${pkgver}.tar.bz2")
24
25
noextract=("rudder-sources-${pkgver}.tar.bz2")
26
sha256sums=('SKIP'
27
'1fa5f3e9fee9bbdeba8903e709e6dd02cdf482481749d1a2d6e33bcd5342c0d2')
28
29
prepare() {
30
# Example using the souces tarball without further patching
31
mv rudder-sources-${pkgver}.tar.bz2 ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources.tar.bz2
32
touch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources.tar.bz2
33
#
34
# Example applying patch only to cfengine source code
35
# cp ${srcdir}/../9901_cfengine_archarm-os.patch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/patches/cfengine/
36
#
37
# Untarring source tarball for applying additional build patches
38
# tar -jf ${srcdir}/../rudder-sources-${pkgver}.tar.bz2 -C ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/ -x
39
# Move extracted source dir to final build location
40
# mv ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources-${pkgver} ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources
41
# Applying patches to source tree
42
# patch -d ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES -p1 < ${srcdir}/../9902_cfengine_manjaro-os.patch || exit 1
43
# Touch source tree so it appears more recent than anything else here
44
# touch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources/rudder-sources
45
#
46
# Edit Makefile.in to
47
# - Update package version to build
48
# - Comment out downloading of source code and overwriting it, as we already provided it
49
sed -i -E -e "s/^RUDDER_VERSION_TO_PACKAGE =.*$/RUDDER_VERSION_TO_PACKAGE = ${pkgver}/i" \
50
-e 's/^([[:space:]]*)chown root fusion(.*)$/\1# chown root fusion\2/' \
51
${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/Makefile.in
52
#
53
# Edit Makefile.in to
54
# - Update package version to build
55
# - Comment out downloading of source code and overwriting it, as we already provided it
56
# sed -i -E -e "s/^RUDDER_VERSION_TO_PACKAGE =.*$/RUDDER_VERSION_TO_PACKAGE = ${pkgver}/i" \
57
# -e 's/^([[:space:]]*)chown root fusion(.*)$/\1# chown root fusion\2/' \
58
# -e 's/^rudder-sources: rudder-sources.tar.bz2/rudder-sources:/' \
59
# -e 's/^([[:space:]]*)bunzip2 < rudder-sources.tar.bz2(.*)$/\1# bunzip2 < rudder-sources.tar.bz2\2/' \
60
# -e 's/^([[:space:]]*)(mv rudder-sources-\$\(RUDDER_VERSION_TO_PACKAGE\)\*\/ rudder-sources\/)(.*)$/\1# \2\3/' \
61
# ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/Makefile.in
62
}
63
64
build() {
65
cd ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/
66
./configure --disable-apt --without-augeas
67
make
68
}
69
70
package() {
71
cd ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/
72
make DESTDIR="${pkgdir}/" install
73
# Fix some directory permissions
74
chmod 700 "${pkgdir}/var/rudder/reports/ready/"
75
chmod 700 "${pkgdir}/var/rudder/tmp/"
76
chmod 700 "${pkgdir}/var/rudder/ncf/"
77
chmod 700 "${pkgdir}/var/rudder/ncf/common/"
78
chmod 700 "${pkgdir}/var/rudder/ncf/local/"
79
# Install libraries in their final destination
80
cp -aR "${pkgdir}/lib" "${pkgdir}/usr/"
81
rm -rf "${pkgdir}/lib"
82
# The man directory contains only oblsolete crap
83
rm -rf "${pkgdir}/opt/rudder/share/man"
84
# Some binaries get built keeping references to ${srcdir} which is not good,
85
# So we strip these paths where we find them.
86
find "${pkgdir}/opt/rudder/lib/perl5/" -name "*.so" -exec strip --strip-unneeded {} +
87
for _executable in $(find "${pkgdir}/opt/rudder/bin/" "${pkgdir}/opt/rudder/lib/" -type f -executable) ; do
88
if _old_rpath="$(patchelf --print-rpath ${_executable} 2>/dev/null)" && \
89
echo "${_old_rpath}" | grep -q "${srcdir}"; then
90
_new_rpath=$(echo "$_old_rpath" | tr ':' '\n' | grep -v "${srcdir}" | paste -sd:)
91
patchelf --set-rpath "$_new_rpath" ${_executable}
92
fi
93
done
94
# Example of installing proposed server patches in the doc directory
95
# First we create the destination directory
96
# install -d -m 0755 -o root -g root "${pkgdir}/opt/rudder/share/doc/server-patches"
97
# install -m 0644 -o root -g root ${srcdir}/../9900_rudder-server_postinstall_cfengine_paths.patch "${pkgdir}/opt/rudder/share/doc/server-patches/"
98
}
99
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |