rudder-agent

maintainer petaramesh · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code from the official project's repository (repository.rudder.io), which is a plausibly legitimate source for Rudder; building from project-owned infrastructure is normal AUR behavior, and no untrusted executable or obfuscated payload is involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the official project's repository (repository.rudder.io), which is a plausibly legitimate source for Rudder; building from project-owned infrastructure is normal AUR behavior, and no untrusted executable or obfuscated payload is involved.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}/rudder-sources-${pkgver}.tar.bz2")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Swâmi Petaramesh <swami AT petaramesh DOT org>
    
      2
    
      3pkgname=rudder-agent
    
      4pkgver="9.1.3"
    
      5# pkgver="9.1.3~git202607090118"
    
      6pkgrel=3
    
      7pkgdesc='Configuration management and audit tool - agent for Rudder managed systems'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://www.rudder.io'
    
      10license=('GPL-3.0-or-later')
    
      11depends=('acl' 'glibc' 'curl' 'gcc-libs' 'pam' 'pcre2' 'readline' 'openssl' 'systemd'
    
      12	'systemd-libs' 'libxml2' 'libyaml' 'util-linux' 'dmidecode' 'cronie' 'net-tools'
    
      13	'diffutils' 'perl' 'perl-xml-treepp' 'jq' 'libvirt' 'augeas' 'python' 'lmdb')
    
      14makedepends=('base-devel' 'gcc' 'rust' 'unzip' 'git' 'clang' 'patchelf')
    
      15install='.install'
    
      16
    
      17# For released sources
    
      18source=("rudder-packages-${pkgver}::git+https://github.com/Normation/rudder-packages.git#branch=branches/rudder/${pkgver%.*}"
    
      19	"rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}/rudder-sources-${pkgver}.tar.bz2")
    
      20
    
      21# For nightly sources
    
      22# source=("rudder-packages-${pkgver}::git+https://github.com/Normation/rudder-packages.git#branch=branches/rudder/${pkgver%.*}"
    
      23#  	"rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}-nightly/rudder-sources-${pkgver}.tar.bz2")
    
      24
    
      25noextract=("rudder-sources-${pkgver}.tar.bz2")
    
      26sha256sums=('SKIP'
    
      27            '01428736e436d9e46b31f96e86a9045b3a335a52eb1aa48a97bef8c410b6c979')
    
      28
    
      29prepare() {
    
      30  # Example using the souces tarball without further patching
    
      31  mv rudder-sources-${pkgver}.tar.bz2 ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources.tar.bz2
    
      32  touch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources.tar.bz2
    
      33  #
    
      34  # Example applying patch only to cfengine source code
    
      35  # cp ${srcdir}/../9901_cfengine_archarm-os.patch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/patches/cfengine/
    
      36  #
    
      37  # Untarring source tarball for applying additional build patches
    
      38  # tar -jf ${srcdir}/../rudder-sources-${pkgver}.tar.bz2 -C ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/ -x
    
      39  # Move extracted source dir to final build location
    
      40  # mv ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources-${pkgver} ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources
    
      41  # Applying patches to source tree
    
      42  # patch -d ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES -p1 < ${srcdir}/../9902_cfengine_manjaro-os.patch || exit 1
    
      43  # Touch source tree so it appears more recent than anything else here
    
      44  # touch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources/rudder-sources
    
      45  #
    
      46  # Edit Makefile.in to
    
      47  # - Update package version to build
    
      48  # - Comment out downloading of source code and overwriting it, as we already provided it
    
      49  sed -i -E -e "s/^RUDDER_VERSION_TO_PACKAGE =.*$/RUDDER_VERSION_TO_PACKAGE = ${pkgver}/i" \
    
      50	  -e 's/^([[:space:]]*)chown root fusion(.*)$/\1# chown root fusion\2/' \
    
      51	  ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/Makefile.in
    
      52  #
    
      53  # Edit Makefile.in to
    
      54  # - Update package version to build
    
      55  # - Comment out downloading of source code and overwriting it, as we already provided it
    
      56  # sed -i -E -e "s/^RUDDER_VERSION_TO_PACKAGE =.*$/RUDDER_VERSION_TO_PACKAGE = ${pkgver}/i" \
    
      57  #         -e 's/^([[:space:]]*)chown root fusion(.*)$/\1# chown root fusion\2/' \
    
      58  #         -e 's/^rudder-sources: rudder-sources.tar.bz2/rudder-sources:/' \
    
      59  #         -e 's/^([[:space:]]*)bunzip2 < rudder-sources.tar.bz2(.*)$/\1# bunzip2 < rudder-sources.tar.bz2\2/' \
    
      60  #         -e 's/^([[:space:]]*)(mv rudder-sources-\$\(RUDDER_VERSION_TO_PACKAGE\)\*\/ rudder-sources\/)(.*)$/\1# \2\3/' \
    
      61  #         ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/Makefile.in
    
      62}
    
      63
    
      64build() {
    
      65  cd ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/
    
      66  ./configure --disable-apt --without-augeas
    
      67  make
    
      68}
    
      69
    
      70package() {
    
      71  cd ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/
    
      72  make DESTDIR="${pkgdir}/" install
    
      73  chmod 700 "${pkgdir}/var/rudder/reports/ready/"
    
      74  chmod 700 "${pkgdir}/var/rudder/tmp/"
    
      75  chmod 700 "${pkgdir}/var/rudder/ncf/"
    
      76  chmod 700 "${pkgdir}/var/rudder/ncf/common/"
    
      77  chmod 700 "${pkgdir}/var/rudder/ncf/local/"
    
      78  cp -aR "${pkgdir}/lib" "${pkgdir}/usr/"
    
      79  rm -rf "${pkgdir}/lib"
    
      80  rm -rf "${pkgdir}/opt/rudder/share/man"
    
      81  find "${pkgdir}/opt/rudder/lib/perl5/" -name "*.so" -exec strip --strip-unneeded {} +
    
      82  for _executable in $(find "${pkgdir}/opt/rudder/bin/" "${pkgdir}/opt/rudder/lib/" -type f -executable) ; do
    
      83  	if _old_rpath="$(patchelf --print-rpath ${_executable} 2>/dev/null)" && \
    
      84		echo "${_old_rpath}" | grep -q "${srcdir}"; then
    
      85  		_new_rpath=$(echo "$_old_rpath" | tr ':' '\n' | grep -v "${srcdir}" | paste -sd:)
    
      86  		patchelf --set-rpath "$_new_rpath" ${_executable}
    
      87  	fi
    
      88  done
    
      89  install -d -m 0755 -o root -g root "${pkgdir}/opt/rudder/share/doc/server-patches"
    
      90  # Example of installing proposed server patches in the doc directory
    
      91  # install -m 0644 -o root -g root ${srcdir}/../9900_rudder-server_postinstall_cfengine_paths.patch "${pkgdir}/opt/rudder/share/doc/server-patches/"
    
      92}
    
      93

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 pkgname=rudder-agent
 pkgver="9.1.3"
 # pkgver="9.1.3~git202607090118"
-pkgrel=1
+pkgrel=3
 pkgdesc='Configuration management and audit tool - agent for Rudder managed systems'
 arch=('x86_64' 'aarch64')
 url='https://www.rudder.io'
@@ -72,6 +72,9 @@
   make DESTDIR="${pkgdir}/" install
   chmod 700 "${pkgdir}/var/rudder/reports/ready/"
   chmod 700 "${pkgdir}/var/rudder/tmp/"
+  chmod 700 "${pkgdir}/var/rudder/ncf/"
+  chmod 700 "${pkgdir}/var/rudder/ncf/common/"
+  chmod 700 "${pkgdir}/var/rudder/ncf/local/"
   cp -aR "${pkgdir}/lib" "${pkgdir}/usr/"
   rm -rf "${pkgdir}/lib"
   rm -rf "${pkgdir}/opt/rudder/share/man"
@@ -84,6 +87,7 @@
   	fi
   done
   install -d -m 0755 -o root -g root "${pkgdir}/opt/rudder/share/doc/server-patches"
-  install -m 0644 -o root -g root ${srcdir}/../9900_rudder-server_postinstall_cfengine_paths.patch "${pkgdir}/opt/rudder/share/doc/server-patches/"
+  # Example of installing proposed server patches in the doc directory
+  # install -m 0644 -o root -g root ${srcdir}/../9900_rudder-server_postinstall_cfengine_paths.patch "${pkgdir}/opt/rudder/share/doc/server-patches/"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 15:27:57	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2