rudder-agent
LOW
maintainer petaramesh
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package builds from the project's own official sources hosted on rudder.io and GitHub, both plausibly project-owned; the non-whitelisted host is the project's own domain, and the downloaded source is standard for building the software, not a prebuilt executable or malicious payload.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own official sources hosted on rudder.io and GitHub, both plausibly project-owned; the non-whitelisted host is the project's own domain, and the downloaded source is standard for building the software, not a prebuilt executable or malicious payload.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
"rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}/rudder-sources-${pkgver}.tar.bz2")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Swâmi Petaramesh <swami AT petaramesh DOT org>
2
3
pkgname=rudder-agent
4
pkgver="9.2.0"
5
# pkgver="9.1.3~git202607090118"
6
pkgrel=2
7
pkgdesc='Configuration management and audit tool - agent for Rudder managed systems'
8
arch=('x86_64' 'aarch64')
9
url='https://www.rudder.io'
10
license=('GPL-3.0-or-later')
11
depends=('acl' 'glibc' 'curl' 'gcc-libs' 'pam' 'pcre2' 'readline' 'openssl' 'systemd'
12
'systemd-libs' 'libxml2' 'libyaml' 'util-linux' 'dmidecode' 'cronie' 'net-tools'
13
'diffutils' 'perl' 'perl-xml-treepp' 'jq' 'libvirt' 'augeas' 'python' 'lmdb'
14
'librsync')
15
makedepends=('base-devel' 'gcc' 'rust' 'unzip' 'git' 'clang' 'patchelf')
16
install='.install'
17
18
# For released sources
19
source=("rudder-packages-${pkgver}::git+https://github.com/Normation/rudder-packages.git#branch=branches/rudder/${pkgver%.*}"
20
"rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}/rudder-sources-${pkgver}.tar.bz2")
21
22
# For nightly sources
23
# source=("rudder-packages-${pkgver}::git+https://github.com/Normation/rudder-packages.git#branch=branches/rudder/${pkgver%.*}"
24
# "rudder-sources-${pkgver}.tar.bz2::https://repository.rudder.io/sources/${pkgver%.*}-nightly/rudder-sources-${pkgver}.tar.bz2")
25
26
noextract=("rudder-sources-${pkgver}.tar.bz2")
27
sha256sums=('SKIP'
28
'53ddef24a260e3d7e893f659e47e54ca3ec99f84b480c6389ca83f014ed3c9c7')
29
30
prepare() {
31
# Example using the souces tarball without further patching
32
mv rudder-sources-${pkgver}.tar.bz2 ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources.tar.bz2
33
touch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources.tar.bz2
34
#
35
# Example applying patch only to cfengine source code
36
# cp ${srcdir}/../9901_cfengine_archarm-os.patch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/patches/cfengine/
37
#
38
# Untarring source tarball for applying additional build patches
39
# tar -jf ${srcdir}/../rudder-sources-${pkgver}.tar.bz2 -C ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/ -x
40
# Move extracted source dir to final build location
41
# mv ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources-${pkgver} ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources
42
# Applying patches to source tree
43
# patch -d ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES -p1 < ${srcdir}/../9902_cfengine_manjaro-os.patch || exit 1
44
# Touch source tree so it appears more recent than anything else here
45
# touch ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/rudder-sources/rudder-sources
46
#
47
# Edit Makefile.in to
48
# - Update package version to build
49
# - Comment out downloading of source code and overwriting it, as we already provided it
50
sed -i -E -e "s/^RUDDER_VERSION_TO_PACKAGE =.*$/RUDDER_VERSION_TO_PACKAGE = ${pkgver}/i" \
51
-e 's/^([[:space:]]*)chown root fusion(.*)$/\1# chown root fusion\2/' \
52
${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/Makefile.in
53
#
54
# Edit Makefile.in to
55
# - Update package version to build
56
# - Comment out downloading of source code and overwriting it, as we already provided it
57
# sed -i -E -e "s/^RUDDER_VERSION_TO_PACKAGE =.*$/RUDDER_VERSION_TO_PACKAGE = ${pkgver}/i" \
58
# -e 's/^([[:space:]]*)chown root fusion(.*)$/\1# chown root fusion\2/' \
59
# -e 's/^rudder-sources: rudder-sources.tar.bz2/rudder-sources:/' \
60
# -e 's/^([[:space:]]*)bunzip2 < rudder-sources.tar.bz2(.*)$/\1# bunzip2 < rudder-sources.tar.bz2\2/' \
61
# -e 's/^([[:space:]]*)(mv rudder-sources-\$\(RUDDER_VERSION_TO_PACKAGE\)\*\/ rudder-sources\/)(.*)$/\1# \2\3/' \
62
# ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/Makefile.in
63
}
64
65
build() {
66
cd ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/
67
./configure --disable-apt --without-augeas
68
make
69
}
70
71
package() {
72
cd ${srcdir}/rudder-packages-${pkgver}/rudder-agent/SOURCES/
73
make DESTDIR="${pkgdir}/" install
74
# Fix some directory permissions
75
chmod 700 "${pkgdir}/var/rudder/reports/ready/"
76
chmod 700 "${pkgdir}/var/rudder/tmp/"
77
chmod 700 "${pkgdir}/var/rudder/ncf/"
78
chmod 700 "${pkgdir}/var/rudder/ncf/common/"
79
chmod 700 "${pkgdir}/var/rudder/ncf/local/"
80
# Install libraries in their final destination
81
cp -aR "${pkgdir}/lib" "${pkgdir}/usr/"
82
rm -rf "${pkgdir}/lib"
83
# The man directory contains only oblsolete crap
84
rm -rf "${pkgdir}/opt/rudder/share/man"
85
# Some binaries get built keeping references to ${srcdir} which is not good,
86
# So we strip these paths where we find them.
87
find "${pkgdir}/opt/rudder/lib/perl5/" -name "*.so" -exec strip --strip-unneeded {} +
88
for _executable in $(find "${pkgdir}/opt/rudder/bin/" "${pkgdir}/opt/rudder/lib/" -type f -executable) ; do
89
if _old_rpath="$(patchelf --print-rpath ${_executable} 2>/dev/null)" && \
90
echo "${_old_rpath}" | grep -q "${srcdir}"; then
91
_new_rpath=$(echo "$_old_rpath" | tr ':' '\n' | grep -v "${srcdir}" | paste -sd:)
92
patchelf --set-rpath "$_new_rpath" ${_executable}
93
fi
94
done
95
# Example of installing proposed server patches in the doc directory
96
# First we create the destination directory
97
# install -d -m 0755 -o root -g root "${pkgdir}/opt/rudder/share/doc/server-patches"
98
# install -m 0644 -o root -g root ${srcdir}/../9900_rudder-server_postinstall_cfengine_paths.patch "${pkgdir}/opt/rudder/share/doc/server-patches/"
99
}
100
Changes since previous scan
--- PKGBUILD @ 2026-10-26 00:12+++ PKGBUILD @ 2026-11-01 00:21@@ -3,14 +3,15 @@ pkgname=rudder-agent pkgver="9.2.0" # pkgver="9.1.3~git202607090118"-pkgrel=1+pkgrel=2 pkgdesc='Configuration management and audit tool - agent for Rudder managed systems' arch=('x86_64' 'aarch64') url='https://www.rudder.io' license=('GPL-3.0-or-later') depends=('acl' 'glibc' 'curl' 'gcc-libs' 'pam' 'pcre2' 'readline' 'openssl' 'systemd' 'systemd-libs' 'libxml2' 'libyaml' 'util-linux' 'dmidecode' 'cronie' 'net-tools'- 'diffutils' 'perl' 'perl-xml-treepp' 'jq' 'libvirt' 'augeas' 'python' 'lmdb')+ 'diffutils' 'perl' 'perl-xml-treepp' 'jq' 'libvirt' 'augeas' 'python' 'lmdb'+ 'librsync') makedepends=('base-devel' 'gcc' 'rust' 'unzip' 'git' 'clang' 'patchelf') install='.install' Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 17:46:00 | Medium | 1 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 19:36:04 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 07:15:06 | Medium | 1 |
| 2026-10-16 00:12:47 | Low | 2 |