sngrep-bin

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs prebuilt static binaries from packages.irontec.com, which is operated by Irontec — the same company that develops sngrep (github.com/irontec/sngrep). This is not a random third-party host; it is the vendor's own infrastructure. However, it is still not the canonical GitHub releases page, and the binaries are not reproducibly built from source. The checksums (both md5 and sha256) are pinned, which mitigates substitution attacks to some degree, but a compromise of packages.irontec.com could serve malicious binaries with matching hashes only if the attacker also controls the PKGBUILD. The core concern is that a prebuilt binary from any host — even the vendor's own — bypasses source-level auditing and represents a supply-chain trust boundary. Since the host is the upstream vendor's own domain (not a personal or unrelated host), the risk is lower than a truly third-party binary host, but it remains a legitimate medium concern because the binary is executed directly and is not built from auditable source.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_i686=("${_pkgsrc}-i686::https://packages.irontec.com/binaries/${_pkgname}-static-i386-linux-gnu-${pkgver}")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads and installs prebuilt static binaries from packages.irontec.com, which is operated by Irontec — the same company that develops sngrep (github.com/irontec/sngrep). This is not a random third-party host; it is the vendor's own infrastructure. However, it is still not the canonical GitHub releases page, and the binaries are not reproducibly built from source. The checksums (both md5 and sha256) are pinned, which mitigates substitution attacks to some degree, but a compromise of packages.irontec.com could serve malicious binaries with matching hashes only if the attacker also controls the PKGBUILD. The core concern is that a prebuilt binary from any host — even the vendor's own — bypasses source-level auditing and represents a supply-chain trust boundary. Since the host is the upstream vendor's own domain (not a personal or unrelated host), the risk is lower than a truly third-party binary host, but it remains a legitimate medium concern because the binary is executed directly and is not built from auditable source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_pkgname="sngrep"
    
      4pkgname="${_pkgname}-bin"
    
      5pkgver=1.8.2
    
      6pkgrel=2
    
      7pkgdesc="A tool for displaying SIP call message flows from a terminal"
    
      8arch=('i686' 'x86_64')
    
      9url="https://github.com/irontec/${_pkgname}"
    
      10license=('GPL-3.0-or-later')
    
      11makedepends=('xxd')
    
      12provides=("${_pkgname}")
    
      13conflicts=("${_pkgname}")
    
      14backup=("etc/${_pkgname}/${_pkgname}rc")
    
      15_pkgsrc="${_pkgname}-${pkgver}"
    
      16source=("${_pkgsrc}-README.md::${url}/raw/refs/tags/v${pkgver}/README.md"
    
      17        "${_pkgsrc}-LICENSE::${url}/raw/refs/tags/v${pkgver}/LICENSE"
    
      18        "${_pkgsrc}.man.8::${url}/raw/refs/tags/v${pkgver}/doc/${_pkgname}.8"
    
      19        "${_pkgsrc}-${_pkgname}rc::${url}/raw/refs/tags/v${pkgver}/config/${_pkgname}rc")
    
      20source_i686=("${_pkgsrc}-i686::https://packages.irontec.com/binaries/${_pkgname}-static-i386-linux-gnu-${pkgver}")
    
      21source_x86_64=("${_pkgsrc}-x86_64::https://packages.irontec.com/binaries/${_pkgname}-static-amd64-linux-gnu-${pkgver}")
    
      22md5sums=('c47c7c7383225ab55ff591cb59c41e6b'
    
      23         'd32239bcb673463ab874e80d47fae504'
    
      24         '3fd6ccca40ec9086a061ca221e5d375b'
    
      25         '5650c8a266261a831642112138129566')
    
      26md5sums_i686=('8f460d1e77e3f8578ab4d529f0d0d873')
    
      27md5sums_x86_64=('354b230c6c426973cbd289c8bedfd914')
    
      28sha256sums=('2b7814d3fca2e99e56c51b6ff2aa313ea6e9da6424804240aa8ad891fdfe0900'
    
      29            '8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903'
    
      30            'e5cf742a5051339c33d8c91c1a8ec7fa9f06ba2fba34a90d81847073e2be7e29'
    
      31            'e7eb8897f6facdaf67eb013b000f8f4443c86b19d29cb66aa8ad1b5e7ec2d633')
    
      32sha256sums_i686=('744ac6185b988aedb2c60981197fcdd27afa474905b794a99cb7fb2a5151aa2a')
    
      33sha256sums_x86_64=('89e3292e4a04d96d9f3ac74852b757019f5a4f76da991cc0493ab0261bd47c1c')
    
      34
    
      35# https://everydaywithlinux.blogspot.com/2012/11/patch-strings-in-binary-files-with-sed.html
    
      36_patch_strings_in_file() {
    
      37  local FILE="$1"
    
      38  local PATTERN="$2"
    
      39  local REPLACEMENT="$3"
    
      40  
    
      41  STRINGS=$(strings ${FILE} | grep ${PATTERN} | sort -u -r)
    
      42  if [ "${STRINGS}" != "" ] ; then
    
      43    echo "Patching file '${FILE}'"
    
      44    for OLD_STRING in ${STRINGS} ; do
    
      45      NEW_STRING=${OLD_STRING//${PATTERN}/${REPLACEMENT}}
    
      46      OLD_STRING_HEX="$(echo -n "${OLD_STRING}" | xxd -g 0 -u -ps -c 256 | tr -d '\n')"
    
      47      NEW_STRING_HEX="$(echo -n "${NEW_STRING}" | xxd -g 0 -u -ps -c 256 | tr -d '\n')"
    
      48      if [ ${#NEW_STRING_HEX} -le ${#OLD_STRING_HEX} ] ; then
    
      49        while [ ${#NEW_STRING_HEX} -lt ${#OLD_STRING_HEX} ] ; do
    
      50          NEW_STRING_HEX="${NEW_STRING_HEX}00"
    
      51        done
    
      52        echo -n "Replacing ${OLD_STRING} with ${NEW_STRING}... "
    
      53        hexdump -ve '1/1 "%.2X"' ${FILE} | \
    
      54          sed "s/${OLD_STRING_HEX}/${NEW_STRING_HEX}/g" | \
    
      55          xxd -r -p > ${FILE}.tmp
    
      56        chmod --reference ${FILE} ${FILE}.tmp
    
      57        mv ${FILE}.tmp ${FILE}
    
      58        echo "Done!"
    
      59      else
    
      60        echo "New string '${NEW_STRING}' is longer than old string '${OLD_STRING}'. Skipping."
    
      61      fi
    
      62    done
    
      63  fi
    
      64}
    
      65
    
      66prepare() {
    
      67  cd "${srcdir}"
    
      68  _patch_strings_in_file "${_pkgsrc}-${CARCH}" "/usr/local/etc/${_pkgname}rc" "/etc/${_pkgname}/${_pkgname}rc"
    
      69}
    
      70
    
      71package() {
    
      72  cd "${srcdir}"
    
      73  install -vDm755 "${_pkgsrc}-${CARCH}" "${pkgdir}/usr/bin/${_pkgname}"
    
      74  install -vDm644 "${_pkgsrc}-README.md" "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
    
      75  install -vDm644 "${_pkgsrc}-LICENSE" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      76  install -vDm644 "${_pkgsrc}.man.8" "${pkgdir}/usr/share/man/man8/${_pkgname}.8"
    
      77  install -vDm644 "${_pkgsrc}-${_pkgname}rc" "${pkgdir}/etc/${_pkgname}/${_pkgname}rc"
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2