snowflake-cli-bin

maintainer phobia · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 binary (.deb) from sfc-repo.snowflakecomputing.com, which is Snowflake's official distribution host (the same domain used by their ODBC/JDBC/CLI installers documented at docs.snowflake.com). This is not a personal or unofficial host — it is the vendor's own CDN. However, the package installs a closed-source, precompiled binary directly into /usr/bin without any source build, which is the standard supply-chain concern for all *-bin AUR packages. There is a sha256sum check, which mitigates MITM risk. The risk level is the normal one for any prebuilt-binary AUR package: trust in the vendor's distribution infrastructure. This does not rise above the baseline medium for binary packages, and is not a novel or elevated threat — it is the standard pattern for snowflake-cli-bin and similar vendor-distributed CLI tools.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://sfc-repo.snowflakecomputing.com/snowflake-cli/linux_${CARCH}/${pkgver}/snowflake-cli-${pkgver}.x86_64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt x86_64 binary (.deb) from sfc-repo.snowflakecomputing.com, which is Snowflake's official distribution host (the same domain used by their ODBC/JDBC/CLI installers documented at docs.snowflake.com). This is not a personal or unofficial host — it is the vendor's own CDN. However, the package installs a closed-source, precompiled binary directly into /usr/bin without any source build, which is the standard supply-chain concern for all *-bin AUR packages. There is a sha256sum check, which mitigates MITM risk. The risk level is the normal one for any prebuilt-binary AUR package: trust in the vendor's distribution infrastructure. This does not rise above the baseline medium for binary packages, and is not a novel or elevated threat — it is the standard pattern for snowflake-cli-bin and similar vendor-distributed CLI tools.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Charlie Menke <charliemenke[at]me[dot]com>
    
      2
    
      3pkgname=snowflake-cli-bin
    
      4pkgver=3.12.0
    
      5pkgrel=1
    
      6epoch=1
    
      7pkgdesc='snowflake-cli (snow)'
    
      8arch=('x86_64')
    
      9url="https://github.com/snowflakedb/snowflake-cli"
    
      10license=('Apache-2.0')
    
      11depends=('gcc-libs'
    
      12    'xz')
    
      13source=("https://sfc-repo.snowflakecomputing.com/snowflake-cli/linux_${CARCH}/${pkgver}/snowflake-cli-${pkgver}.x86_64.deb")
    
      14sha256sums=('435bae1f246e94df4b019a3e278195206940f2ab9dc221193774c874fae799d6')
    
      15
    
      16package() {
    
      17  mkdir -p $pkgdir/snow
    
      18  bsdtar -C $pkgdir/snow -xf data.tar.gz
    
      19  install -Dm755 $pkgdir/snow/usr/lib/snowflake/snowflake-cli/snow $pkgdir/usr/bin/snow
    
      20  rm -rf ${pkgdir}/snow
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2