squid4

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD fetches a patch at build time via wget from raw.githubusercontent.com/bar0metr/squid/master/client_side_request.patch — a personal GitHub repository owned by the maintainer — with no checksum verification (all sha256sums are 'SKIP', and the patch itself isn't even listed in source[]). This is a genuine supply-chain concern: the patch is fetched dynamically during prepare(), bypassing makepkg's integrity checking entirely. If the maintainer's GitHub account were compromised, or if the branch were force-pushed, arbitrary code could be injected into the Squid source before compilation. The patch is applied to C++ source that is then compiled and installed as a privileged network daemon, so the impact of a malicious substitution would be significant (RCE potential). The primary sources also all have 'SKIP' checksums, compounding the integrity problem. This is a real, if not clearly malicious, supply-chain risk — correctly rated MEDIUM.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("http://www.squid-cache.org/Versions/v4/squid-$pkgver.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 88%): The PKGBUILD fetches a patch at build time via wget from raw.githubusercontent.com/bar0metr/squid/master/client_side_request.patch — a personal GitHub repository owned by the maintainer — with no checksum verification (all sha256sums are 'SKIP', and the patch itself isn't even listed in source[]). This is a genuine supply-chain concern: the patch is fetched dynamically during prepare(), bypassing makepkg's integrity checking entirely. If the maintainer's GitHub account were compromised, or if the branch were force-pushed, arbitrary code could be injected into the Squid source before compilation. The patch is applied to C++ source that is then compiled and installed as a privileged network daemon, so the impact of a malicious substitution would be significant (RCE potential). The primary sources also all have 'SKIP' checksums, compounding the integrity problem. This is a real, if not clearly malicious, supply-chain risk — correctly rated MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bar0metr <admin@os-admin.ru>
    
      2pkgname=squid4
    
      3pkgver=4.13
    
      4pkgrel=4
    
      5pkgdesc='Full-featured Web proxy cache server with the support SSL, eCAP, iCAP-client. Include patches for normal work with cache, long url`s and CDN.'
    
      6arch=('x86_64')
    
      7url='http://www.squid-cache.org'
    
      8depends=('openssl' 'libecap' 'libnetfilter_conntrack' 'pam' 'perl' 'libltdl' 'libcap' 'nettle' 'gnutls' 'libnsl' 'gperftools' 'libbsd')
    
      9makedepends=('krb5')
    
      10conflicts=('squid' 'squid4' 'squid5')
    
      11license=('GPL')
    
      12options=('emptydirs')
    
      13backup=('etc/squid/squid.conf'
    
'etc/squid/cachemgr.conf'
    
'etc/squid/errorpage.css'
    
'etc/squid/mime.conf')
    
      17source=("http://www.squid-cache.org/Versions/v4/squid-$pkgver.tar.xz"
    
      'squid.pam'
    
      'squid.service'
    
      'squid.tmpfiles'
    
      'squid.sysusers'
    
      'squid-rotate.service'
    
      'squid-rotate.timer')
    
      24
    
      25sha256sums=('SKIP'
    
          'SKIP'
    
          'SKIP'
    
          'SKIP'
    
          'SKIP'
    
          'SKIP'
    
          'SKIP')
    
      32
    
      33
    
      34prepare() {
    
cd "$srcdir/squid-$pkgver"
    
msg "Preparing Squid..."
    
msg2 "Getting the client_side_request patch (for work with CDN)..."
    
wget https://raw.githubusercontent.com/bar0metr/squid/master/client_side_request.patch
    
msg2 "Patching Squid (client_side_request)"
    
patch -p0 -i client_side_request.patch
    
msg2 "Done!"
    
      42}
    
      43
    
      44build() {
    
cd "$srcdir/squid-$pkgver"
    
      46
    
PKG_CONFIG_PATH=/usr/lib \
    
./configure \
    
  --prefix=/usr \
    
  --sbindir=/usr/bin \
    
  --datadir=/usr/share/squid \
    
  --sysconfdir=/etc/squid \
    
  --libexecdir=/usr/lib/squid \
    
  --localstatedir=/var \
    
  --with-logdir=/var/log/squid \
    
  --with-pidfile=/run/squid.pid \
    
  --enable-ecap \
    
  --enable-icap-client \
    
  --enable-auth \
    
  --enable-auth-basic \
    
  --disable-auth-ntlm \
    
  --disable-auth-digest \
    
  --enable-auth-negotiate \
    
  --enable-removal-policies="lru,heap" \
    
  --enable-storeio="ufs,aufs,diskd,rock" \
    
  --enable-delay-pools \
    
  --enable-arp-acl \
    
  --enable-zph-qos \
    
  --with-netfilter-conntrack \
    
  --with-openssl=/usr/include/openssl \
    
  --enable-snmp \
    
  --enable-linux-netfilter \
    
  --enable-ident-lookups \
    
  --enable-useragent-log \
    
  --enable-cache-digests \
    
  --enable-referer-log \
    
  --enable-arp-acl \
    
  --enable-htcp \
    
  --enable-carp \
    
  --enable-epoll \
    
  --with-large-files \
    
  --enable-arp-acl \
    
  --with-default-user=proxy \
    
  --enable-async-io \
    
  --enable-truncate \
    
  --enable-icap-client \
    
  --enable-ssl-crtd \
    
  --disable-arch-native \
    
  --disable-strict-error-checking \
    
  --enable-wccpv2 \
    
  --disable-wccp \
    
  --enable-ssl-crtd \
    
  --with-build-environment=POSIX_V6_LP64_OFF64 \
    
  --enable-build-info="Intercept/WCCPv2/SSL/CRTD/(A)UFS/DISKD/ROCK/eCAP/ICAP/64/GCC Production" \
    
  'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -DNDEBUG -Wformat -Werror=format-security -Wall -ltcmalloc_minimal' \
    
  'LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now' \
    
  'CPPFLAGS=-D_FORTIFY_SOURCE=2' \
    
  'CXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -DNDEBUG -Wformat -Werror=format-security -ltcmalloc_minimal'
    
make -j$(nproc)
    
      100}
    
      101
    
      102package() {
    
cd "$srcdir"
    
      104
    
make -C "squid-$pkgver" DESTDIR="$pkgdir" install
    
install -Dm644 "$srcdir/squid.pam" "$pkgdir/etc/pam.d/squid"
    
install -Dm644 "$srcdir/squid.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/squid.conf"
    
install -Dm644 "$srcdir/squid.sysusers" "$pkgdir/usr/lib/sysusers.d/squid.conf"
    
install -Dm644 "$srcdir/squid.service" \
    
  "$pkgdir/usr/lib/systemd/system/squid.service"
    
install -Dm644 "$srcdir/squid-rotate.service" \
    
  "$pkgdir/usr/lib/systemd/system/squid-rotate.service"
    
install -Dm644 "$srcdir/squid-rotate.timer" \
    
  "$pkgdir/usr/lib/systemd/system/squid-rotate.timer"
    
      115#  install -dm755 "$pkgdir/usr/lib/systemd/system/timers.target.wants"
    
      116#  ln -s ../squid-rotate.timer \
    
      117#    "$pkgdir/usr/lib/systemd/system/timers.target.wants/squid-rotate.timer"
    
rm -rf "$pkgdir/run" "$pkgdir"/var/{cache,log,run}
    
      119}
    
      120
    
      121

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2