substratumnode-cli

maintainer microoo · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary ZIP from an AWS S3 bucket (substratum-website-downloads) and installs two executables (SubstratumNode and dns_utility) directly without building from source. While the SHA256 checksum is present and the S3 bucket appears to be the official vendor distribution channel for SubstratumNode (a real decentralized networking project), the host is not a canonical VCS release page (e.g., GitHub releases) and S3 buckets can be misconfigured or taken over. The binaries are executed code installed to /usr/bin with 755 permissions, and dns_utility in particular likely requires elevated privileges to manipulate DNS settings. This is a genuine medium-severity supply-chain concern: prebuilt binaries from a non-standard host with no source build, even with a checksum. The checksum mitigates substitution risk but does not address the trustworthiness of the original binary content.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://s3.us-east-2.amazonaws.com/substratum-website-downloads/v${pkgver}/SubstratumNode-v${pkgver}-Linux64-binary.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary ZIP from an AWS S3 bucket (substratum-website-downloads) and installs two executables (SubstratumNode and dns_utility) directly without building from source. While the SHA256 checksum is present and the S3 bucket appears to be the official vendor distribution channel for SubstratumNode (a real decentralized networking project), the host is not a canonical VCS release page (e.g., GitHub releases) and S3 buckets can be misconfigured or taken over. The binaries are executed code installed to /usr/bin with 755 permissions, and dns_utility in particular likely requires elevated privileges to manipulate DNS settings. This is a genuine medium-severity supply-chain concern: prebuilt binaries from a non-standard host with no source build, even with a checksum. The checksum mitigates substitution risk but does not address the trustworthiness of the original binary content.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Microoo <hu _AT_ m i c r o o o _DOT_ net>
    
      2pkgname=substratumnode-cli
    
      3pkgver=0.4.6
    
      4pkgrel=1
    
      5pkgdesc="Command line binary of SubstratumNode. SubstratumNode is the foundation of the decentralized SubstratumNetwork. SubstratumNodes work together to relay CORES packages and content on the network."
    
      6arch=('x86_64')
    
      7url="https://substratum.net"
    
      8license=('GPLv3')
    
      9depends=()
    
      10conflicts=('substratumnode-cli-git')
    
      11options=('!strip' '!emptydirs')
    
      12source=("https://s3.us-east-2.amazonaws.com/substratum-website-downloads/v${pkgver}/SubstratumNode-v${pkgver}-Linux64-binary.zip")
    
      13sha256sums=('fc96de2ec35baeecdeedf6a0781f05fd32787b1c5d7fb2373b28d38c4b807c26')
    
      14
    
      15package(){
    
      16    install -Dm755 SubstratumNode "$pkgdir/usr/bin/SubstratumNode"
    
      17    install -Dm755 dns_utility "$pkgdir/usr/bin/dns_utility"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2