td-agent

maintainer eagletmt · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .deb binary package from packages.treasuredata.com (Treasure Data's official distribution host for td-agent/Fluentd) and installs its contents directly. While packages.treasuredata.com is the legitimate official vendor host for td-agent (Treasure Data is the company behind Fluentd/td-agent), this is still a prebuilt binary blob being extracted and installed on an Arch system without any source build. The sha512sum is present and provides integrity verification against tampering in transit. The concern is that this is an Ubuntu/Debian prebuilt binary (amd64.deb for Ubuntu Bionic) being repacked for Arch — it bundles its own Ruby runtime and gems under /opt/td-agent, meaning a large amount of precompiled code is installed that cannot be audited at build time. This is a genuine supply-chain concern (executed prebuilt binary from a vendor host, not built from source), but it is the official vendor distribution channel with a checksum, not an unofficial or personal host. This pattern is medium risk: legitimate vendor source but prebuilt binary installation with no source compilation.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(https://packages.treasuredata.com/4/ubuntu/bionic/pool/contrib/t/td-agent/${pkgname}_${pkgver}-${_pkgrel}_amd64.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt .deb binary package from packages.treasuredata.com (Treasure Data's official distribution host for td-agent/Fluentd) and installs its contents directly. While packages.treasuredata.com is the legitimate official vendor host for td-agent (Treasure Data is the company behind Fluentd/td-agent), this is still a prebuilt binary blob being extracted and installed on an Arch system without any source build. The sha512sum is present and provides integrity verification against tampering in transit. The concern is that this is an Ubuntu/Debian prebuilt binary (amd64.deb for Ubuntu Bionic) being repacked for Arch — it bundles its own Ruby runtime and gems under /opt/td-agent, meaning a large amount of precompiled code is installed that cannot be audited at build time. This is a genuine supply-chain concern (executed prebuilt binary from a vendor host, not built from source), but it is the official vendor distribution channel with a checksum, not an unofficial or personal host. This pattern is medium risk: legitimate vendor source but prebuilt binary installation with no source compilation.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kohei Suzuki <eagletmt@gmail.com>
    
      2pkgname=td-agent
    
      3pkgver=4.0.1
    
      4pkgrel=1
    
      5_pkgrel=1
    
      6pkgdesc='Open-Source Log Collector'
    
      7arch=('x86_64')
    
      8url='https://www.fluentd.org/'
    
      9license=('MIT')
    
      10options=('!strip')
    
      11source=(https://packages.treasuredata.com/4/ubuntu/bionic/pool/contrib/t/td-agent/${pkgname}_${pkgver}-${_pkgrel}_amd64.deb)
    
      12install=td-agent.install
    
      13backup=('etc/td-agent/td-agent.conf')
    
      14
    
      15package() {
    
      16  cd "$srcdir"
    
      17
    
      18  tar xf data.tar.xz -C "$pkgdir/"
    
      19
    
      20  find "$pkgdir" -type d -exec chmod 755 {} +
    
      21
    
      22  mv "$pkgdir/usr/sbin"/* "$pkgdir/usr/bin/"
    
      23  rmdir "$pkgdir/usr/sbin"
    
      24
    
      25  mv "$pkgdir/lib/systemd" "$pkgdir/usr/lib/systemd"
    
      26  rmdir "$pkgdir/lib"
    
      27
    
      28  sed -i -e 's#/var/run/td-agent#/run/td-agent#g' "$pkgdir/usr/lib/tmpfiles.d/td-agent.conf" "$pkgdir/usr/lib/systemd/system/td-agent.service"
    
      29
    
      30  rm -r "$pkgdir/usr/share/lintian"
    
      31}
    
      32
    
      33# vim: set ft=sh:
    
      34
    
      35sha512sums=('651d48177f73855e5b77f117c39dc75b0019650895747a6dbbe002a797571b991a79dc091efd88519c0d72eacd26b9ac9d932652bdbf2ac8ad754257527a04f5')
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2