warp-cli
maintainer kylethompson
· 1 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt proprietary binary (.deb) from downloads.cloudflareclient.com, which is Cloudflare's official download host for their WARP client. This is not a random personal or unofficial host — it is the canonical vendor distribution endpoint. However, sha256sums='SKIP' means there is no integrity verification of the downloaded binary, so a MITM or server-side substitution would go undetected. The binary is then extracted and installed as a system service (warp-svc.service) running with elevated privileges. The combination of: (1) no checksum verification, (2) a prebuilt proprietary binary, and (3) installation as a privileged systemd service constitutes a genuine supply-chain risk even though the source host is legitimate. This is a real medium-severity concern — not a false positive — because the lack of checksums on an executed binary from even a legitimate vendor host is a meaningful integrity gap. The optional enterprise certificate installation is a minor additional concern but is gated on user-provided files. The package is not piracy and appears functional.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:39
source=("cloudflare-warp_${_pkgver}_amd64.deb::https://downloads.cloudflareclient.com/v1/download/jammy-intel/version/${_pkgver}")
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The package downloads a prebuilt proprietary binary (.deb) from downloads.cloudflareclient.com, which is Cloudflare's official download host for their WARP client. This is not a random personal or unofficial host — it is the canonical vendor distribution endpoint. However, sha256sums='SKIP' means there is no integrity verification of the downloaded binary, so a MITM or server-side substitution would go undetected. The binary is then extracted and installed as a system service (warp-svc.service) running with elevated privileges. The combination of: (1) no checksum verification, (2) a prebuilt proprietary binary, and (3) installation as a privileged systemd service constitutes a genuine supply-chain risk even though the source host is legitimate. This is a real medium-severity concern — not a false positive — because the lack of checksums on an executed binary from even a legitimate vendor host is a meaningful integrity gap. The optional enterprise certificate installation is a minor additional concern but is gated on user-provided files. The package is not piracy and appears functional.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Kyle Thompson <kylejeromethompson@gmail.com>
2
#
3
# --- DISCLAIMER ---
4
# This PKGBUILD is an unofficial community contribution. It is not affiliated with,
5
# endorsed, or supported by Cloudflare
6
#
7
# The Cloudflare WARP agent is proprietary software. By building and installing
8
# this package, you acknowledge that you are downloading software directly from
9
# Cloudflare and agree to be bound by their End User License Agreement and
10
# Privacy Notice. You are solely responsible for ensuring you have a valid
11
# license to use the software.
12
#
13
# This installation script is provided "AS IS" without warranty of any kind,
14
# express or implied. The user assumes all risk and responsibility for its use.
15
#
16
# Terms of Use: https://www.cloudflare.com/website-terms/
17
# Privacy Notice: https://www.cloudflare.com/application/privacypolicy/
18
19
# --- Package Information ---
20
pkgname='warp-cli'
21
pkgdesc="Cloudflare WARP Client for Arch Linux"
22
arch=('x86_64')
23
url="https://www.cloudflare.com/"
24
license=('custom')
25
26
# --- Versioning ---
27
_pkgver='2025.8.779.0'
28
pkgver=${_pkgver}
29
pkgrel=1
30
31
# --- Dependencies and Conflicts ---
32
# FINAL CHANGE: Added 'nss' and 'dbus' to ensure all runtime dependencies are met.
33
depends=('glibc' 'openssl' 'gtk3' 'nftables' 'nss' 'dbus')
34
provides=("${pkgname}")
35
36
# --- Source File ---
37
# CRITICAL CHANGE: 'certificate.crt' is NOT listed here.
38
# This prevents makepkg from aborting if the file is missing from the PWD.
39
source=("cloudflare-warp_${_pkgver}_amd64.deb::https://downloads.cloudflareclient.com/v1/download/jammy-intel/version/${_pkgver}")
40
sha256sums=('SKIP')
41
42
# --- Packaging Function ---
43
package() {
44
# Extract the data archive.
45
tar -xzf "${srcdir}/data.tar.gz" -C "${pkgdir}"
46
47
# Move binaries from /bin to /usr/bin
48
mv "${pkgdir}/bin" "${pkgdir}/usr/bin"
49
50
# The service file is located at ./lib/systemd/system/warp-svc.service inside the archive.
51
# We need to move it to /usr/lib/systemd/system/ in the package.
52
install -Dm644 "${pkgdir}/lib/systemd/system/warp-svc.service" "${pkgdir}/usr/lib/systemd/system/warp-svc.service"
53
54
# Remove the old directory structure
55
rm -r "${pkgdir}/lib"
56
57
# Fix permissions for other files
58
if [ -d "${pkgdir}/usr/share/applications" ]; then
59
find "${pkgdir}/usr/share/applications" -type f -exec chmod 644 {} +
60
fi
61
if [ -d "${pkgdir}/usr/share/icons" ]; then
62
find "${pkgdir}/usr/share/icons" -type f -exec chmod 644 {} +
63
fi
64
65
# ----------------------------------------------------
66
# NEW RESILIENT STEP: Install Corporate Certificate (OPTIONAL)
67
# ----------------------------------------------------
68
# Check if 'certificate.crt' exists in the build directory ($srcdir).
69
if [ -f "${srcdir}/certificate.crt" ]; then
70
echo "Found certificate.crt! Installing to trust anchors for Enterprise use."
71
# SOURCE: Looks for the 'certificate.crt' file provided by the user.
72
# DESTINATION: Renames it to 'tenant-ca.crt' in the system trust anchors.
73
install -Dm644 "${srcdir}/certificate.crt" "${pkgdir}/etc/ca-certificates/trust-source/anchors/tenant-ca.crt"
74
else
75
echo "Note: certificate.crt not found. Skipping optional enterprise certificate installation."
76
fi
77
}
78
79
# --- Installation Script (for running update-ca-trust) ---
80
# This step is performed immediately after the package files are copied to the system.
81
post_install() {
82
# We run update-ca-trust regardless, as the binary install requires clean trust stores.
83
echo "Updating system certificate trust store..."
84
update-ca-trust
85
echo "Certificate trust store updated successfully."
86
}
87
88
# --- Removal Script ---
89
post_remove() {
90
echo "Updating system certificate trust store after removal..."
91
update-ca-trust
92
echo "Certificate trust store updated successfully."
93
}
94
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |