wazuh-agent

maintainer madara125 · 11 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt RPM from a non-standard host (packages.wazuh.com) which is not whitelisted, posing a supply-chain risk if the host is compromised or the checksums are unverifiable; however, the source is from the official vendor's domain and checksums are provided, reducing the likelihood of malicious intent.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 source_aarch64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.aarch64.rpm"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt RPM from a non-standard host (packages.wazuh.com) which is not whitelisted, posing a supply-chain risk if the host is compromised or the checksums are unverifiable; however, the source is from the official vendor's domain and checksums are provided, reducing the likelihood of malicious intent.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jesus Martin Ortega Martinez (madara125) <martin.ortega.arashi@gmail.com><jortega@condorbs.net>
    
      2# Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><contacto@mrhacker.com.co>
    
      3pkgname=wazuh-agent
    
      4pkgver=4.14.6
    
      5pkgrel=1
    
      6_remRevision=1
    
      7_prodver=${pkgver}-${_remRevision}
    
      8pkgdesc="Wazuh Agent actively protects Arch Linux systems with advanced threat prevention, detection, and response capabilities."
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://wazuh.com/"
    
      11license=('gpl2')
    
      12depends=(
    
      13  'curl'
    
      14  'sudo'
    
      15  'perl'
    
      16  'python'
    
      17  'brotli'
    
      18  'nodejs'
    
      19  'inetutils'
    
      20)
    
      21optdepends=(
    
      22  'lsb-release'
    
      23)
    
      24
    
      25validpgpkeys=(
    
      26)
    
      27
    
      28sca_file="cis_arch_linux.yml"
    
      29source=(
    
      30  "${sca_file}::https://raw.githubusercontent.com/wazuh/integrations/refs/heads/main/integrations/archlinux_sca/sca/cis_arch_linux.yml"
    
      31  "ossec.conf"
    
      32  "cis_arch_linux-arch-derivatives.patch"
    
      33)
    
      34source_aarch64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.aarch64.rpm"
    
      35)
    
      36source_x86_64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.x86_64.rpm"
    
      37)
    
      38
    
      39backup=(
    
      40  "var/ossec/etc/client.keys"
    
      41  "var/ossec/etc/local_internal_options.conf"
    
      42  "var/ossec/etc/ossec.conf"
    
      43)
    
      44
    
      45sha512sums=('3951de83f3f61191eb5ddc5c5474a2a049e86d6a9607cdcbbe9caa77cc58d3a33f9a3e6b2070381ff6285b8b41da544a9785d1fbe3fb1dd72d956c58c516b2c6'
    
      46            '94ef03e4ec28bf5adb6abc761adfa785e9088667e3a6df39af87b33d25cd9cdd3df3a388bb4bccae22643dc7c030927754240ab1724afaef047e08393536bf44'
    
      47            '41548675747387bc11ea755f41272d42456d82845fa9e469c3ad6f16254062ac220e6e5652721201884e2256941968b24b92d17e15b869eaf2a7ba2ba22a8d72')
    
      48sha512sums_x86_64=('e58ae95a9bacf01aeb56581dca653e8b40f8233b8ec756247ec007604399116d5a39a7c98785c6d046bca48e7f57f9699a8c6e538d060a785e24b964bb39f17d')
    
      49sha512sums_aarch64=('eb0c101b1d632e692b917ce7923dd3ef8354cd859292bd8a475e67c5ed40a62cc55f4d671674dbad54df4225f20dbc01ba78207f4170e53ccfd3be49c545e659')
    
      50
    
      51install=$pkgname.install
    
      52
    
      53prepare() {
    
      54  # Corregir permisos restrictivos del RPM para que makepkg pueda limpiar $srcdir
    
      55  chmod -R u+rwX "$srcdir/var/ossec"
    
      56
    
      57  # Aplicar correcciones locales al SCA de upstream:
    
      58  #  - Detección de OS por ID_LIKE=arch (soporta CachyOS y demás derivados de Arch)
    
      59  #  - Arreglo del bug "not c:comando" sin patrón en el motor SCA de Wazuh
    
      60  #  - Fallback con findmnt para las comprobaciones de montaje de /tmp
    
      61  patch -Np1 -d "$srcdir" -i "$srcdir/cis_arch_linux-arch-derivatives.patch"
    
      62}
    
      63
    
      64package() {
    
      65
    
      66  # Configuración
    
      67  cd $pkgdir
    
      68  mv $srcdir/etc .
    
      69  mv $srcdir/usr .
    
      70  mv $srcdir/var .
    
      71
    
      72  # Asegurarse de que los archivos de configuración existen y tienen permisos adecuados
    
      73  mkdir -p $pkgdir/var/ossec/etc
    
      74
    
      75  # Instalar ossec.conf personalizado para Arch Linux
    
      76  install -Dm644 "$srcdir/ossec.conf" "$pkgdir/var/ossec/etc/ossec.conf"
    
      77
    
      78  # Instalar archivo SCA para Arch Linux
    
      79  install -Dm640 "$srcdir/$sca_file" "$pkgdir/var/ossec/ruleset/sca/$sca_file"
    
      80
    
      81  if [ -f "$pkgdir/var/ossec/etc/local_internal_options.conf" ]; then
    
      82    chmod 644 $pkgdir/var/ossec/etc/local_internal_options.conf
    
      83  fi
    
      84
    
      85  # Si client.keys no existe, crear uno vacío con permisos adecuados
    
      86  if [ ! -f "$pkgdir/var/ossec/etc/client.keys" ]; then
    
      87    install -Dm644 /dev/null "$pkgdir/var/ossec/etc/client.keys"
    
      88  else
    
      89    chmod 644 $pkgdir/var/ossec/etc/client.keys
    
      90  fi
    
      91
    
      92  # Establecer permisos del archivo de servicio systemd
    
      93  chmod 644 $pkgdir/usr/lib/systemd/system/wazuh-agent.service
    
      94}
    
      95

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2