wazuh-agent
LOW
maintainer madara125
11 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a YAML configuration file from GitHub, which is non-executable data used for security checks; the actual agent binaries come from the official Wazuh repository, and the source is checksum-verified.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a YAML configuration file from GitHub, which is non-executable data used for security checks; the actual agent binaries come from the official Wazuh repository, and the source is checksum-verified.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:39
source_aarch64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.aarch64.rpm"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jesus Martin Ortega Martinez (madara125) <martin.ortega.arashi@gmail.com><jortega@condorbs.net>
2
# Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><contacto@mrhacker.com.co>
3
pkgname=wazuh-agent
4
pkgver=4.14.7
5
pkgrel=1
6
_remRevision=1
7
_prodver=${pkgver}-${_remRevision}
8
pkgdesc="Wazuh Agent actively protects Arch Linux systems with advanced threat prevention, detection, and response capabilities."
9
arch=('x86_64' 'aarch64')
10
url="https://wazuh.com/"
11
license=('gpl2')
12
depends=(
13
'curl'
14
'sudo'
15
'perl'
16
'python'
17
'brotli'
18
'nodejs'
19
'inetutils'
20
)
21
optdepends=(
22
'lsb-release'
23
)
24
25
# Agente y manager son el mismo /var/ossec: comparten ~164 ficheros. Sin esta
26
# declaracion pacman aborta con un "exists in filesystem" ilegible en vez de
27
# avisar del conflicto real entre los dos paquetes.
28
conflicts=('wazuh-manager')
29
30
validpgpkeys=(
31
)
32
33
sca_file="cis_arch_linux.yml"
34
source=(
35
"${sca_file}::https://raw.githubusercontent.com/wazuh/integrations/refs/heads/main/integrations/archlinux_sca/sca/cis_arch_linux.yml"
36
"ossec.conf"
37
"cis_arch_linux-arch-derivatives.patch"
38
)
39
source_aarch64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.aarch64.rpm"
40
)
41
source_x86_64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.x86_64.rpm"
42
)
43
44
backup=(
45
"var/ossec/etc/client.keys"
46
"var/ossec/etc/local_internal_options.conf"
47
"var/ossec/etc/ossec.conf"
48
)
49
50
sha512sums=('3951de83f3f61191eb5ddc5c5474a2a049e86d6a9607cdcbbe9caa77cc58d3a33f9a3e6b2070381ff6285b8b41da544a9785d1fbe3fb1dd72d956c58c516b2c6'
51
'94ef03e4ec28bf5adb6abc761adfa785e9088667e3a6df39af87b33d25cd9cdd3df3a388bb4bccae22643dc7c030927754240ab1724afaef047e08393536bf44'
52
'41548675747387bc11ea755f41272d42456d82845fa9e469c3ad6f16254062ac220e6e5652721201884e2256941968b24b92d17e15b869eaf2a7ba2ba22a8d72')
53
sha512sums_x86_64=('35070e9329ead6d5571f5a5889063d1b67d0d9e3c94767b14ef3a4ef9742cab39dca244c2969e0c5c8fddad31ed8bcb8c78315355da8ad9eb6e26b8208ccd147')
54
sha512sums_aarch64=('5e3fadeec4b613f3661ecbbffc6b6afd6738417e62d2e53904cafeb10f81ca19ad8f1cdbf3e0127d3eb540fa1d71529d7b12c5ee0100a628ebb53cda844dc343')
55
56
install=$pkgname.install
57
58
prepare() {
59
# Corregir permisos restrictivos del RPM para que makepkg pueda limpiar $srcdir
60
chmod -R u+rwX "$srcdir/var/ossec"
61
62
# makepkg enlaza las fuentes no-archivo como symlink dentro de $srcdir apuntando
63
# a la caché SRCDEST. patch(1) se niega a modificar symlinks (endurecimiento
64
# CVE-2015-1196) y, de seguirlos con --follow-symlinks, parchearía el archivo
65
# cacheado in-place rompiendo el checksum en el siguiente build. Materializamos
66
# una copia real primero: patch actúa sobre $srcdir (efímero), no sobre la caché.
67
if [ -L "$srcdir/$sca_file" ]; then
68
cp --remove-destination -- "$(readlink -f "$srcdir/$sca_file")" "$srcdir/$sca_file"
69
fi
70
71
# Aplicar correcciones locales al SCA de upstream:
72
# - Detección de OS por ID_LIKE=arch (soporta CachyOS y demás derivados de Arch)
73
# - Arreglo del bug "not c:comando" sin patrón en el motor SCA de Wazuh
74
# - Fallback con findmnt para las comprobaciones de montaje de /tmp
75
patch -Np1 -d "$srcdir" -i "$srcdir/cis_arch_linux-arch-derivatives.patch"
76
}
77
78
package() {
79
80
# Configuración
81
cd $pkgdir
82
mv $srcdir/etc .
83
mv $srcdir/usr .
84
mv $srcdir/var .
85
86
# Asegurarse de que los archivos de configuración existen y tienen permisos adecuados
87
mkdir -p $pkgdir/var/ossec/etc
88
89
# Instalar ossec.conf personalizado para Arch Linux
90
install -Dm644 "$srcdir/ossec.conf" "$pkgdir/var/ossec/etc/ossec.conf"
91
92
# Instalar archivo SCA para Arch Linux
93
install -Dm640 "$srcdir/$sca_file" "$pkgdir/var/ossec/ruleset/sca/$sca_file"
94
95
if [ -f "$pkgdir/var/ossec/etc/local_internal_options.conf" ]; then
96
chmod 644 $pkgdir/var/ossec/etc/local_internal_options.conf
97
fi
98
99
# Si client.keys no existe, crear uno vacío con permisos adecuados
100
if [ ! -f "$pkgdir/var/ossec/etc/client.keys" ]; then
101
install -Dm644 /dev/null "$pkgdir/var/ossec/etc/client.keys"
102
else
103
chmod 644 $pkgdir/var/ossec/etc/client.keys
104
fi
105
106
# Establecer permisos del archivo de servicio systemd
107
chmod 644 $pkgdir/usr/lib/systemd/system/wazuh-agent.service
108
}
109
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |