wazuh-agent

LOW

maintainer madara125 11 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a YAML SCA file from a non-whitelisted host (GitHub), but it is non-executable data used for security compliance checks, not code; the main binaries come from the official wazuh.com domain, and the build process is transparent and follows standard AUR practices.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a YAML SCA file from a non-whitelisted host (GitHub), but it is non-executable data used for security compliance checks, not code; the main binaries come from the official wazuh.com domain, and the build process is transparent and follows standard AUR practices.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 source_aarch64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.aarch64.rpm"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jesus Martin Ortega Martinez (madara125) <martin.ortega.arashi@gmail.com><jortega@condorbs.net>
    
      2# Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><contacto@mrhacker.com.co>
    
      3pkgname=wazuh-agent
    
      4pkgver=4.14.9
    
      5pkgrel=1
    
      6_remRevision=1
    
      7_prodver=${pkgver}-${_remRevision}
    
      8pkgdesc="Wazuh Agent actively protects Arch Linux systems with advanced threat prevention, detection, and response capabilities."
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://wazuh.com/"
    
      11license=('gpl2')
    
      12depends=(
    
      13  'curl'
    
      14  'sudo'
    
      15  'perl'
    
      16  'python'
    
      17  'brotli'
    
      18  'nodejs'
    
      19  'inetutils'
    
      20)
    
      21optdepends=(
    
      22  'lsb-release'
    
      23)
    
      24
    
      25conflicts=('wazuh-manager')
    
      26
    
      27validpgpkeys=(
    
      28)
    
      29
    
      30sca_file="cis_arch_linux.yml"
    
      31source=(
    
      32  "${sca_file}::https://raw.githubusercontent.com/wazuh/integrations/refs/heads/main/integrations/archlinux_sca/sca/cis_arch_linux.yml"
    
      33  "ossec.conf"
    
      34  "cis_arch_linux-arch-derivatives.patch"
    
      35)
    
      36source_aarch64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.aarch64.rpm"
    
      37)
    
      38source_x86_64=("https://packages.wazuh.com/4.x/yum/${pkgname}-${pkgver}-${_remRevision}.x86_64.rpm"
    
      39)
    
      40
    
      41backup=(
    
      42  "var/ossec/etc/client.keys"
    
      43  "var/ossec/etc/local_internal_options.conf"
    
      44  "var/ossec/etc/ossec.conf"
    
      45)
    
      46
    
      47sha512sums=('3951de83f3f61191eb5ddc5c5474a2a049e86d6a9607cdcbbe9caa77cc58d3a33f9a3e6b2070381ff6285b8b41da544a9785d1fbe3fb1dd72d956c58c516b2c6'
    
      48            '94ef03e4ec28bf5adb6abc761adfa785e9088667e3a6df39af87b33d25cd9cdd3df3a388bb4bccae22643dc7c030927754240ab1724afaef047e08393536bf44'
    
      49            '41548675747387bc11ea755f41272d42456d82845fa9e469c3ad6f16254062ac220e6e5652721201884e2256941968b24b92d17e15b869eaf2a7ba2ba22a8d72')
    
      50sha512sums_x86_64=('d4ad14b5759a73ed8e047f1b834e9943bbedbb8e17914267ac906e89304b583cc4e78e088a8494260b49a644d29e133e65582f5fe2fd8902325a7e213a15acd6')
    
      51sha512sums_aarch64=('355d2a5ae190e94c071dc49c61fec8c19ad6d6e80a7244232793273f20bb564226bf6f06e1eb8c37b9031da5fd2af8680dd5b5b6b1f9f4bac5a10434bc9dbef7')
    
      52
    
      53install=$pkgname.install
    
      54
    
      55prepare() {
    
      56  # Corregir permisos restrictivos del RPM para que makepkg pueda limpiar $srcdir
    
      57  chmod -R u+rwX "$srcdir/var/ossec"
    
      58
    
      59  # makepkg enlaza las fuentes no-archivo como symlink dentro de $srcdir apuntando
    
      60  # a la caché SRCDEST. patch(1) se niega a modificar symlinks (endurecimiento
    
      61  # CVE-2015-1196) y, de seguirlos con --follow-symlinks, parchearía el archivo
    
      62  # cacheado in-place rompiendo el checksum en el siguiente build. Materializamos
    
      63  # una copia real primero: patch actúa sobre $srcdir (efímero), no sobre la caché.
    
      64  if [ -L "$srcdir/$sca_file" ]; then
    
      65    cp --remove-destination -- "$(readlink -f "$srcdir/$sca_file")" "$srcdir/$sca_file"
    
      66  fi
    
      67
    
      68  # Aplicar correcciones locales al SCA de upstream:
    
      69  #  - Detección de OS por ID_LIKE=arch (soporta CachyOS y demás derivados de Arch)
    
      70  #  - Arreglo del bug "not c:comando" sin patrón en el motor SCA de Wazuh
    
      71  #  - Fallback con findmnt para las comprobaciones de montaje de /tmp
    
      72  patch -Np1 -d "$srcdir" -i "$srcdir/cis_arch_linux-arch-derivatives.patch"
    
      73}
    
      74
    
      75package() {
    
      76
    
      77  # Configuración
    
      78  cd $pkgdir
    
      79  mv $srcdir/etc .
    
      80  mv $srcdir/usr .
    
      81  mv $srcdir/var .
    
      82
    
      83  # Asegurarse de que los archivos de configuración existen y tienen permisos adecuados
    
      84  mkdir -p $pkgdir/var/ossec/etc
    
      85
    
      86  # Instalar ossec.conf personalizado para Arch Linux
    
      87  install -Dm644 "$srcdir/ossec.conf" "$pkgdir/var/ossec/etc/ossec.conf"
    
      88
    
      89  # Instalar archivo SCA para Arch Linux
    
      90  install -Dm640 "$srcdir/$sca_file" "$pkgdir/var/ossec/ruleset/sca/$sca_file"
    
      91
    
      92  if [ -f "$pkgdir/var/ossec/etc/local_internal_options.conf" ]; then
    
      93    chmod 644 $pkgdir/var/ossec/etc/local_internal_options.conf
    
      94  fi
    
      95
    
      96  # Si client.keys no existe, crear uno vacío con permisos adecuados
    
      97  if [ ! -f "$pkgdir/var/ossec/etc/client.keys" ]; then
    
      98    install -Dm644 /dev/null "$pkgdir/var/ossec/etc/client.keys"
    
      99  else
    
      100    chmod 644 $pkgdir/var/ossec/etc/client.keys
    
      101  fi
    
      102
    
      103  # Establecer permisos del archivo de servicio systemd
    
      104  chmod 644 $pkgdir/usr/lib/systemd/system/wazuh-agent.service
    
      105}
    
      106

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Jesus Martin Ortega Martinez (madara125) <martin.ortega.arashi@gmail.com><jortega@condorbs.net>
 # Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><contacto@mrhacker.com.co>
 pkgname=wazuh-agent
-pkgver=4.14.7
+pkgver=4.14.9
 pkgrel=1
 _remRevision=1
 _prodver=${pkgver}-${_remRevision}
@@ -22,9 +22,6 @@
   'lsb-release'
 )
 
-# Agente y manager son el mismo /var/ossec: comparten ~164 ficheros. Sin esta
-# declaracion pacman aborta con un "exists in filesystem" ilegible en vez de
-# avisar del conflicto real entre los dos paquetes.
 conflicts=('wazuh-manager')
 
 validpgpkeys=(
@@ -50,8 +47,8 @@
 sha512sums=('3951de83f3f61191eb5ddc5c5474a2a049e86d6a9607cdcbbe9caa77cc58d3a33f9a3e6b2070381ff6285b8b41da544a9785d1fbe3fb1dd72d956c58c516b2c6'
             '94ef03e4ec28bf5adb6abc761adfa785e9088667e3a6df39af87b33d25cd9cdd3df3a388bb4bccae22643dc7c030927754240ab1724afaef047e08393536bf44'
             '41548675747387bc11ea755f41272d42456d82845fa9e469c3ad6f16254062ac220e6e5652721201884e2256941968b24b92d17e15b869eaf2a7ba2ba22a8d72')
-sha512sums_x86_64=('35070e9329ead6d5571f5a5889063d1b67d0d9e3c94767b14ef3a4ef9742cab39dca244c2969e0c5c8fddad31ed8bcb8c78315355da8ad9eb6e26b8208ccd147')
-sha512sums_aarch64=('5e3fadeec4b613f3661ecbbffc6b6afd6738417e62d2e53904cafeb10f81ca19ad8f1cdbf3e0127d3eb540fa1d71529d7b12c5ee0100a628ebb53cda844dc343')
+sha512sums_x86_64=('d4ad14b5759a73ed8e047f1b834e9943bbedbb8e17914267ac906e89304b583cc4e78e088a8494260b49a644d29e133e65582f5fe2fd8902325a7e213a15acd6')
+sha512sums_aarch64=('355d2a5ae190e94c071dc49c61fec8c19ad6d6e80a7244232793273f20bb564226bf6f06e1eb8c37b9031da5fd2af8680dd5b5b6b1f9f4bac5a10434bc9dbef7')
 
 install=$pkgname.install
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 01:13:57	Medium	1
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2