wazuh-manager

MEDIUM

maintainer madara125 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt RPM from an official but non-whitelisted host (packages.wazuh.com); while the source is verifiable via checksum and plausibly official, using a binary artifact from a third-party host introduces a supply-chain risk if that host were compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "https://packages.wazuh.com/4.x/yum/${pkgname}-${_prodver}.x86_64.rpm"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt RPM from an official but non-whitelisted host (packages.wazuh.com); while the source is verifiable via checksum and plausibly official, using a binary artifact from a third-party host introduces a supply-chain risk if that host were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jesus Martin Ortega Martinez (madara125) <martin.ortega.arashi@gmail.com><jortega@condorbs.net>
    
      2# Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><david.munozm@proton.me>
    
      3pkgname=wazuh-manager
    
      4pkgver=4.14.9
    
      5pkgrel=1
    
      6_remRevision=1
    
      7_prodver=${pkgver}-${_remRevision}
    
      8pkgdesc="Wazuh Manager for Arch Linux"
    
      9arch=('x86_64')
    
      10url="https://wazuh.com/"
    
      11license=('gpl2')
    
      12groups=("wazuh-siem")
    
      13depends=(
    
      14  'wazuh-filebeat'
    
      15  'curl'
    
      16)
    
      17
    
      18optdepends=(
    
      19)
    
      20
    
      21# Manager y agente son el mismo /var/ossec: comparten ~164 ficheros. Sin esta
    
      22# declaracion pacman aborta con un "exists in filesystem" ilegible en vez de
    
      23# avisar del conflicto real entre los dos paquetes.
    
      24conflicts=('wazuh-agent')
    
      25
    
      26validpgpkeys=(
    
      27)
    
      28
    
      29source=(
    
      30  "https://packages.wazuh.com/4.x/yum/${pkgname}-${_prodver}.x86_64.rpm"
    
      31)
    
      32
    
      33sha512sums=('70502e04e0773493ac3b59576399147530aa13602204055df1d8d426226ec7d5e8300e72960c7d0e51ee69a61495900e5db7df5958f1b52bef38c6a4ee952eae')
    
      34
    
      35install=$pkgname.install
    
      36
    
      37package() {
    
      38  #Setup
    
      39  cd $pkgdir
    
      40  mv $srcdir/etc .
    
      41  mv $srcdir/usr .
    
      42  mv $srcdir/var .
    
      43
    
      44  #change permissions (owner will be set in post_install when user exists)
    
      45  chmod -R +w "$pkgdir/var/ossec"
    
      46
    
      47  # Politicas SCA. El %post del RPM las mueve desde var/ossec/tmp/sca-*-tmp a
    
      48  # ruleset/sca y borra el temporal. Sin ese paso el manager se instala con
    
      49  # ruleset/sca VACIO (queda sin ninguna politica SCA) y ademas se dejan 21 MB
    
      50  # de temporales en disco para siempre.
    
      51  # La seleccion depende de la distro, pero en Arch y sus derivadas nunca hay
    
      52  # un sca.files propio, asi que siempre aplica el de 'generic': se puede
    
      53  # resolver aqui, en tiempo de empaquetado, y el paquete queda determinista.
    
      54  local _sca_tmp _f _base
    
      55  _sca_tmp=$(find "$pkgdir/var/ossec/tmp" -maxdepth 1 -type d -name 'sca-*-tmp' 2>/dev/null | head -1)
    
      56  if [ -n "$_sca_tmp" ] && [ -r "$_sca_tmp/generic/sca.files" ]; then
    
      57    install -dm750 "$pkgdir/var/ossec/ruleset/sca"
    
      58
    
      59    # Politicas activas para esta distro
    
      60    while read -r _f; do
    
      61      [ -f "$_sca_tmp/$_f" ] && install -m640 "$_sca_tmp/$_f" "$pkgdir/var/ossec/ruleset/sca/"
    
      62    done < "$_sca_tmp/generic/sca.files"
    
      63
    
      64    # El resto de politicas que el manager distribuye a sus agentes se instalan
    
      65    # desactivadas (.disabled), igual que hace el RPM.
    
      66    while read -r _f; do
    
      67      _base=$(basename "$_f")
    
      68      if [ -f "$_sca_tmp/$_f" ] && [ ! -f "$pkgdir/var/ossec/ruleset/sca/$_base" ]; then
    
      69        install -m640 "$_sca_tmp/$_f" "$pkgdir/var/ossec/ruleset/sca/${_base}.disabled"
    
      70      fi
    
      71    done < "$_sca_tmp/generic/sca.manager.files"
    
      72
    
      73    rm -rf "$_sca_tmp"
    
      74  fi
    
      75
    
      76  #Set systemd service file perms
    
      77  chmod 644 $pkgdir/usr/lib/systemd/system/wazuh-manager.service
    
      78}
    
      79

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Jesus Martin Ortega Martinez (madara125) <martin.ortega.arashi@gmail.com><jortega@condorbs.net>
 # Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><david.munozm@proton.me>
 pkgname=wazuh-manager
-pkgver=4.14.3
+pkgver=4.14.9
 pkgrel=1
 _remRevision=1
 _prodver=${pkgver}-${_remRevision}
@@ -18,6 +18,11 @@
 optdepends=(
 )
 
+# Manager y agente son el mismo /var/ossec: comparten ~164 ficheros. Sin esta
+# declaracion pacman aborta con un "exists in filesystem" ilegible en vez de
+# avisar del conflicto real entre los dos paquetes.
+conflicts=('wazuh-agent')
+
 validpgpkeys=(
 )
 
@@ -25,7 +30,7 @@
   "https://packages.wazuh.com/4.x/yum/${pkgname}-${_prodver}.x86_64.rpm"
 )
 
-sha512sums=('987acc2e344586dba932a23f09d6ba2c98a5a860925436a65da9fdf1032e4f70c71b1b2fd499e3939c2f2ae9557e8e411ad94b7549a721cdf4e6d34f7efb80fd')
+sha512sums=('70502e04e0773493ac3b59576399147530aa13602204055df1d8d426226ec7d5e8300e72960c7d0e51ee69a61495900e5db7df5958f1b52bef38c6a4ee952eae')
 
 install=$pkgname.install
 
@@ -39,6 +44,35 @@
   #change permissions (owner will be set in post_install when user exists)
   chmod -R +w "$pkgdir/var/ossec"
 
+  # Politicas SCA. El %post del RPM las mueve desde var/ossec/tmp/sca-*-tmp a
+  # ruleset/sca y borra el temporal. Sin ese paso el manager se instala con
+  # ruleset/sca VACIO (queda sin ninguna politica SCA) y ademas se dejan 21 MB
+  # de temporales en disco para siempre.
+  # La seleccion depende de la distro, pero en Arch y sus derivadas nunca hay
+  # un sca.files propio, asi que siempre aplica el de 'generic': se puede
+  # resolver aqui, en tiempo de empaquetado, y el paquete queda determinista.
+  local _sca_tmp _f _base
+  _sca_tmp=$(find "$pkgdir/var/ossec/tmp" -maxdepth 1 -type d -name 'sca-*-tmp' 2>/dev/null | head -1)
+  if [ -n "$_sca_tmp" ] && [ -r "$_sca_tmp/generic/sca.files" ]; then
+    install -dm750 "$pkgdir/var/ossec/ruleset/sca"
+
+    # Politicas activas para esta distro
+    while read -r _f; do
+      [ -f "$_sca_tmp/$_f" ] && install -m640 "$_sca_tmp/$_f" "$pkgdir/var/ossec/ruleset/sca/"
+    done < "$_sca_tmp/generic/sca.files"
+
+    # El resto de politicas que el manager distribuye a sus agentes se instalan
+    # desactivadas (.disabled), igual que hace el RPM.
+    while read -r _f; do
+      _base=$(basename "$_f")
+      if [ -f "$_sca_tmp/$_f" ] && [ ! -f "$pkgdir/var/ossec/ruleset/sca/$_base" ]; then
+        install -m640 "$_sca_tmp/$_f" "$pkgdir/var/ossec/ruleset/sca/${_base}.disabled"
+      fi
+    done < "$_sca_tmp/generic/sca.manager.files"
+
+    rm -rf "$_sca_tmp"
+  fi
+
   #Set systemd service file perms
   chmod 644 $pkgdir/usr/lib/systemd/system/wazuh-manager.service
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 01:13:57	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2