wdckit

maintainer k0ste · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary (wdckit, a Western Digital CLI utility) from s3.e2e4.ru/k0ste/, which is a personal/third-party S3 bucket operated by the maintainer, not an official Western Digital distribution channel. The comment acknowledges the official source is behind a Cloudflare challenge (hddguru.com), so the maintainer is re-hosting the binary themselves. This is a classic supply-chain concern: a closed-source, prebuilt x86_64/aarch64 binary is fetched from an unofficial host controlled by a single individual. There is a sha256sum check, which provides some integrity guarantee, but does not protect against the host owner substituting the file and updating the checksum in the PKGBUILD. The binary is then directly installed to /opt/wdc/wdckit and executed paths are set up. This pattern — unofficial re-hosting of a proprietary prebuilt binary — is a genuine medium-severity supply-chain risk, consistent with the original rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://s3.e2e4.ru/k0ste/pkgbuild/${pkgname}-${pkgver}.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary (wdckit, a Western Digital CLI utility) from s3.e2e4.ru/k0ste/, which is a personal/third-party S3 bucket operated by the maintainer, not an official Western Digital distribution channel. The comment acknowledges the official source is behind a Cloudflare challenge (hddguru.com), so the maintainer is re-hosting the binary themselves. This is a classic supply-chain concern: a closed-source, prebuilt x86_64/aarch64 binary is fetched from an unofficial host controlled by a single individual. There is a sha256sum check, which provides some integrity guarantee, but does not protect against the host owner substituting the file and updating the checksum in the PKGBUILD. The binary is then directly installed to /opt/wdc/wdckit and executed paths are set up. This pattern — unofficial re-hosting of a proprietary prebuilt binary — is a genuine medium-severity supply-chain risk, consistent with the original rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Konstantin Shalygin <k0ste@k0ste.ru>
    
      2# Contributor: Konstantin Shalygin <k0ste@k0ste.ru>
    
      3
    
      4pkgname='wdckit'
    
      5_path="opt/wdc/${pkgname}"
    
      6pkgver='3.3.1.0'
    
      7pkgrel='1'
    
      8pkgdesc="Western Digital ATA/SCSI command line utility"
    
      9url='https://westerndigital.com/'
    
      10license=('custom')
    
      11arch=('x86_64' 'aarch64')
    
      12makedepends=('libarchive')
    
      13# Source file is covered with Cloudflare challenge
    
      14# https://files.hddguru.com/index.php?action=downloadfile&filename=wdckit-3.3.1.0.zip&directory=Software/Western%20Digital&
    
      15
    
      16source=("https://s3.e2e4.ru/k0ste/pkgbuild/${pkgname}-${pkgver}.zip")
    
      17sha256sums=('541c2ed48dd6e6ddc7e5a2c9dd292cb4108392bd02bca3d5be2ff6057b316e3a')
    
      18
    
      19_file_arch=$([[ "${CARCH}" == 'x86_64' ]] && echo -n "${pkgname}-${pkgver}-${CARCH}-rpm" || echo -n "${pkgname}-${pkgver}-${CARCH}_deb")
    
      20_pkg_arch=$([[ "${CARCH}" == 'x86_64' ]] && echo -n "${pkgname}-${pkgver}.${CARCH}.rpm" || echo -n "${pkgname}_${pkgver}_${CARCH}.deb")
    
      21
    
      22prepare() {
    
      23  mkdir "${_file_arch}" "${pkgname}-pkgsource"
    
      24  # Unpack zip with packages
    
      25  bsdtar -xf "${_file_arch}.zip" --directory "${_file_arch}"
    
      26  # Unpack package
    
      27  bsdtar -xf "${_file_arch}/${_pkg_arch}" --directory "${pkgname}-pkgsource"
    
      28}
    
      29
    
      30build() {
    
      31  cd "${pkgname}-pkgsource"
    
      32  # trick ported from original package
    
      33  echo "1" > "${_path}/.${pkgname}_lic"
    
      34  touch "${_path}/.exit_codes.txt"
    
      35}
    
      36
    
      37package() {
    
      38  cd "${pkgname}-pkgsource"
    
      39  install -Dm0755 "${_path}/man/${pkgname}.1.gz" -t "${pkgdir}/usr/share/man/man1"
    
      40  rm --force --recursive "${_path}/man"
    
      41  cp --recursive "usr" "${pkgdir}"
    
      42  cp --recursive "opt" "${pkgdir}"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2