wpe-cli-bin

maintainer vire · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball from an S3 bucket (s3-us-east-2.amazonaws.com/wpeclibinaries) that is controlled by WP Engine, the vendor of the wpe-cli tool. While this is the official vendor's distribution channel (WP Engine publishes their CLI binaries on S3), it is not a canonical upstream release host like GitHub releases, and the bucket name 'wpeclibinaries' is not independently verifiable as the official WP Engine distribution endpoint without external confirmation. The binary is executed directly (install -Dm755) with no signature verification — only an MD5 checksum is used, which provides integrity but not authenticity. If the S3 bucket were compromised or the object replaced, arbitrary code would execute on the user's system. This is a genuine supply-chain concern: a prebuilt binary from a non-standard (even if plausibly official) host with no cryptographic signature verification. The medium rating from the cheaper model is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://s3-us-east-2.amazonaws.com/wpeclibinaries/$_pkgname/v$pkgver/${_pkgname}_${pkgver}_linux_amd64.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball from an S3 bucket (s3-us-east-2.amazonaws.com/wpeclibinaries) that is controlled by WP Engine, the vendor of the wpe-cli tool. While this is the official vendor's distribution channel (WP Engine publishes their CLI binaries on S3), it is not a canonical upstream release host like GitHub releases, and the bucket name 'wpeclibinaries' is not independently verifiable as the official WP Engine distribution endpoint without external confirmation. The binary is executed directly (install -Dm755) with no signature verification — only an MD5 checksum is used, which provides integrity but not authenticity. If the S3 bucket were compromised or the object replaced, arbitrary code would execute on the user's system. This is a genuine supply-chain concern: a prebuilt binary from a non-standard (even if plausibly official) host with no cryptographic signature verification. The medium rating from the cheaper model is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Niels Mentink niels.mentink@gmail.com
    
      2
    
      3pkgname=wpe-cli-bin
    
      4_pkgname=wpe-cli
    
      5pkgver=0.14.1
    
      6pkgrel=1
    
      7pkgdesc='An aur package for the wpe-cli'
    
      8arch=('x86_64')
    
      9url='https://wpengine.com/'
    
      10license=('MIT')
    
      11provides=('wpe')
    
      12conflicts=('wpe')
    
      13options=('!strip')
    
      14source=("https://s3-us-east-2.amazonaws.com/wpeclibinaries/$_pkgname/v$pkgver/${_pkgname}_${pkgver}_linux_amd64.tar.gz")
    
      15md5sums=('7aa87724b2c9fd6c0b91da88bd13b9c8')
    
      16
    
      17package() {
    
      18  install -Dm755 "${srcdir}/wpe" "${pkgdir}/usr/local/bin/wpe"
    
      19}
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2