ydb

maintainer thebits · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary executable directly from Yandex Cloud Storage (storage.yandexcloud.net) and installs it into /usr/bin/ydb. While this is the official Yandex distribution host for YDB CLI releases (analogous to how other vendors distribute binaries via their own cloud storage), it is still a prebuilt binary from a vendor-controlled host with no way to verify build reproducibility. The sha256sum provides integrity checking against tampering in transit, but does not protect against the vendor silently replacing the binary at the same URL. The license is listed as 'unknown' which is a minor concern. This is a genuine medium-risk supply-chain concern: an executed binary from a non-standard (though plausibly official vendor) host, with no source build, no GPG signature verification, and reliance solely on a hash that the maintainer must manually update. Not clearly malicious, but the pattern of installing an opaque prebuilt binary warrants the medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("$pkgname-$pkgver"::"https://storage.yandexcloud.net/yandexcloud-ydb/release/${pkgver}/linux/amd64/ydb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads a prebuilt binary executable directly from Yandex Cloud Storage (storage.yandexcloud.net) and installs it into /usr/bin/ydb. While this is the official Yandex distribution host for YDB CLI releases (analogous to how other vendors distribute binaries via their own cloud storage), it is still a prebuilt binary from a vendor-controlled host with no way to verify build reproducibility. The sha256sum provides integrity checking against tampering in transit, but does not protect against the vendor silently replacing the binary at the same URL. The license is listed as 'unknown' which is a minor concern. This is a genuine medium-risk supply-chain concern: an executed binary from a non-standard (though plausibly official vendor) host, with no source build, no GPG signature verification, and reliance solely on a hash that the maintainer must manually update. Not clearly malicious, but the pattern of installing an opaque prebuilt binary warrants the medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sergey Mezentsev <thebits@yandex.ru>
    
      2pkgname=ydb
    
      3pkgver=2.31.0
    
      4pkgrel=1
    
      5pkgdesc="Yandex Database CLI"
    
      6license=('unknown')
    
      7arch=("x86_64")
    
      8url="https://ydb.tech/en/docs/reference/ydb-cli/"
    
      9source=("$pkgname-$pkgver"::"https://storage.yandexcloud.net/yandexcloud-ydb/release/${pkgver}/linux/amd64/ydb")
    
      10sha256sums=('6cbf9504438cb46f6cd129ddaf1bac0f1de937ae693807cc8d13457617336ff0')
    
      11
    
      12package() {
    
      13  cd "${srcdir}"
    
      14  install -D -m 0755 "$pkgname-$pkgver" "$pkgdir/usr/bin/ydb"
    
      15}
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2