aksusbd

maintainer fennekuiper · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary tarball from fdsext.gemalto.com (Gemalto/Thales, the actual vendor of Sentinel/HASP hardware security keys), extracts an RPM from it, and installs the aksusbd and hasplmd daemons that run as system services. Gemalto is the legitimate upstream vendor (now Thales Group), so this is not a random personal host — it is the official vendor download portal. However, the download URL is an opaque file-store endpoint (not a versioned release page), the host is not a well-known public forge, and the binaries are closed-source executables installed as root-level system daemons with udev rules. The sha256sums are pinned, which mitigates substitution risk significantly. The concern is real but modest: closed-source vendor binaries from a semi-obscure vendor CDN endpoint, installed as privileged daemons. This is a legitimate vendor package with a non-standard distribution mechanism, not clearly malicious, but the executed-binary-from-unofficial-endpoint pattern warrants medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("${_tarballname}-${pkgver}.tar.gz::https://fdsext.gemalto.com/filesSN/Index/$_dl_hash?sid=$_dl_id"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball from fdsext.gemalto.com (Gemalto/Thales, the actual vendor of Sentinel/HASP hardware security keys), extracts an RPM from it, and installs the aksusbd and hasplmd daemons that run as system services. Gemalto is the legitimate upstream vendor (now Thales Group), so this is not a random personal host — it is the official vendor download portal. However, the download URL is an opaque file-store endpoint (not a versioned release page), the host is not a well-known public forge, and the binaries are closed-source executables installed as root-level system daemons with udev rules. The sha256sums are pinned, which mitigates substitution risk significantly. The concern is real but modest: closed-source vendor binaries from a semi-obscure vendor CDN endpoint, installed as privileged daemons. This is a legitimate vendor package with a non-standard distribution mechanism, not clearly malicious, but the executed-binary-from-unofficial-endpoint pattern warrants medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# $Id$
    
      2# Maintainer: jakob <grandchild@gmx.net>
    
      3# Contributor: Ido Rosen (ido) <ido@kernel.org>
    
      4# Contributor: Alexander Konarev (kale-ru) <AVKonarev@gmail.com>
    
      5# Contributor: Alexander Konarev <avkonarev@gmail.com.cc>
    
      6# Contributor: Andre Bartke (andre) <andrew@archlinux.us>
    
      7
    
      8pkgname=aksusbd
    
      9pkgver=8.21
    
      10pkgrel=2
    
      11_tarballname=Sentinel_LDK_RedHat_and_SuSE_RPM_Run-time_Installer
    
      12_rpm_pkgrel=1
    
      13_dl_hash=e4e1722f4c6a46e1ac2243f0c1e3ca5d
    
      14_dl_id=4a5e2d551bc9bc50e2af520f6e4bcb2b
    
      15pkgdesc="Sentinel AKSUSB daemon supporting Sentinel HASP, HASP HL, HASP4 and Hardlock keys."
    
      16arch=('i686' 'x86_64')
    
      17url="https://supportportal.thalesgroup.com/csm?sys_id=54303b92db852e00d298728dae96199c&id=csm_product"
    
      18license=('custom')
    
      19source=("${_tarballname}-${pkgver}.tar.gz::https://fdsext.gemalto.com/filesSN/Index/$_dl_hash?sid=$_dl_id"
    
      20        "service-usr-bin-i386.patch"
    
      21        "service-usr-bin-x86_64.patch"
    
      22        "LICENSE")
    
      23sha256sums=('83a07df5ed04be1d78e96bc70133c5b4adbdea5dc1f75b3aad5f734298450555'
    
      24            '75c02721799e3f2b498d67265201445c963063b331c61402205db2ad91e72ec3'
    
      25            'd63548bac27eab7cf4a524830643705bafc63349d2e3c5276a37d3382e5598ec'
    
      26            'c67d1383c94e2fda4c25a70d5a5d4a90d692586ff7977eb5e9e82139f85e22dd')
    
      27makedepends=('libarchive')
    
      28conflicts=('ehaspd')
    
      29options=('!strip')
    
      30
    
      31prepare(){
    
      32  cd $srcdir
    
      33
    
      34  # Extract RPM into $srcdir:
    
      35  bsdtar -xvf ${_tarballname}/${pkgname}-${pkgver}-${_rpm_pkgrel}.${CARCH}.rpm
    
      36
    
      37  # Change /usr/sbin/ to /usr/bin/
    
      38  patch -p1 < service-usr-bin-i386.patch
    
      39  patch -p1 < service-usr-bin-x86_64.patch
    
      40}
    
      41
    
      42package() {
    
      43  cd $srcdir
    
      44  if [ "${CARCH}" == "x86_64" ]; then
    
      45    arch_suffix=_${CARCH}
    
      46  fi
    
      47
    
      48  # Binaries:
    
      49  install -dm755 ${pkgdir}/usr/bin
    
      50  install -Dm755 ${srcdir}/usr/sbin/{aksusbd,hasplmd}${arch_suffix} \
    
      51      ${pkgdir}/usr/bin/
    
      52
    
      53  # udev rules:
    
      54  install -dm755 ${pkgdir}/usr/lib/udev/rules.d
    
      55  install -m644 ${srcdir}/etc/udev/rules.d/* \
    
      56      ${pkgdir}/usr/lib/udev/rules.d/
    
      57
    
      58  # systemd service
    
      59  install -dm755 ${pkgdir}/usr/lib/systemd/system/
    
      60  install -m644 ${srcdir}/var/hasplm/init/aksusbd${arch_suffix}.service \
    
      61      ${pkgdir}/usr/lib/systemd/system/aksusbd.service
    
      62  install -m644 ${srcdir}/var/hasplm/init/hasplmd${arch_suffix}.service \
    
      63      ${pkgdir}/usr/lib/systemd/system/hasplmd.service
    
      64
    
      65  # LICENSE and readme.html:
    
      66  install -Dm644 ${srcdir}/${_tarballname}/Readme.html \
    
      67      ${pkgdir}/usr/share/${pkgname}/readme.html
    
      68  install -Dm644 ${srcdir}/LICENSE \
    
      69      ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2