atrust-bin

maintainer zxp19821005 · 4 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads a prebuilt .deb from a Sangfor-owned CDN (atrustcdn.sangfor.com) for a legitimate enterprise client; while the host is not a standard forge, it is plausibly official, and the package installs only verified files without executing remote code or exfiltrating data.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from a Sangfor-owned CDN (atrustcdn.sangfor.com) for a legitimate enterprise client; while the host is not a standard forge, it is plausibly official, and the package installs only verified files without executing remote code or exfiltrating data.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:32 "${pkgname%-bin}-${pkgver}.deb::https://atrustcdn.sangfor.com/standard/linux/${pkgver}/uos/amd64/${_pkgname}Installer_amd64.deb"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=atrust-bin
3_pkgname=aTrust
4_debname="cn.com.sangfor.${pkgname%-bin}"
5pkgver=2.5.16.30
6_electronversion=9
7pkgrel=4
8pkgdesc="Sangfor ssl sdp client.(Prebuilt version.Use system-wide electron)"
9arch=('x86_64')
10url="https://www.sangfor.com/"
11license=('LicenseRef-unknown')
12conflicts=("${pkgname%-bin}")
13provides=("${pkgname%-bin}=${pkgver}")
14depends=(
15 'libxss'
16 'qt5-base'
17 'java-runtime'
18 'gtk3'
19 'libxrandr'
20 'cairo'
21 'libxcomposite'
22 'at-spi2-core'
23 'alsa-lib'
24 'libxtst'
25 'nodejs'
26)
27options=(
28 '!strip'
29 '!emptydirs'
30)
31source=(
32 "${pkgname%-bin}-${pkgver}.deb::https://atrustcdn.sangfor.com/standard/linux/${pkgver}/uos/amd64/${_pkgname}Installer_amd64.deb"
33 "bsod_checker.js"
34 "${pkgname%-bin}.sh"
35)
36sha256sums=('aa8ba93532ae250dcab3d75d3b103fb01a93b97b49cbc6d9066c5ed1f70b75a6'
37 'ae82a7e0575d2ed8778134fc7d5c9c85001c955a7d26710a13101ff2363c53e6'
38 'dcd83c90f18567cab33c5734d2b55e0a5331e58634ea224054f7a186fd8b17bd')
39_check_electron_version() {
40 echo "Verifying Electron version..."
41 local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
42 local _main_exe=""
43 if [[ -n "${_app_dir}" ]]; then
44 _main_exe=$(find "${_app_dir}" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -n 1 | cut -d' ' -f2-)
45 fi
46 if [[ -n "${_main_exe}" ]]; then
47 local _elec_ver=$(strings "${_main_exe}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1 | head -n 1)
48 if [[ -n "${_elec_ver}" ]]; then
49 if [[ "${_elec_ver}" != "${_electronversion}" ]]; then
50 echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m"
51 else
52 echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
53 fi
54 fi
55 else
56 echo -e "\033[1;33mNote: Could not find Electron binary for version verification.\033[0m"
57 fi
58}
59prepare() {
60 sed -i -e "
61 s/@appname@/sangfor/g
62 s/@runpath@/${_pkgname}/g
63 s/@runname@/${_pkgname}Tray/g
64 " "${srcdir}/${pkgname%-bin}.sh"
65 bsdtar -xf "${srcdir}/data."*
66 _check_electron_version
67 sed -i -e "
68 s/\/usr\/share\/sangfor\/${_pkgname}\/${_pkgname}Tray/${pkgname%-bin}/g
69 s/Icon=${_pkgname}/Icon=${pkgname%-bin}/g
70 s/GenericName=sdp client/GenericName=${_pkgname}/g
71 /packagename/d
72 " "${srcdir}/usr/share/applications/${_debname}.desktop"
73 rm -rf \
74 "${srcdir}/usr/share/sangfor/${_pkgname}/resources/lib/libstdc++.so.6" \
75 "${srcdir}/usr/share/sangfor/${_pkgname}/resources/lib/libqxcb.so" \
76 "${srcdir}/usr/share/sangfor/${_pkgname}/resources/lib/libxcb.so.1" \
77 "${srcdir}/usr/share/sangfor/${_pkgname}/resources/lib/ libxcb-xinerama.so.0" \
78 "${srcdir}/usr/share/sangfor/${_pkgname}/uem/lib/libstdc++.so.6"
79 install -Dm644 "${srcdir}/bsod_checker.js" "${srcdir}/usr/share/sangfor/${_pkgname}/resources/app/src/service/bsod_checker.js"
80}
81package() {
82 install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
83 install -Dm755 -d "${pkgdir}/usr/share"
84 cp -Pr --no-preserve=ownership "${srcdir}/usr/share/sangfor" "${pkgdir}/usr/share"
85 install -Dm644 "${srcdir}/usr/lib/systemd/system/"* -t "${pkgdir}/usr/lib/systemd/system"
86 install -Dm644 "${srcdir}/usr/lib/systemd/user/"* -t "${pkgdir}/usr/lib/systemd/user"
87 install -Dm644 "${srcdir}/usr/share/pixmaps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
88 install -Dm644 "${srcdir}/usr/share/applications/${_debname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
89 install -Dm644 "${srcdir}/usr/share/sangfor/${_pkgname}/LICENSE"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
90 install -Dm755 -d "${pkgdir}/usr/share/sangfor/.${_pkgname}"
91 chown -R "${USER}:${USER}" "${pkgdir}/usr/share/sangfor/.${_pkgname}"
92}
93

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion