boringssl-git

maintainer alicejohansson · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The build() function executes 'sudo "$srcdir/hasher"' - running an arbitrary local script with root privileges via sudo. The 'hasher' file is listed as a source with 'SKIP' for its checksum, meaning its contents are never verified. There is no git repository listed as a source (the PKGBUILD references '$srcdir/${pkgname%-git}' but no git+https:// source is declared), making this PKGBUILD broken in terms of actually building BoringSSL. More critically, the 'hasher' script with an unverified checksum being executed as root is a genuine high-severity concern: any attacker who controls the AUR snapshot can put arbitrary commands in 'hasher' and have them run as root on the builder's machine. The use of sudo inside a PKGBUILD is itself a serious red flag - makepkg explicitly warns against this pattern. Combined with SKIP checksums and the orphan/re-adoption history, this is a real attack vector rather than a false positive.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The build() function executes 'sudo "$srcdir/hasher"' - running an arbitrary local script with root privileges via sudo. The 'hasher' file is listed as a source with 'SKIP' for its checksum, meaning its contents are never verified. There is no git repository listed as a source (the PKGBUILD references '$srcdir/${pkgname%-git}' but no git+https:// source is declared), making this PKGBUILD broken in terms of actually building BoringSSL. More critically, the 'hasher' script with an unverified checksum being executed as root is a genuine high-severity concern: any attacker who controls the AUR snapshot can put arbitrary commands in 'hasher' and have them run as root on the builder's machine. The use of sudo inside a PKGBUILD is itself a serious red flag - makepkg explicitly warns against this pattern. Combined with SKIP checksums and the orphan/re-adoption history, this is a real attack vector rather than a false positive.

PKGBUILD

      1# Maintainer: Edmund Lodewijks <edmund AT proteamail.com>
    
      2# Contributor: Vincent Bernardoff <vb AT luminar.eu.org>
    
      3
    
      4# Note: This package installs to /usr/lib/boringssl and /usr/include/boringssl
    
      5# to avoid conflicts with system OpenSSL. To build software against BoringSSL,
    
      6# specify the library and include paths explicitly during configuration.
    
      7
    
      8pkgname=boringssl-git
    
      9_pkgname=boringssl
    
      10pkgver=0.20260211.0.14.gc0da0e7623
    
      11pkgrel=1
    
      12pkgdesc="BoringSSL is a fork of OpenSSL that is designed to meet Google's needs"
    
      13arch=(arm armv6h armv7h aarch64 x86_64 i686)
    
      14url="https://boringssl.googlesource.com/boringssl"
    
      15license=('Apache-2.0')
    
      16depends=('gcc-libs' 'glibc')
    
      17makedepends=('git' 'cmake' 'go' 'perl' 'ninja' 'patchelf')
    
      18provides=("${pkgname%-git}")
    
      19conflicts=("${pkgname%-git}")
    
      20source=(
    
      21  'hasher'
    
      22)
    
      23b2sums=(
    
      24  'SKIP'
    
      25)
    
      26
    
      27pkgver() {
    
      28    cd "$srcdir/${pkgname%-git}"
    
      29    git describe --always --dirty --tags | sed -e 's/-/./g'
    
      30}
    
      31
    
      32prepare() {
    
      33    cd "$srcdir/${pkgname%-git}"
    
      34
    
      35    export CXXFLAGS="${CXXFLAGS} -Wno-error=array-bounds"
    
      36
    
      37    mkdir -p build
    
      38    cd build
    
      39    cmake \
    
      40        -DCMAKE_EXE_LINKER_FLAGS="$LDFLAGS" \
    
      41        -DCMAKE_SHARED_LINKER_FLAGS="$LDFLAGS" \
    
      42        -DCMAKE_BUILD_TYPE=RelWithDebInfo \
    
      43        -DCMAKE_INSTALL_PREFIX=/usr \
    
      44        -DCMAKE_INSTALL_LIBDIR=lib/$_pkgname \
    
      45        -DCMAKE_INSTALL_BINDIR=bin/$_pkgname \
    
      46        -DCMAKE_INSTALL_INCLUDEDIR=include/$_pkgname \
    
      47        -DCMAKE_INSTALL_RPATH='$ORIGIN/../lib/boringssl' \
    
      48        -DBUILD_SHARED_LIBS=1 \
    
      49        -GNinja ..
    
      50}
    
      51
    
      52build() {
    
      53    sudo "$srcdir/hasher"
    
      54    cd "$srcdir/${pkgname%-git}"
    
      55    ninja -C build
    
      56}
    
      57
    
      58check() {
    
      59    cd "$srcdir/${pkgname%-git}"
    
      60    ninja -C build run_tests
    
      61}
    
      62
    
      63package() {
    
      64    cd "$srcdir/$_pkgname"
    
      65
    
      66    # Documentation
    
      67    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      68    for i in *.md ; do
    
      69        install -Dm644 "$i" "$pkgdir/usr/share/doc/$_pkgname/$i"
    
      70    done
    
      71
    
      72    # Libraries: Put them all under /usr/lib/boringssl/
    
      73    install -Dm755 build/libcrypto.so "$pkgdir/usr/lib/$_pkgname/libcrypto.so"
    
      74    install -Dm755 build/libssl.so "$pkgdir/usr/lib/$_pkgname/libssl.so"
    
      75    install -Dm755 build/libdecrepit.so "$pkgdir/usr/lib/$_pkgname/libdecrepit.so"
    
      76    install -Dm755 build/libpki.so "$pkgdir/usr/lib/$_pkgname/libpki.so"
    
      77
    
      78    # Headers: Put them under /usr/include/boringssl/
    
      79    # BoringSSL uses include/openssl subdirectory for compatibility
    
      80    install -d "$pkgdir/usr/include/$_pkgname"
    
      81    cp -r include/openssl "$pkgdir/usr/include/$_pkgname/"
    
      82
    
      83    # Binary: Put it under /usr/bin/boringssl/
    
      84    install -Dm755 build/bssl "$pkgdir/usr/bin/$_pkgname/bssl"
    
      85
    
      86    echo "Fixing RPATHs with $ORIGIN..."
    
      87
    
      88    # Fix the binary
    
      89    patchelf --set-rpath '$ORIGIN/../../lib/boringssl' "$pkgdir/usr/bin/$_pkgname/bssl"
    
      90
    
      91    # Fix the libraries
    
      92    find "$pkgdir/usr/lib/$_pkgname" -type f -name "*.so" -exec \
    
      93        patchelf --set-rpath '$ORIGIN' {} +
    
      94
    
      95    # Generate pkg-config file so other apps can find this BoringSSL
    
      96    install -d "$pkgdir/usr/lib/pkgconfig"
    
      97    cat <<EOF >"$pkgdir/usr/lib/pkgconfig/boringssl.pc"
    
      98prefix=/usr
    
      99exec_prefix=\${prefix}
    
      100libdir=\${prefix}/lib/$_pkgname
    
      101includedir=\${prefix}/include/$_pkgname
    
      102
    
      103Name: BoringSSL
    
      104Description: BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
    
      105Version: ${pkgver}
    
      106Libs: -L\${libdir} -lssl -lcrypto
    
      107Cflags: -I\${includedir}
    
      108EOF
    
      109}
    
      110
    
      111
    
      112

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -17,8 +17,12 @@
 makedepends=('git' 'cmake' 'go' 'perl' 'ninja' 'patchelf')
 provides=("${pkgname%-git}")
 conflicts=("${pkgname%-git}")
-source=('git+https://boringssl.googlesource.com/boringssl')
-b2sums=('SKIP')
+source=(
+  'hasher'
+)
+b2sums=(
+  'SKIP'
+)
 
 pkgver() {
     cd "$srcdir/${pkgname%-git}"
@@ -46,6 +50,7 @@
 }
 
 build() {
+    sudo "$srcdir/hasher"
     cd "$srcdir/${pkgname%-git}"
     ninja -C build
 }
@@ -104,3 +109,4 @@
 }
 
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1