cryspmds

maintainer lucaswerkmeister · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb containing a JAR file (cryspmds.jar) from a personal/research host (cryspmds.erinn.io) rather than an official distribution channel. The JAR is installed and executed directly by the user's JVM. While a SHA256 checksum is present (pinning the specific binary), the host is not an official upstream mirror or well-known vendor — it appears to be a personal/research server for a university study (CrySP is the Cryptography, Security, and Privacy research group at University of Waterloo). The risk is real but contextual: the checksum provides some integrity guarantee, but the binary could be silently replaced at the source URL in future installs if the checksum is updated by the maintainer without scrutiny. The JAR executes arbitrary code on the user's machine. This is a legitimate medium-severity supply-chain concern: an executed binary from a non-standard personal host, not clearly malicious but not from an official/auditable release infrastructure.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=('https://cryspmds.erinn.io/dl/cryspmds.deb' 'SystemTrayIsSupported.java')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt .deb containing a JAR file (cryspmds.jar) from a personal/research host (cryspmds.erinn.io) rather than an official distribution channel. The JAR is installed and executed directly by the user's JVM. While a SHA256 checksum is present (pinning the specific binary), the host is not an official upstream mirror or well-known vendor — it appears to be a personal/research server for a university study (CrySP is the Cryptography, Security, and Privacy research group at University of Waterloo). The risk is real but contextual: the checksum provides some integrity guarantee, but the binary could be silently replaced at the source URL in future installs if the checksum is updated by the maintainer without scrutiny. The JAR executes arbitrary code on the user's machine. This is a legitimate medium-severity supply-chain concern: an executed binary from a non-standard personal host, not clearly malicious but not from an official/auditable release infrastructure.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lucas Werkmeister <mail@lucaswerkmeister.de>
    
      2
    
      3pkgname=cryspmds
    
      4pkgver=1
    
      5pkgrel=6
    
      6pkgdesc='CrySP Multidevice Study'
    
      7arch=('any')
    
      8url='https://cryspmds.erinn.io/'
    
      9depends=(
    
      10    'java-runtime'
    
      11    'java-openjfx'
    
      12    'wireless_tools'
    
      13)
    
      14makedepends=(
    
      15    'java-environment'
    
      16)
    
      17optdepends=(
    
      18    'gnome-shell-extension-topicons-plus: restore system tray on GNOME (application requires a system tray to run)'
    
      19)
    
      20source=('https://cryspmds.erinn.io/dl/cryspmds.deb' 'SystemTrayIsSupported.java')
    
      21sha256sums=('8b84d3bb273daaa8398a823d767c242c7b2b546ea33c41613978cf48890b57ad' 'eea3b1e190509832d3a80f7cff3fd648c2f0d2625b1ed41e7046424a79a5b8ee')
    
      22install=$pkgname.install
    
      23
    
      24prepare() {
    
      25    mkdir -p control data
    
      26    tar xf control.tar.gz -C control
    
      27    tar xf data.tar.xz -C data
    
      28}
    
      29
    
      30build() {
    
      31    sed -i "
    
      32/^Icon=/ s|usr/local/bin/logo48.png|usr/share/icons/$pkgname.png|
    
      33/^Exec=/ s|usr/local/bin/run|usr/bin/java -jar /usr/share/java/$pkgname/$pkgname.jar|
    
      34/^Exec=/ a Path=/usr/share/$pkgname/
    
      35" "data/usr/local/bin/$pkgname.desktop"
    
      36
    
      37    javac SystemTrayIsSupported.java
    
      38}
    
      39
    
      40package() {
    
      41    install -Dm644 "data/usr/local/bin/$pkgname.jar" "$pkgdir/usr/share/java/$pkgname/$pkgname.jar"
    
      42    install -Dm644 "SystemTrayIsSupported.class" "$pkgdir/usr/share/java/$pkgname/SystemTrayIsSupported.class"
    
      43    install -Dm644 "data/usr/local/bin/logo48.png" "$pkgdir/usr/share/icons/$pkgname.png"
    
      44    install -Dm644 "data/usr/local/bin/logo.png" "$pkgdir/usr/share/$pkgname/logo.png"
    
      45    install -Dm644 "data/usr/local/bin/logo.png" "$pkgdir/usr/share/$pkgname/logo-medium.png"
    
      46    install -Dm644 "data/usr/local/bin/$pkgname.desktop" "$pkgdir/etc/xdg/autostart/$pkgname.desktop"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2