easycrypt-bin

MEDIUM

maintainer Herbrant 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt Debian binary from a non-standard, non-project-owned host (repo.formosa-crypto.org), which presents a supply-chain risk if the host is compromised or controlled by an unrelated party.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "${_pkgname}_${_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/e/easycrypt/${_pkgname}_${_debver}_amd64.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Debian binary from a non-standard, non-project-owned host (repo.formosa-crypto.org), which presents a supply-chain risk if the host is compromised or controlled by an unrelated party.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Davide Carnemolla <herbrant@protonmail.com>
    
      2
    
      3pkgname=easycrypt-bin
    
      4pkgver=2026.09
    
      5pkgrel=1
    
      6pkgdesc="Interactive framework for cryptographic proofs (EasyCrypt)"
    
      7arch=('x86_64')
    
      8url="https://github.com/EasyCrypt/easycrypt"
    
      9license=('MIT')
    
      10
    
      11# Prebuilt, already-stripped binaries: skip strip/debug to avoid
    
      12# "gdb-add-index: No index was created" noise and an empty -debug package
    
      13options=('!strip' '!debug' '!lto')
    
      14
    
      15# Runtime dependencies available in official repositories
    
      16depends=(
    
      17  'ocaml'
    
      18  'gmp'
    
      19  'mpfr'
    
      20  'why3-bin'
    
      21)
    
      22
    
      23# Tools required to extract the Debian package
    
      24makedepends=('binutils' 'tar')
    
      25
    
      26# Debian packages
    
      27_pkgname=easycrypt
    
      28
    
      29# Debian version string used in the source URL
    
      30_debver="${pkgver}-1"
    
      31
    
      32source=(
    
      33  "${_pkgname}_${_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/e/easycrypt/${_pkgname}_${_debver}_amd64.deb"
    
      34  "easycrypt.sh"
    
      35)
    
      36
    
      37sha256sums=('a5a19fccaaecd6225ee972eed23bce2b81efe6007300f3a8c644f013ad0c0982'
    
      38            'f389fa8ea5c44e872069cfac7b2320b1108442b3efbfc93dda8a9c8d9bca8ed3')
    
      39
    
      40package() {
    
      41  cd "$srcdir"
    
      42
    
      43  # Extract the Debian package
    
      44  ar x "${_pkgname}_${_debver}_amd64.deb"
    
      45
    
      46  # Extract the data archive (format may vary)
    
      47  if [ -f data.tar.xz ]; then
    
      48    tar -xf data.tar.xz -C "$pkgdir"
    
      49  elif [ -f data.tar.gz ]; then
    
      50    tar -xf data.tar.gz -C "$pkgdir"
    
      51  elif [ -f data.tar.zst ]; then
    
      52    tar -xf data.tar.zst -C "$pkgdir"
    
      53  fi
    
      54
    
      55  # The binary has why3server's path baked in under Debian's OCaml 5.3.0
    
      56  # libdir, while why3-bin installs it elsewhere. Install the real binary
    
      57  # behind a wrapper that sets WHY3LIB to a directory linking why3-bin's
    
      58  # helper executables.
    
      59  local _why3lib
    
      60  _why3lib="$(why3 --print-libdir)"
    
      61  mv "$pkgdir/usr/bin/easycrypt" "$pkgdir/usr/lib/easycrypt/easycrypt"
    
      62  install -Dm755 easycrypt.sh "$pkgdir/usr/bin/easycrypt"
    
      63  install -dm755 "$pkgdir/usr/lib/easycrypt/why3lib"
    
      64  ln -s "$_why3lib/why3server" "$pkgdir/usr/lib/easycrypt/why3lib/why3server"
    
      65  ln -s "$_why3lib/why3cpulimit" "$pkgdir/usr/lib/easycrypt/why3lib/why3cpulimit"
    
      66
    
      67  # Remove Debian-specific changelog files
    
      68  if [ -d "$pkgdir/usr/share/doc/$_pkgname" ]; then
    
      69    rm -f "$pkgdir/usr/share/doc/$_pkgname/changelog.Debian"*
    
      70  fi
    
      71
    
      72  # Install the MIT license under the package's own name.
    
      73  # The Debian copyright file is empty, so use the real LICENSE shipped
    
      74  # in the docs directory and fall back to copyright only if it is missing.
    
      75  if [ -s "$pkgdir/usr/doc/$_pkgname/LICENSE" ]; then
    
      76    install -Dm644 \
    
      77      "$pkgdir/usr/doc/$_pkgname/LICENSE" \
    
      78      "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      79  elif [ -s "$pkgdir/usr/share/doc/$_pkgname/copyright" ]; then
    
      80    install -Dm644 \
    
      81      "$pkgdir/usr/share/doc/$_pkgname/copyright" \
    
      82      "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      83  fi
    
      84
    
      85  # Drop the empty Debian copyright stub
    
      86  rm -f "$pkgdir/usr/share/doc/$_pkgname/copyright"
    
      87  rmdir --ignore-fail-on-non-empty \
    
      88    "$pkgdir/usr/share/doc/$_pkgname" "$pkgdir/usr/share/doc" 2>/dev/null || true
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2