easycrypt-bin

maintainer Herbrant · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Debian binary (.deb) from repo.formosa-crypto.org, which is not an official distribution channel (GitHub releases, official distro repos, etc.) but rather a third-party Debian repository operated by the Formosa-Crypto project. The binary is then extracted and installed directly onto the system. While a sha256sum is pinned (mitigating casual tampering), the host is not the upstream GitHub project itself, and the key question is whether repo.formosa-crypto.org is a trustworthy, project-controlled host. The Formosa-Crypto project (https://github.com/formosa-crypto) is a legitimate academic cryptography project closely related to EasyCrypt, and this Debian repo appears to be their official distribution channel for EasyCrypt binaries. However, it remains a third-party binary host rather than a GitHub release artifact, and the sha256sum provides only integrity, not authenticity (no GPG signature verification). This is a real, if modest, supply-chain concern: a prebuilt binary from a non-GitHub host with no signature check. The risk is real but not clearly malicious, consistent with a medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "${_pkgname}_${_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/e/easycrypt/${_pkgname}_${_debver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Debian binary (.deb) from repo.formosa-crypto.org, which is not an official distribution channel (GitHub releases, official distro repos, etc.) but rather a third-party Debian repository operated by the Formosa-Crypto project. The binary is then extracted and installed directly onto the system. While a sha256sum is pinned (mitigating casual tampering), the host is not the upstream GitHub project itself, and the key question is whether repo.formosa-crypto.org is a trustworthy, project-controlled host. The Formosa-Crypto project (https://github.com/formosa-crypto) is a legitimate academic cryptography project closely related to EasyCrypt, and this Debian repo appears to be their official distribution channel for EasyCrypt binaries. However, it remains a third-party binary host rather than a GitHub release artifact, and the sha256sum provides only integrity, not authenticity (no GPG signature verification). This is a real, if modest, supply-chain concern: a prebuilt binary from a non-GitHub host with no signature check. The risk is real but not clearly malicious, consistent with a medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Davide Carnemolla <herbrant@protonmail.com>
    
      2
    
      3pkgname=easycrypt-bin
    
      4pkgver=2026.02
    
      5pkgrel=1
    
      6pkgdesc="Interactive framework for cryptographic proofs (EasyCrypt)"
    
      7arch=('x86_64')
    
      8url="https://github.com/EasyCrypt/easycrypt"
    
      9license=('MIT')
    
      10
    
      11# Runtime dependencies available in official repositories
    
      12depends=(
    
      13  'ocaml'
    
      14  'gmp'
    
      15  'mpfr'
    
      16  'why3-bin'
    
      17)
    
      18
    
      19# Tools required to extract the Debian package
    
      20makedepends=('binutils' 'tar')
    
      21
    
      22# Debian packages
    
      23_pkgname=easycrypt
    
      24
    
      25# Debian version string used in the source URL
    
      26_debver="${pkgver}-1"
    
      27
    
      28source=(
    
      29  "${_pkgname}_${_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/e/easycrypt/${_pkgname}_${_debver}_amd64.deb"
    
      30)
    
      31
    
      32sha256sums=('f4d9fa9b8a73d0d1d2fef3da242608654491c881fe9005a3f51f68b644f75bfd')
    
      33
    
      34package() {
    
      35  cd "$srcdir"
    
      36
    
      37  # Extract the Debian package
    
      38  ar x "${_pkgname}_${_debver}_amd64.deb"
    
      39
    
      40  # Extract the data archive (format may vary)
    
      41  if [ -f data.tar.xz ]; then
    
      42    tar -xf data.tar.xz -C "$pkgdir"
    
      43  elif [ -f data.tar.gz ]; then
    
      44    tar -xf data.tar.gz -C "$pkgdir"
    
      45  elif [ -f data.tar.zst ]; then
    
      46    tar -xf data.tar.zst -C "$pkgdir"
    
      47  fi
    
      48
    
      49  # Remove Debian-specific changelog files
    
      50  if [ -d "$pkgdir/usr/share/doc/$_pkgname" ]; then
    
      51    rm -f "$pkgdir/usr/share/doc/$_pkgname/changelog.Debian"*
    
      52  fi
    
      53
    
      54  # Install license file if provided
    
      55  if [ -f "$pkgdir/usr/share/doc/$_pkgname/copyright" ]; then
    
      56    install -Dm644 \
    
      57      "$pkgdir/usr/share/doc/$_pkgname/copyright" \
    
      58      "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      59  fi
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2