easycrypt-bin
MEDIUM
maintainer Herbrant
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt Debian binary from a non-standard, non-whitelisted host (repo.formosa-crypto.org), which is not the project's primary repository, creating a supply-chain risk if the host is compromised or malicious.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"${_pkgname}_${_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/e/easycrypt/${_pkgname}_${_debver}_amd64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Debian binary from a non-standard, non-whitelisted host (repo.formosa-crypto.org), which is not the project's primary repository, creating a supply-chain risk if the host is compromised or malicious.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Davide Carnemolla <herbrant@protonmail.com>
2
3
pkgname=easycrypt-bin
4
pkgver=2026.07
5
pkgrel=1
6
pkgdesc="Interactive framework for cryptographic proofs (EasyCrypt)"
7
arch=('x86_64')
8
url="https://github.com/EasyCrypt/easycrypt"
9
license=('MIT')
10
11
# Prebuilt, already-stripped binaries: skip strip/debug to avoid
12
# "gdb-add-index: No index was created" noise and an empty -debug package
13
options=('!strip' '!debug' '!lto')
14
15
# Runtime dependencies available in official repositories
16
depends=(
17
'ocaml'
18
'gmp'
19
'mpfr'
20
'why3-bin'
21
)
22
23
# Tools required to extract the Debian package
24
makedepends=('binutils' 'tar')
25
26
# Debian packages
27
_pkgname=easycrypt
28
29
# Debian version string used in the source URL
30
_debver="${pkgver}-1"
31
32
source=(
33
"${_pkgname}_${_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/e/easycrypt/${_pkgname}_${_debver}_amd64.deb"
34
)
35
36
sha256sums=('0a801ef86be76a6e46960c9f2a391e0915d88d53b46019c8a54f5717698c30cb')
37
38
package() {
39
cd "$srcdir"
40
41
# Extract the Debian package
42
ar x "${_pkgname}_${_debver}_amd64.deb"
43
44
# Extract the data archive (format may vary)
45
if [ -f data.tar.xz ]; then
46
tar -xf data.tar.xz -C "$pkgdir"
47
elif [ -f data.tar.gz ]; then
48
tar -xf data.tar.gz -C "$pkgdir"
49
elif [ -f data.tar.zst ]; then
50
tar -xf data.tar.zst -C "$pkgdir"
51
fi
52
53
# Remove Debian-specific changelog files
54
if [ -d "$pkgdir/usr/share/doc/$_pkgname" ]; then
55
rm -f "$pkgdir/usr/share/doc/$_pkgname/changelog.Debian"*
56
fi
57
58
# Install the MIT license under the package's own name.
59
# The Debian copyright file is empty, so use the real LICENSE shipped
60
# in the docs directory and fall back to copyright only if it is missing.
61
if [ -s "$pkgdir/usr/doc/$_pkgname/LICENSE" ]; then
62
install -Dm644 \
63
"$pkgdir/usr/doc/$_pkgname/LICENSE" \
64
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
65
elif [ -s "$pkgdir/usr/share/doc/$_pkgname/copyright" ]; then
66
install -Dm644 \
67
"$pkgdir/usr/share/doc/$_pkgname/copyright" \
68
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
69
fi
70
71
# Drop the empty Debian copyright stub
72
rm -f "$pkgdir/usr/share/doc/$_pkgname/copyright"
73
rmdir --ignore-fail-on-non-empty \
74
"$pkgdir/usr/share/doc/$_pkgname" "$pkgdir/usr/share/doc" 2>/dev/null || true
75
}
76
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |