embridge-bin

maintainer amish · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary (.deb extracted from a zip) from resources.emudhra.com, which is a subdomain of emudhra.com — the same company that owns the product domain embridge.emudhra.com. This is not a random personal host; it appears to be eMudhra's own CDN/resource server. However, the URL uses 'latest' in the path (resources.emudhra.com/hs/Ubuntu/latest/emBridge.zip), meaning the actual content can change without the sha512sum catching it if the maintainer updates the checksum to match whatever 'latest' serves. The sha512sum is pinned to a specific download at package build time, which mitigates the 'latest' concern for end users installing this exact PKGBUILD version. The binary is a closed-source .NET/ASP.NET Core application (emBridge) that runs as a local HTTPS service on port 26769 for crypto token access — this is a legitimate PKI middleware product from eMudhra, an Indian CA. The real concern is: (1) prebuilt binary from a vendor subdomain with no source build option, and (2) the 'latest' URL pattern means the sha512sum could silently become stale if the vendor updates the binary without the maintainer noticing. These are standard medium-severity supply-chain concerns for binary AUR packages, not evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("emBridge-${pkgver}.zip::https://resources.emudhra.com/hs/Ubuntu/latest/emBridge.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary (.deb extracted from a zip) from resources.emudhra.com, which is a subdomain of emudhra.com — the same company that owns the product domain embridge.emudhra.com. This is not a random personal host; it appears to be eMudhra's own CDN/resource server. However, the URL uses 'latest' in the path (resources.emudhra.com/hs/Ubuntu/latest/emBridge.zip), meaning the actual content can change without the sha512sum catching it if the maintainer updates the checksum to match whatever 'latest' serves. The sha512sum is pinned to a specific download at package build time, which mitigates the 'latest' concern for end users installing this exact PKGBUILD version. The binary is a closed-source .NET/ASP.NET Core application (emBridge) that runs as a local HTTPS service on port 26769 for crypto token access — this is a legitimate PKI middleware product from eMudhra, an Indian CA. The real concern is: (1) prebuilt binary from a vendor subdomain with no source build option, and (2) the 'latest' URL pattern means the sha512sum could silently become stale if the vendor updates the binary without the maintainer noticing. These are standard medium-severity supply-chain concerns for binary AUR packages, not evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Amish <contact at via dot aur>
    
      2pkgname=embridge-bin
    
      3pkgver=3.3.0.2
    
      4pkgrel=1
    
      5pkgdesc='emBridge Service to access crypto tokens'
    
      6arch=(x86_64)
    
      7url='https://embridge.emudhra.com'
    
      8license=('custom')
    
      9depends=('ca-certificates' 'curl' 'libunwind' 'lttng-ust2.12' 'numactl' 'openssl' 'icu')
    
      10source=("emBridge-${pkgver}.zip::https://resources.emudhra.com/hs/Ubuntu/latest/emBridge.zip")
    
      11sha512sums=('0f053fddabb8b17b4e23bee2be6f06597294af7a4ea05255ec6b894968d6af8b2a75b7b31012d4b1ddcbb5515d79823301a03e74d8e3bfb72dcd74c2cf1aa542')
    
      12options=('!debug' 'libtool' 'staticlibs' '!strip')
    
      13
    
      14package() {
    
      15    cd "${srcdir}"
    
      16    msg2 "Extracting the emBridge-v${pkgver}.deb"
    
      17    ar po "emBridge-v${pkgver}.deb" data.tar.xz | bsdtar -C "${pkgdir}" -xf - --no-same-owner
    
      18    find "${pkgdir}/opt" -type d -exec chmod 755 {} \+
    
      19    cd "${pkgdir}/opt/eMudhra/emBridge"
    
      20    find . -type f -exec chmod 644 {} \+
    
      21    find . -name '*.dll' -exec chmod 755 {} \+
    
      22#    find . -name '*.sh' -exec chmod 755 {} \+
    
      23    find . -name '*.so' -exec chmod 755 {} \+
    
      24    chmod 755 createdump emBridge
    
      25    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/embridge" << 'EOF'
    
      26#!/bin/bash
    
      27mkdir -p ~/Documents/embridge
    
      28cd ~/Documents/embridge
    
      29export ASPNETCORE_ENVIRONMENT="Production"
    
      30export ASPNETCORE_HTTPS_PORT=26769
    
      31export ASPNETCORE_URLS="https://localhost.emudhra.com:26769"
    
      32export CLR_ICU_VERSION_OVERRIDE=$(icu-config --version)
    
      33/opt/eMudhra/emBridge/emBridge
    
      34EOF
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2