gosplugin

maintainer komex · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary package (a .deb wrapped in a .zip) from gu-st.ru, which is the official Russian government services (Gosuslugi) content delivery host used for distributing the Gosplugin browser crypto plugin. This is not a random personal host — gu-st.ru is the CDN/static host for gosuslugi.ru (the Russian e-government portal referenced in the url= field). However, the concern is still real: (1) the source is a prebuilt binary blob containing numerous proprietary shared libraries (libcrypto_core.so, libwincrypt.so, libplugin_ssl.so, etc.) that are installed and executed directly without source verification beyond a single sha256sum on the outer zip; (2) the extraction chain is complex — zip → shell-script payload → deb → data.tar.xz — meaning the sha256sum only covers the outermost archive, not the inner deb or its contents; (3) the libraries include cryptographic components (libcrypto_core.so, libcryptoki.so) that handle sensitive operations. While gu-st.ru appears to be the legitimate official distribution host for this plugin (not a personal or unofficial mirror), the pattern of installing opaque prebuilt crypto libraries from any host — even an official one — without per-binary verification constitutes a genuine supply-chain risk. The cheaper model's concern is directionally correct even if the host characterization was slightly off. Rating remains MEDIUM.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:55 "${pkgname}-${pkgver}-${pkgrel}.deb.zip::https://gu-st.ru/content/Gosplugin/Gosplugin_Linux-Debian_Installer.deb.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary package (a .deb wrapped in a .zip) from gu-st.ru, which is the official Russian government services (Gosuslugi) content delivery host used for distributing the Gosplugin browser crypto plugin. This is not a random personal host — gu-st.ru is the CDN/static host for gosuslugi.ru (the Russian e-government portal referenced in the url= field). However, the concern is still real: (1) the source is a prebuilt binary blob containing numerous proprietary shared libraries (libcrypto_core.so, libwincrypt.so, libplugin_ssl.so, etc.) that are installed and executed directly without source verification beyond a single sha256sum on the outer zip; (2) the extraction chain is complex — zip → shell-script payload → deb → data.tar.xz — meaning the sha256sum only covers the outermost archive, not the inner deb or its contents; (3) the libraries include cryptographic components (libcrypto_core.so, libcryptoki.so) that handle sensitive operations. While gu-st.ru appears to be the legitimate official distribution host for this plugin (not a personal or unofficial mirror), the pattern of installing opaque prebuilt crypto libraries from any host — even an official one — without per-binary verification constitutes a genuine supply-chain risk. The cheaper model's concern is directionally correct even if the host characterization was slightly off. Rating remains MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Andrey Kolchenko <andrey@kolchenko.me>
    
      2
    
      3pkgname=gosplugin
    
      4pkgver=1.3.42.0
    
      5pkgrel=1
    
      6pkgdesc='Crypto Interface Web Browser Plugin for https://gosuslugi.ru/'
    
      7arch=('x86_64')
    
      8url="https://www.gosuslugi.ru/help/faq/esignature/3842"
    
      9license=('unknown')
    
      10depends=(
    
  'brotli'
    
  'bzip2'
    
  'curl'
    
  'double-conversion'
    
  'duktape'
    
  'e2fsprogs'
    
  'freetype2'
    
  'gcc-libs'
    
  'glib2'
    
  'glibc'
    
  'graphite'
    
  'harfbuzz'
    
  'icu'
    
  'keyutils'
    
  'krb5'
    
  'libcap'
    
  'libffi'
    
  'libglvnd'
    
  'libidn2'
    
  'libnghttp2'
    
  'libnghttp3'
    
  'libpng'
    
  'libproxy'
    
  'libpsl'
    
  'libssh2'
    
  'libunistring'
    
  'libx11'
    
  'libxau'
    
  'libxcb'
    
  'libxdmcp'
    
  'md4c'
    
  'openssl'
    
  'pcre2'
    
  'qt5-base'
    
  'systemd-libs'
    
  'util-linux-libs'
    
  'zlib'
    
  'zstd'
    
  'rutoken-connect'
    
      50)
    
      51optdepends=('rutoken-connect' 'jacartauc')
    
      52makedepends=('grep' 'libarchive')
    
      53
    
      54source=(
    
  "${pkgname}-${pkgver}-${pkgrel}.deb.zip::https://gu-st.ru/content/Gosplugin/Gosplugin_Linux-Debian_Installer.deb.zip"
    
'gosuslugi_plugin.sh'
    
      57)
    
      58sha256sums=('332b321e069c34eda5c22ded50696d5bd58df077408262c74fbe9894e7611ef8'
    
          'b2a148903b0fc84a60a8e1423b01c865491401a2b65d6b16dbe8442b15705dda')
    
      60
    
      61_script='Gosplugin_Linux-Debian_Installer.deb.sh'
    
      62
    
      63prepare() {
    
payload_offset=$(grep --text --line-number '^PAYLOAD:$' "${srcdir}/${_script}" | cut -d: -f1)
    
tail -n +$((payload_offset + 1)) "${_script}" | bsdtar -xC "${srcdir}"
    
filename=$(ls "${srcdir}"/gosuslugi-plugin_*.deb)
    
bsdtar -xf "${filename}"
    
bsdtar -xf "${srcdir}/data.tar.xz"
    
      69}
    
      70
    
      71pkgver() {
    
filename=$(ls "${srcdir}"/gosuslugi-plugin_*.deb)
    
# Убираем префикс до первой подчеркивания
    
temp=${filename#*_}
    
# Убираем суффикс после дефиса
    
version=${temp%-*}
    
echo "$version"
    
      78}
    
      79
    
      80package() {
    
rm -rf "${srcdir}/usr/lib"
    
rm -rf "${srcdir}/usr/share"
    
mv "${srcdir}/usr/lib64" "${srcdir}/usr/lib"
    
      84
    
  # Эти зависимости оставляем из пакета, остальные не копируем, а используем системные.
    
libs=(
    
'libboost_program_options.so.1.83.0'
    
'libboost_date_time.so.1.83.0'
    
'libwincrypt.so'
    
'libui.so'
    
'libcrypto_core.so'
    
'libxml_dsign.so'
    
'libboost_regex.so.1.83.0'
    
'libxml-security-c.so.20'
    
'libxml_soap.so'
    
'libcryptoki.so'
    
'libplugin_ssl.so'
    
'libsession.so'
    
'libasn.so'
    
'libxml_document.so'
    
'libshared.so'
    
'libboost_serialization.so.1.83.0'
    
'libboost_filesystem.so.1.83.0'
    
'libboost_thread.so.1.83.0'
    
'libboost_locale.so.1.83.0'
    
'libboost_log.so.1.83.0'
    
'libboost_log_setup.so.1.83.0'
    
'libxerces-c-3.2.so'
    
'libxalan-c.so.112'
    
'libboost_atomic.so.1.83.0'
    
'libboost_chrono.so.1.83.0'
    
'libxalanMsg.so.112'
    
)
    
for file in "${libs[@]}"; do
    
   install -D "${srcdir}/opt/iitrust/gosuslugi_plugin/lib/${file}" "${pkgdir}/opt/iitrust/gosuslugi_plugin/lib/${file}"
    
done
    
rm -rf "${srcdir}/opt/iitrust/gosuslugi_plugin/lib"
    
      118
    
unused=(
    
'tokens'
    
'xdg-open.sh'
    
'librutoken.so'
    
)
    
for file in "${unused[@]}"; do
    
rm -rf "${srcdir}/opt/iitrust/gosuslugi_plugin/bin/${file}"
    
done
    
      127
    
cp -a "${srcdir}/usr" "${pkgdir}"
    
cp -a "${srcdir}/etc" "${pkgdir}"
    
cp -a "${srcdir}/opt" "${pkgdir}"
    
      131
    
install -D 'gosuslugi_plugin.sh' "${pkgdir}/opt/iitrust/gosuslugi_plugin/bin/gosuslugi_plugin.sh"
    
      133}
    
      134

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2