jasmin-compiler-bin

maintainer Herbrant · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs prebuilt binary .deb packages (a compiler and a library) from repo.formosa-crypto.org, which is the official Debian repository maintained by the Formosa Crypto project (the upstream maintainers of the Jasmin compiler). This is not a random personal host — Formosa Crypto is a well-known academic/industry cryptography project and this appears to be their official package distribution channel. However, it is still a non-mainstream, project-specific binary host rather than a widely audited mirror (like GitHub Releases or a major distro repo), and the packages are executed binaries/libraries installed directly into the system. The sha256sums are pinned, which mitigates substitution risk at download time, but does not protect against a compromised upstream host at the time the sums were recorded. The risk is a real but low-probability supply-chain concern: if repo.formosa-crypto.org were compromised, malicious binaries could be distributed. This fits the medium category — prebuilt binaries from an unofficial (though plausibly legitimate) host with pinned checksums.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "${_pkgname}_${_jasmin_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/j/${_pkgname}/${_pkgname}_${_jasmin_debver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and installs prebuilt binary .deb packages (a compiler and a library) from repo.formosa-crypto.org, which is the official Debian repository maintained by the Formosa Crypto project (the upstream maintainers of the Jasmin compiler). This is not a random personal host — Formosa Crypto is a well-known academic/industry cryptography project and this appears to be their official package distribution channel. However, it is still a non-mainstream, project-specific binary host rather than a widely audited mirror (like GitHub Releases or a major distro repo), and the packages are executed binaries/libraries installed directly into the system. The sha256sums are pinned, which mitigates substitution risk at download time, but does not protect against a compromised upstream host at the time the sums were recorded. The risk is a real but low-probability supply-chain concern: if repo.formosa-crypto.org were compromised, malicious binaries could be distributed. This fits the medium category — prebuilt binaries from an unofficial (though plausibly legitimate) host with pinned checksums.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Davide Carnemolla <herbrant@protonmail.com>
    
      2
    
      3pkgname=jasmin-compiler-bin
    
      4pkgver=2026.03.0
    
      5pkgrel=1
    
      6pkgdesc="Compiler for the Jasmin language for high-assurance and high-speed cryptography"
    
      7arch=('x86_64')
    
      8url="https://github.com/jasmin-lang/jasmin"
    
      9license=('MIT')
    
      10
    
      11depends=(
    
      12  'ocaml'
    
      13  'gmp'
    
      14  'mpfr'
    
      15  'ppl'
    
      16)
    
      17
    
      18makedepends=('binutils' 'tar')
    
      19
    
      20# Debian packages
    
      21_pkgname="jasmin-compiler"
    
      22
    
      23# Debian package versions
    
      24_jasmin_debver="${pkgver}-1"
    
      25_apron_debver="0.9.15-1"
    
      26
    
      27source=(
    
      28  "${_pkgname}_${_jasmin_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/j/${_pkgname}/${_pkgname}_${_jasmin_debver}_amd64.deb"
    
      29  "libapron_${_apron_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/a/apron/libapron_${_apron_debver}_amd64.deb"
    
      30)
    
      31
    
      32sha256sums=('419e0287e6ae4188552288e837ecd03e926a8cd19910778bacda40507e87b7a5' 'c32aa0507c4afa33063bc8bb7bf64c1782684b723301ae35061736363a4ee555')
    
      33
    
      34package() {
    
      35  cd "$srcdir"
    
      36
    
      37  # Extract Jasmin compiler
    
      38  ar x "${_pkgname}_${_jasmin_debver}_amd64.deb"
    
      39  for f in data.tar.*; do
    
      40    [ -f "$f" ] && tar -xf "$f" -C "$pkgdir"
    
      41  done
    
      42
    
      43  # Extract Apron libraries
    
      44  ar x "libapron_${_apron_debver}_amd64.deb"
    
      45  for f in data.tar.*; do
    
      46    [ -f "$f" ] && tar -xf "$f" -C "$pkgdir"
    
      47  done
    
      48
    
      49  # Remove Debian-specific changelog files
    
      50  if [ -d "$pkgdir/usr/share/doc/$_pkgname" ]; then
    
      51    rm -f "$pkgdir/usr/share/doc/$_pkgname/changelog.Debian"*
    
      52  fi
    
      53
    
      54  # Install license file if present
    
      55  if [ -f "$pkgdir/usr/share/doc/$_pkgname/copyright" ]; then
    
      56    install -Dm644 \
    
      57      "$pkgdir/usr/share/doc/$_pkgname/copyright" \
    
      58      "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      59  fi
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2