libjasmin-easycrypt-bin

maintainer Herbrant · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Debian binary package from repo.formosa-crypto.org, which is not a well-known official distribution channel. The Jasmin compiler project (jasmin-lang) is a legitimate academic/research project, and formosa-crypto.org is associated with the Formosa Project (a research initiative for formally verified cryptographic software), making this a plausible official or semi-official host. However, it is not the primary upstream GitHub release host, and the package installs EasyCrypt library files (likely compiled OCaml or similar) extracted directly from a Debian binary without any source build. A sha256sum is provided, which mitigates tampering risk for the specific artifact, but does not address the trustworthiness of the host itself. Since this installs executed/loaded library code from a non-primary, non-mainstream host, the medium rating is appropriate — it is not clearly malicious, but represents a real supply-chain concern if the host were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "${_pkgname}_${_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/j/jasmin-compiler/${_pkgname}_${_debver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Debian binary package from repo.formosa-crypto.org, which is not a well-known official distribution channel. The Jasmin compiler project (jasmin-lang) is a legitimate academic/research project, and formosa-crypto.org is associated with the Formosa Project (a research initiative for formally verified cryptographic software), making this a plausible official or semi-official host. However, it is not the primary upstream GitHub release host, and the package installs EasyCrypt library files (likely compiled OCaml or similar) extracted directly from a Debian binary without any source build. A sha256sum is provided, which mitigates tampering risk for the specific artifact, but does not address the trustworthiness of the host itself. Since this installs executed/loaded library code from a non-primary, non-mainstream host, the medium rating is appropriate — it is not clearly malicious, but represents a real supply-chain concern if the host were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Davide Carnemolla <herbrant@protonmail.com>
    
      2
    
      3pkgname=libjasmin-easycrypt-bin
    
      4pkgver=2026.03.0
    
      5pkgrel=1
    
      6pkgdesc="EasyCrypt libraries used for verifying Jasmin implementations"
    
      7arch=('x86_64')
    
      8url="https://github.com/jasmin-lang/jasmin"
    
      9license=('MIT')
    
      10
    
      11# Runtime dependencies available in official repositories
    
      12depends=()
    
      13
    
      14# Tools required to extract the Debian package
    
      15makedepends=('binutils' 'tar')
    
      16
    
      17# Debian packages
    
      18_pkgname=libjasmin-easycrypt
    
      19
    
      20# Debian package version (may include dashes, unlike pkgver)
    
      21_debver="${pkgver}-1"
    
      22
    
      23source=(
    
      24  "${_pkgname}_${_debver}_amd64.deb::https://repo.formosa-crypto.org/debian/pool/main/j/jasmin-compiler/${_pkgname}_${_debver}_amd64.deb"
    
      25)
    
      26
    
      27sha256sums=('2ba9378c3c4e3310732b72c9b7ff04ff73938196568ad2eaeae86b58a5d9adb0')
    
      28
    
      29package() {
    
      30  cd "$srcdir"
    
      31
    
      32  # Extract the Debian package
    
      33  ar x "${_pkgname}_${_debver}_amd64.deb"
    
      34
    
      35  # Extract data archive (format may vary)
    
      36  if [ -f data.tar.xz ]; then
    
      37    tar -xf data.tar.xz -C "$pkgdir"
    
      38  elif [ -f data.tar.gz ]; then
    
      39    tar -xf data.tar.gz -C "$pkgdir"
    
      40  elif [ -f data.tar.zst ]; then
    
      41    tar -xf data.tar.zst -C "$pkgdir"
    
      42  fi
    
      43
    
      44  # Install license or copyright if present
    
      45  if [ -f "$pkgdir/usr/share/doc/$_pkgname/copyright" ]; then
    
      46    install -Dm644 \
    
      47      "$pkgdir/usr/share/doc/$_pkgname/copyright" \
    
      48      "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      49  fi
    
      50
    
      51  # Remove Debian-specific changelog files
    
      52  if [ -d "$pkgdir/usr/share/doc/$_pkgname" ]; then
    
      53    rm -f "$pkgdir/usr/share/doc/$_pkgname/changelog.Debian"*
    
      54  fi
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2