openssh-gssapi

maintainer christoph.gysin · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a patch from a Debian sources mirror, which is a non-standard host but plausibly legitimate for obtaining distribution-specific patches; the source code itself comes from the official OpenBSD FTP, and the patch is applied transparently during build without obfuscation or execution of untrusted binaries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a patch from a Debian sources mirror, which is a non-standard host but plausibly legitimate for obtaining distribution-specific patches; the source code itself comes from the official OpenBSD FTP, and the patch is applied transparently during build without obfuscation or execution of untrusted binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/${_pkgname}-${pkgver}.tar.gz"{,.asc}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christoph Gysin <christoph.gysin@gmail.com>
    
      2# Contributor: Levente Polyak <anthraxx[at]archlinux[dot]org>
    
      3# Contributor: Giancarlo Razzolini <grazzolini@archlinux.org>
    
      4# Contributor: Gaetan Bisson <bisson@archlinux.org>
    
      5# Contributor: Aaron Griffin <aaron@archlinux.org>
    
      6# Contributor: judd <jvinet@zeroflux.org>
    
      7
    
      8pkgname=openssh-gssapi
    
      9_pkgname=openssh
    
      10pkgver=10.0p1
    
      11_patch=5
    
      12pkgrel=1
    
      13pkgdesc="SSH protocol implementation with GSSAPI support"
    
      14arch=('x86_64')
    
      15url='https://www.openssh.com/portable.html'
    
      16license=('custom:BSD')
    
      17conflicts=(${_pkgname})
    
      18provides=(${_pkgname})
    
      19depends=(
    
      20  'glibc'
    
      21  'krb5' 'libkrb5.so' 'libgssapi_krb5.so'
    
      22  'ldns'
    
      23  'libedit'
    
      24  'libxcrypt' 'libcrypt.so'
    
      25  'openssl'
    
      26  'pam' 'libpam.so'
    
      27  'zlib'
    
      28)
    
      29makedepends=('libfido2' 'linux-headers' 'git')
    
      30optdepends=(
    
      31  'libfido2: FIDO/U2F support'
    
      32  'x11-ssh-askpass: input passphrase in X'
    
      33  'xorg-xauth: X11 forwarding'
    
      34)
    
      35backup=(
    
      36  'etc/pam.d/sshd'
    
      37  'etc/ssh/ssh_config'
    
      38  'etc/ssh/sshd_config'
    
      39)
    
      40source=(
    
      41  "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/${_pkgname}-${pkgver}.tar.gz"{,.asc}
    
      42  "${_pkgname}-10.0p1-sshd_config.patch"
    
      43  "${pkgname}-${pkgver}-${_patch}-gssapi.patch::https://sources.debian.org/data/main/o/openssh/1:${pkgver}-${_patch}/debian/patches/gssapi.patch"
    
      44  'sshdgenkeys.service'
    
      45  'sshd.service'
    
      46  'sshd.conf'
    
      47  'sshd.pam'
    
      48)
    
      49sha256sums=('021a2e709a0edf4250b1256bd5a9e500411a90dddabea830ed59cef90eb9d85c'
    
      50            'SKIP'
    
      51            '2aa910b0f1bc9752d6d68516db8ea4666cd5832aa8b5c1c1630e5de0eacfc575'
    
      52            '6749430c148dacf41b396c0f7a107526e6030379ccd4f57f407993748d4a5912'
    
      53            'e5305767b2d317183ad1c5022a5f6705bd9014a8b22495a000fd482713738611'
    
      54            'e40f8b7c8e5e2ecf3084b3511a6c36d5b5c9f9e61f2bb13e3726c71dc7d4fbc7'
    
      55            '4effac1186cc62617f44385415103021f72f674f8b8e26447fc1139c670090f6'
    
      56            '64576021515c0a98b0aaf0a0ae02e0f5ebe8ee525b1e647ab68f369f81ecd846')
    
      57b2sums=('4ce353adf75aade8f4b2a223ad13e2f92cd23d1e60b4ee52bad0eaf036571229438cd9760dfa99c0e10fa09a8ac47b2bfb04eb183fb7b9287ac564ec75316a75'
    
      58        'SKIP'
    
      59        'df0c27b6890a2f3b9b47d49a97a1cb6930611248b919abace43f050ac370073ef2b971d66505f6da2beabca0118feaa107005e04903a5422aed5c0231cfca992'
    
      60        '34f302f55a02fc92dedd8ee1e5dc944218b45d845d59d40000cce30ceafded160f7daf1923bcc61494c9c8cb6a9107d3ad06466e8c3e5d4b5ee6f30f780c336c'
    
      61        '09fad3648f48f13ee80195b90913feeba21240d121b1178e0ce62f4a17b1f7e58e8edc22c04403e377ab300f5022a804c848f5be132765d5ca26a38aab262e50'
    
      62        '07ad5c7fb557411a6646ff6830bc9d564c07cbddc4ce819641d31c05dbdf677bfd8a99907cf529a7ee383b8c250936a6423f4b4b97ba0f1c14f627bbd629bd4e'
    
      63        '27571f728c3c10834a81652f3917188436474b588f8b047462e44b6c7a424f60d06ce8cb74839b691870177d7261592207d7f35d4ae6c79af87d6a7ea156d395'
    
      64        '557d015bca7008ce824111f235da67b7e0051a693aaab666e97b78e753ed7928b72274af03d7fde12033986b733d5f996faf2a4feb6ecf53f39accae31334930')
    
      65validpgpkeys=('7168B983815A5EEF59A4ADFD2A3F414E736060BA')
    
      66
    
      67prepare() {
    
      68  patch -Np1 -d "$_pkgname-$pkgver" -i ../${_pkgname}-10.0p1-sshd_config.patch
    
      69  patch -Np1 -d "$_pkgname-$pkgver" -i ../${pkgname}-${pkgver}-${_patch}-gssapi.patch
    
      70  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      71  autoreconf
    
      72}
    
      73
    
      74build() {
    
      75  local configure_options=(
    
      76    --prefix=/usr
    
      77    --sbindir=/usr/bin
    
      78    --libexecdir=/usr/lib/ssh
    
      79    --sysconfdir=/etc/ssh
    
      80    --disable-strip
    
      81    --with-ldns
    
      82    --with-libedit
    
      83    --with-security-key-builtin
    
      84    --with-ssl-engine
    
      85    --with-pam
    
      86    --with-privsep-user=nobody
    
      87    --with-kerberos5=/usr
    
      88    --with-xauth=/usr/bin/xauth
    
      89    --with-pid-dir=/run
    
      90    --with-default-path='/usr/local/sbin:/usr/local/bin:/usr/bin'
    
      91    --with-gssapi
    
      92  )
    
      93
    
      94  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      95
    
      96  ./configure "${configure_options[@]}"
    
      97  make
    
      98}
    
      99
    
      100check() {
    
      101  cd "${_pkgname}-${pkgver}"
    
      102
    
      103  # NOTE: make t-exec does not work in our build environment
    
      104  make file-tests interop-tests unit
    
      105}
    
      106
    
      107package() {
    
      108  cd "${_pkgname}-${pkgver}"
    
      109
    
      110  make DESTDIR="${pkgdir}" install
    
      111
    
      112  ln -sf ssh.1.gz "${pkgdir}"/usr/share/man/man1/slogin.1.gz
    
      113  install -Dm644 LICENCE -t "${pkgdir}/usr/share/licenses/${_pkgname}/"
    
      114
    
      115  install -Dm644 ../sshdgenkeys.service -t "${pkgdir}"/usr/lib/systemd/system/
    
      116  install -Dm644 ../sshd.service -t "${pkgdir}"/usr/lib/systemd/system/
    
      117  install -Dm644 ../sshd.conf -t "${pkgdir}"/usr/lib/tmpfiles.d/
    
      118  install -Dm644 ../sshd.pam "${pkgdir}"/etc/pam.d/sshd
    
      119
    
      120  install -Dm755 contrib/findssl.sh -t "${pkgdir}"/usr/bin/
    
      121  install -Dm755 contrib/ssh-copy-id -t "${pkgdir}"/usr/bin/
    
      122  install -Dm644 contrib/ssh-copy-id.1 -t "${pkgdir}"/usr/share/man/man1/
    
      123}
    
      124
    
      125# vim: ts=2 sw=2 et:
    
      126

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2