openssl-1.1
MEDIUM
maintainer the-k
37 votes
scanned 2026-08-25 11:26:09.289924
Why flagged
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
"https://www.openssl.org/source/${_pkgname}-${_ver}.tar.gz"{,.asc}
PKGBUILD
1 offending line(s) highlighted
1
#!/bin/bash -e
2
# Maintainer: Ľubomír 'the-k' Kučera <lubomir.kucera.jr at gmail.com>
3
# Contributor: Pierre Schmitz <pierre@archlinux.de>
4
5
pkgname=openssl-1.1
6
_pkgname=openssl
7
_ver=1.1.1w
8
# use a pacman compatible version scheme
9
pkgver=${_ver/[a-z]/.${_ver//[0-9.]/}}
10
pkgrel=11
11
pkgdesc='The Open Source toolkit for Secure Sockets Layer and Transport Layer Security'
12
arch=('aarch64' 'x86_64')
13
url='https://www.openssl.org'
14
license=('custom:BSD')
15
depends=('glibc')
16
provides=('libcrypto.so' 'libssl.so')
17
makedepends=('perl')
18
source=(
19
"https://www.openssl.org/source/${_pkgname}-${_ver}.tar.gz"{,.asc}
20
'ca-dir.patch'
21
# https://salsa.debian.org/debian/openssl/-/tree/debian/bullseye/debian/patches
22
CVE-2023-5678.patch
23
CVE-2024-0727-1.patch
24
CVE-2024-0727-2.patch
25
CVE-2024-2511.patch
26
CVE-2024-4741.patch
27
CVE-2024-5535-1.patch
28
CVE-2024-5535-2.patch
29
CVE-2024-5535-3.patch
30
CVE-2024-5535-4.patch
31
CVE-2024-5535-5.patch
32
CVE-2024-5535-6.patch
33
CVE-2024-5535-7.patch
34
CVE-2024-5535-8.patch
35
CVE-2024-9143.patch
36
CVE-2024-13176.patch
37
CVE-2025-9230.patch
38
CVE-2025-68160.patch
39
CVE-2025-69418.patch
40
CVE-2025-69420.patch
41
CVE-2025-69421.patch
42
CVE-2026-7383.patch
43
CVE-2026-9076-1.patch
44
CVE-2026-9076-2.patch
45
CVE-2026-9076.tar
46
CVE-2026-22795_CVE-2026-22796.patch
47
CVE-2026-28387.patch
48
CVE-2026-28388-1.patch
49
CVE-2026-28388-2.patch
50
CVE-2026-28389-1.patch
51
CVE-2026-28389-2.patch
52
CVE-2026-28389.tar
53
CVE-2026-28390-1.patch
54
CVE-2026-28390-2.patch
55
CVE-2026-28390-3.patch
56
CVE-2026-28390-4.patch
57
CVE-2026-34180.patch
58
CVE-2026-42766-1.patch
59
CVE-2026-42766-2.patch
60
CVE-2026-42766.tar
61
CVE-2026-45447-1.patch
62
CVE-2026-45447-2.patch
63
# https://git.almalinux.org/rpms/openssl/src/branch/c8s
64
CVE-2025-69419-1.patch
65
CVE-2025-69419-2.patch
66
)
67
sha256sums=('cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8'
68
'SKIP'
69
'75aa8c2c638c8a3ebfd9fa146fc61c7ff878fc997dc6aa10d39e4b2415d669b2'
70
'2fc41792a80991df8de4174a59888d2217c2d2f57ea0b411ff2c193871389709'
71
'26fb539e30ffcdda179bca5c44858df360035e5209facb5cc6e3976129e10de5'
72
'84be27ad8732556d880b3b584371dd1603fdbfbe5615990e256ac1b5e00e5163'
73
'4bb00c132ad7057bedd91d34a3354087e8a4e3f321acb4b9721e13f89bccd990'
74
'6bb37fc0a0b031876c79f6fecf21fd1b3a4fafdc73b0a83bb1ebf407b8b6ac8d'
75
'bd0818c56353d04eb61e4f1996e63020597ea44f1c1e014eadccf528fae74304'
76
'76f426f62acaec2631172838f7807a91d0d4d05eb05dffe624de3f9c849dbb72'
77
'9b1346d6b446ea9c8a9fc67596442bb148ee9aa548d2788fd056ad9d7cbd81e3'
78
'8599fe7b8257f42642d0ee879577e4087cd7fa80e6dd2308a105cb767f17dddf'
79
'c597f50b8ec0332ecbe5945ba3ca8cde9654d2be3860ecb949293ed75bba23dc'
80
'9eaa7c529bf29183a3313a81c80f5b31ec5dd7ed03d154a8cda1f5cae95eba5a'
81
'dac937ebd37ed3a9b7bd7d4e646da227eacd2dd46975ffe887bc78ee2d836699'
82
'c8ea09e1e68ca794be78a8000d9986759df793c5f929db76b1177e06ca04c61e'
83
'1dc2e3b31a3c70cd9f10ec4a1c87f8cfb6776f9cec9cfb99560598679e9b3e88'
84
'828792284bd823a0ea6d23033990bd155c8627cdb7200aaf4e6b4bf1d41f4f9d'
85
'2bfc4da1ca00791bf268de8d8681b86fcbc4fc9e3949e59dfee36b28b64c920d'
86
'2e548f306c136caefcbcc9a3945134bec0171ec88210b708f68490c9ecd9329f'
87
'1bb720f06bfc27216e2ac339cd13d94a1269db3e97c80e734e649ed4e8245473'
88
'a8872bd2e35b9e98f609280425a8f0c2aefdb53bf8e82867801dc1bd4929442a'
89
'abbac0667f15870da50e19601bec90b4a3323e38e8d99bc2340037dff5091658'
90
'e666a38218cbde067ecf9b8c6525ac40bee0b7aaca1a313f231abdfb5c80718d'
91
'4d8b43bfd7045c953680c00dbf960309aa39669460865f884a3ffd22b0a2fdce'
92
'5e978c392007f8f72e4a3ce2d5132ebd40f0d13d8703d8567daff8e4d5ac163c'
93
'3c97cc109178e3be699816b30c4a89e9cc1513ade2113f4b36cbe6a097a50389'
94
'5ae30f0101c5ce031c2a22531b099e16b1796bca1ef640dde087f0caaf34265d'
95
'eb815e57a59646b185576b6a04ba9803fcf2f77a41f4a611a39f1c8223177270'
96
'662786ba0e229616f0dde5c08b550e2ea4b81d6c51babe97db7aadf1438259f4'
97
'f6bcf54edac5382be399c33a50c9d7568c3f6316ec9cfe5d80b9c41bac4906ae'
98
'ae5fdc98beb183179362eac0ebdc8d9cfe5a3eec44552b6bf0106c4bdabb5de0'
99
'c94eb9553df3e351f4cd49b7d46f4901e7ec3cd9c1b4f67c04af390ee4a8e116'
100
'ab721837f629ee7bd3501d71345e028f871b8a5e5feb828b809b3138a706fdbf'
101
'61b0d0d876d68c4c4e1762ca69d22fd8d3c3d61959e1d32823ecc8e03971e624'
102
'd1bd3facfc13838171aa6ad353f7f1844d803d77f9c32b900c943c07c99476fc'
103
'c93a91e411c35eef8620927804ea4f4228063f503ae8ccc9adb4c248a57d3f6d'
104
'dd5c12716c5b558de8284689ce6feb7ee68f26cc8312be6380db96ddd9ea5a42'
105
'40f41bd595ada9072ed4afe534b7bf78b44c39c1241cab7152139a7c9a39de7d'
106
'095c04743b42745669feb252e2ccff4677bed6f1d7aae76e008071c66bb941a6'
107
'a7048bb026d5ae889804229d4e395f4574f5c63c5258130470a4f05dc706581e'
108
'b03d53705375794da859dbd1287b9356a750fd3f669b74403d3f4619d494eab8'
109
'f5689d1652045fe14c70e6eb68b080b1a26ad1c49d5308cd7212b417e10f2afc'
110
'4fe62fbbce088325f5b62fab3edfe59d4d9a8108ddfd06cf2a53fa1bd758c5b3'
111
'd89423836be0cb5ca076e173ea373c4deeef3d6ffa17085ca8a0850b364d7d3b'
112
'933c61f15a81ac9c50f66f8c6c059d09f94a116d7b4c4d534a41b1c8f0140160')
113
validpgpkeys=(
114
'8657ABB260F056B1E5190839D9C4D26D0E604491'
115
'7953AC1FBC3DC8B3B292393ED5E9E43F7DF9EE8C'
116
'A21FAB74B0088AA361152586B8EF1A6BA9DA2D5C'
117
'EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5'
118
)
119
noextract=(
120
CVE-2026-9076.tar
121
CVE-2026-28389.tar
122
CVE-2026-42766.tar
123
)
124
125
prepare() {
126
: "${srcdir:?}"
127
128
cd "$srcdir/$_pkgname-$_ver"
129
130
# Files created by the patches
131
rm -f \
132
include/internal/unicode.h \
133
test/certs/cve-2026-28388-ca.pem \
134
test/certs/cve-2026-28388-ca.pem \
135
test/certs/cve-2026-28388-crls.pem \
136
test/certs/cve-2026-28388-leaf.pem \
137
test/cms-msg/make_missing_kdf_der.py \
138
test/recipes/70-test_npn.t \
139
test/recipes/80-test_cms_data/dh-cert.pem \
140
test/recipes/80-test_cms_data/dh-key.pem \
141
test/recipes/80-test_cms_data/ecdh-cert.pem \
142
test/recipes/80-test_cms_data/ecdh-key.pem \
143
test/recipes/80-test_pkcs12_data/bad{1,2,3}.p12 \
144
test/smime-certs/smrsa3-cert.pem \
145
test/smime-eml/pkcs7-empty-digest-set.eml \
146
util/perl/TLSProxy/NextProto.pm \
147
;
148
149
# set ca dir to /etc/ssl by default
150
patch -p0 -i "$srcdir/ca-dir.patch"
151
152
local patch
153
for patch in \
154
CVE-2023-5678 \
155
CVE-2024-0727-1 \
156
CVE-2024-0727-2 \
157
CVE-2024-2511 \
158
CVE-2024-4741 \
159
CVE-2024-5535-1 \
160
CVE-2024-5535-2 \
161
CVE-2024-5535-3 \
162
CVE-2024-5535-4 \
163
CVE-2024-5535-5 \
164
CVE-2024-5535-6 \
165
CVE-2024-5535-7 \
166
CVE-2024-5535-8 \
167
CVE-2024-9143 \
168
CVE-2024-13176 \
169
CVE-2025-9230 \
170
CVE-2025-68160 \
171
CVE-2025-69418 \
172
CVE-2025-69419-1 \
173
CVE-2025-69419-2 \
174
CVE-2025-69420 \
175
CVE-2025-69421 \
176
CVE-2026-7383 \
177
CVE-2026-9076-1 \
178
CVE-2026-9076-2 \
179
CVE-2026-22795_CVE-2026-22796 \
180
CVE-2026-28387 \
181
CVE-2026-28388-1 \
182
CVE-2026-28388-2 \
183
CVE-2026-28389-1 \
184
CVE-2026-28389-2 \
185
CVE-2026-28390-1 \
186
CVE-2026-28390-2 \
187
CVE-2026-28390-3 \
188
CVE-2026-28390-4 \
189
CVE-2026-34180 \
190
CVE-2026-42766-1 \
191
CVE-2026-42766-2 \
192
CVE-2026-45447-1 \
193
CVE-2026-45447-2 \
194
; do
195
patch -p1 -i "${srcdir}/${patch}.patch"
196
done
197
198
local tarball
199
for tarball in \
200
CVE-2026-9076 \
201
CVE-2026-28389 \
202
CVE-2026-42766 \
203
; do
204
tar xvf "${srcdir}/${tarball}.tar"
205
done
206
}
207
208
build() {
209
cd "$srcdir/$_pkgname-$_ver"
210
211
./Configure --prefix=/usr --openssldir=/etc/ssl --libdir=lib/openssl-1.1 \
212
shared no-ssl3-method enable-ec_nistp_64_gcc_128 "linux-${CARCH}"
213
214
make depend
215
make
216
}
217
218
check() {
219
cd "$srcdir/$_pkgname-$_ver"
220
221
# the test fails due to missing write permissions in /etc/ssl
222
# revert this patch for make test
223
patch -p0 -R -i "$srcdir/ca-dir.patch"
224
225
make test
226
227
patch -p0 -i "$srcdir/ca-dir.patch"
228
# re-run make to re-generate CA.pl from th patched .in file.
229
make apps/CA.pl
230
}
231
232
package() {
233
: "${pkgdir:?}"
234
235
cd "$srcdir/$_pkgname-$_ver"
236
237
make DESTDIR="$pkgdir" install_sw
238
239
# Move some files around
240
install -m755 -d "$pkgdir/usr/include/openssl-1.1"
241
mv "$pkgdir/usr/include/openssl" "$pkgdir/usr/include/openssl-1.1/"
242
mv "$pkgdir/usr/lib/openssl-1.1/libcrypto.so.1.1" "$pkgdir/usr/lib/"
243
mv "$pkgdir/usr/lib/openssl-1.1/libssl.so.1.1" "$pkgdir/usr/lib/"
244
ln -sf ../libssl.so.1.1 "$pkgdir/usr/lib/openssl-1.1/libssl.so"
245
ln -sf ../libcrypto.so.1.1 "$pkgdir/usr/lib/openssl-1.1/libcrypto.so"
246
mv "$pkgdir/usr/bin/openssl" "$pkgdir/usr/bin/openssl-1.1"
247
248
# Update includedir in .pc files
249
sed -e 's|/include$|/include/openssl-1.1|' -i "$pkgdir"/usr/lib/openssl-1.1/pkgconfig/*.pc
250
251
rm -rf "${pkgdir:?}"/{etc,usr/bin/c_rehash}
252
253
install -D -m644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
254
}
255
256
: "${arch[@]}"
257
: "${depends[@]}"
258
: "${license[@]}"
259
: "${makedepends[@]}"
260
: "${noextract[@]}"
261
: "${pkgdesc}"
262
: "${pkgrel}"
263
: "${pkgver}"
264
: "${provides[@]}"
265
: "${source[@]}"
266
: "${sha256sums[@]}"
267
: "${url}"
268
: "${validpgpkeys[@]}"
269
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-25 11:26:09 | Medium | 1 |
| 2026-06-19 19:07:35 | Clean | 2 |
| 2026-06-18 18:04:49 | Clean | 2 |
| 2026-06-18 17:53:10 | Medium | 1 |
| 2026-06-18 16:11:54 | Medium | 1 |