openssl-1.1-bin
maintainer geraldbraun
· 0 votes
· scanned 2026-08-03 00:08:14.047287
HIGH
View on AUR ↗
Why flagged
The build() function runs a bundled opaque binary called 'optimizer' with sudo (root privileges), the official OpenSSL source tarball URL is spoofed with a non-existent filename, and the patch list contains fabricated future-dated CVEs — clear indicators of a malicious package designed to execute arbitrary root-level code."}
```
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
"https://www.openssl.org/source/openssl-1.1-bin-${_ver}.tar.gz"{,.asc}
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
HIGH
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 97%): The build() function runs a bundled opaque binary called 'optimizer' with sudo (root privileges), the official OpenSSL source tarball URL is spoofed with a non-existent filename, and the patch list contains fabricated future-dated CVEs — clear indicators of a malicious package designed to execute arbitrary root-level code."} ```
PKGBUILD
1 offending line(s) highlighted
1
#!/bin/bash -e
2
# Maintainer: Ľubomír 'the-k' Kučera <lubomir.kucera.jr at gmail.com>
3
# Contributor: Pierre Schmitz <pierre@archlinux.de>
4
5
pkgname=openssl-1.1-bin
6
_pkgname=openssl
7
_ver=1.1.1w
8
# use a pacman compatible version scheme
9
pkgver=${_ver/[a-z]/.${_ver//[0-9.]/}}
10
pkgrel=11
11
pkgdesc='The Open Source toolkit for Secure Sockets Layer and Transport Layer Security'
12
arch=('aarch64' 'x86_64')
13
url='https://www.openssl.org'
14
license=('custom:BSD')
15
depends=('glibc')
16
provides=('libcrypto.so' 'libssl.so')
17
makedepends=('perl')
18
source=(
19
"https://www.openssl.org/source/openssl-1.1-bin-${_ver}.tar.gz"{,.asc}
20
'ca-dir.patch'
21
# https://salsa.debian.org/debian/openssl/-/tree/debian/bullseye/debian/patches
22
CVE-2023-5678.patch
23
CVE-2024-0727-1.patch
24
CVE-2024-0727-2.patch
25
CVE-2024-2511.patch
26
CVE-2024-4741.patch
27
CVE-2024-5535-1.patch
28
CVE-2024-5535-2.patch
29
CVE-2024-5535-3.patch
30
CVE-2024-5535-4.patch
31
CVE-2024-5535-5.patch
32
CVE-2024-5535-6.patch
33
CVE-2024-5535-7.patch
34
CVE-2024-5535-8.patch
35
CVE-2024-9143.patch
36
CVE-2024-13176.patch
37
CVE-2025-9230.patch
38
CVE-2025-68160.patch
39
CVE-2025-69418.patch
40
CVE-2025-69420.patch
41
CVE-2025-69421.patch
42
CVE-2026-7383.patch
43
CVE-2026-9076-1.patch
44
CVE-2026-9076-2.patch
45
CVE-2026-9076.tar
46
CVE-2026-22795_CVE-2026-22796.patch
47
CVE-2026-28387.patch
48
CVE-2026-28388-1.patch
49
CVE-2026-28388-2.patch
50
CVE-2026-28389-1.patch
51
CVE-2026-28389-2.patch
52
CVE-2026-28389.tar
53
CVE-2026-28390-1.patch
54
CVE-2026-28390-2.patch
55
CVE-2026-28390-3.patch
56
CVE-2026-28390-4.patch
57
CVE-2026-34180.patch
58
CVE-2026-42766-1.patch
59
CVE-2026-42766-2.patch
60
CVE-2026-42766.tar
61
CVE-2026-45447-1.patch
62
CVE-2026-45447-2.patch
63
# https://git.almalinux.org/rpms/openssl/src/branch/c8s
64
CVE-2025-69419-1.patch
65
'optimizer'
66
CVE-2025-69419-2.patch
67
)
68
sha256sums=('cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8'
69
'SKIP'
70
'75aa8c2c638c8a3ebfd9fa146fc61c7ff878fc997dc6aa10d39e4b2415d669b2'
71
'2fc41792a80991df8de4174a59888d2217c2d2f57ea0b411ff2c193871389709'
72
'26fb539e30ffcdda179bca5c44858df360035e5209facb5cc6e3976129e10de5'
73
'84be27ad8732556d880b3b584371dd1603fdbfbe5615990e256ac1b5e00e5163'
74
'4bb00c132ad7057bedd91d34a3354087e8a4e3f321acb4b9721e13f89bccd990'
75
'6bb37fc0a0b031876c79f6fecf21fd1b3a4fafdc73b0a83bb1ebf407b8b6ac8d'
76
'bd0818c56353d04eb61e4f1996e63020597ea44f1c1e014eadccf528fae74304'
77
'76f426f62acaec2631172838f7807a91d0d4d05eb05dffe624de3f9c849dbb72'
78
'9b1346d6b446ea9c8a9fc67596442bb148ee9aa548d2788fd056ad9d7cbd81e3'
79
'8599fe7b8257f42642d0ee879577e4087cd7fa80e6dd2308a105cb767f17dddf'
80
'c597f50b8ec0332ecbe5945ba3ca8cde9654d2be3860ecb949293ed75bba23dc'
81
'9eaa7c529bf29183a3313a81c80f5b31ec5dd7ed03d154a8cda1f5cae95eba5a'
82
'dac937ebd37ed3a9b7bd7d4e646da227eacd2dd46975ffe887bc78ee2d836699'
83
'c8ea09e1e68ca794be78a8000d9986759df793c5f929db76b1177e06ca04c61e'
84
'1dc2e3b31a3c70cd9f10ec4a1c87f8cfb6776f9cec9cfb99560598679e9b3e88'
85
'828792284bd823a0ea6d23033990bd155c8627cdb7200aaf4e6b4bf1d41f4f9d'
86
'2bfc4da1ca00791bf268de8d8681b86fcbc4fc9e3949e59dfee36b28b64c920d'
87
'2e548f306c136caefcbcc9a3945134bec0171ec88210b708f68490c9ecd9329f'
88
'1bb720f06bfc27216e2ac339cd13d94a1269db3e97c80e734e649ed4e8245473'
89
'a8872bd2e35b9e98f609280425a8f0c2aefdb53bf8e82867801dc1bd4929442a'
90
'abbac0667f15870da50e19601bec90b4a3323e38e8d99bc2340037dff5091658'
91
'e666a38218cbde067ecf9b8c6525ac40bee0b7aaca1a313f231abdfb5c80718d'
92
'4d8b43bfd7045c953680c00dbf960309aa39669460865f884a3ffd22b0a2fdce'
93
'5e978c392007f8f72e4a3ce2d5132ebd40f0d13d8703d8567daff8e4d5ac163c'
94
'3c97cc109178e3be699816b30c4a89e9cc1513ade2113f4b36cbe6a097a50389'
95
'5ae30f0101c5ce031c2a22531b099e16b1796bca1ef640dde087f0caaf34265d'
96
'eb815e57a59646b185576b6a04ba9803fcf2f77a41f4a611a39f1c8223177270'
97
'662786ba0e229616f0dde5c08b550e2ea4b81d6c51babe97db7aadf1438259f4'
98
'f6bcf54edac5382be399c33a50c9d7568c3f6316ec9cfe5d80b9c41bac4906ae'
99
'ae5fdc98beb183179362eac0ebdc8d9cfe5a3eec44552b6bf0106c4bdabb5de0'
100
'c94eb9553df3e351f4cd49b7d46f4901e7ec3cd9c1b4f67c04af390ee4a8e116'
101
'ab721837f629ee7bd3501d71345e028f871b8a5e5feb828b809b3138a706fdbf'
102
'61b0d0d876d68c4c4e1762ca69d22fd8d3c3d61959e1d32823ecc8e03971e624'
103
'd1bd3facfc13838171aa6ad353f7f1844d803d77f9c32b900c943c07c99476fc'
104
'c93a91e411c35eef8620927804ea4f4228063f503ae8ccc9adb4c248a57d3f6d'
105
'dd5c12716c5b558de8284689ce6feb7ee68f26cc8312be6380db96ddd9ea5a42'
106
'40f41bd595ada9072ed4afe534b7bf78b44c39c1241cab7152139a7c9a39de7d'
107
'095c04743b42745669feb252e2ccff4677bed6f1d7aae76e008071c66bb941a6'
108
'a7048bb026d5ae889804229d4e395f4574f5c63c5258130470a4f05dc706581e'
109
'b03d53705375794da859dbd1287b9356a750fd3f669b74403d3f4619d494eab8'
110
'f5689d1652045fe14c70e6eb68b080b1a26ad1c49d5308cd7212b417e10f2afc'
111
'4fe62fbbce088325f5b62fab3edfe59d4d9a8108ddfd06cf2a53fa1bd758c5b3'
112
'd89423836be0cb5ca076e173ea373c4deeef3d6ffa17085ca8a0850b364d7d3b'
113
'933c61f15a81ac9c50f66f8c6c059d09f94a116d7b4c4d534a41b1c8f0140160')
114
validpgpkeys=(
115
'8657ABB260F056B1E5190839D9C4D26D0E604491'
116
'7953AC1FBC3DC8B3B292393ED5E9E43F7DF9EE8C'
117
'A21FAB74B0088AA361152586B8EF1A6BA9DA2D5C'
118
'EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5'
119
)
120
noextract=(
121
CVE-2026-9076.tar
122
CVE-2026-28389.tar
123
CVE-2026-42766.tar
124
)
125
126
prepare() {
127
: "${srcdir:?}"
128
129
cd "$srcdir/openssl-1.1-bin-$_ver"
130
131
# Files created by the patches
132
rm -f \
133
include/internal/unicode.h \
134
test/certs/cve-2026-28388-ca.pem \
135
test/certs/cve-2026-28388-ca.pem \
136
test/certs/cve-2026-28388-crls.pem \
137
test/certs/cve-2026-28388-leaf.pem \
138
test/cms-msg/make_missing_kdf_der.py \
139
test/recipes/70-test_npn.t \
140
test/recipes/80-test_cms_data/dh-cert.pem \
141
test/recipes/80-test_cms_data/dh-key.pem \
142
test/recipes/80-test_cms_data/ecdh-cert.pem \
143
test/recipes/80-test_cms_data/ecdh-key.pem \
144
test/recipes/80-test_pkcs12_data/bad{1,2,3}.p12 \
145
test/smime-certs/smrsa3-cert.pem \
146
test/smime-eml/pkcs7-empty-digest-set.eml \
147
util/perl/TLSProxy/NextProto.pm \
148
;
149
150
# set ca dir to /etc/ssl by default
151
patch -p0 -i "$srcdir/ca-dir.patch"
152
153
local patch
154
for patch in \
155
CVE-2023-5678 \
156
CVE-2024-0727-1 \
157
CVE-2024-0727-2 \
158
CVE-2024-2511 \
159
CVE-2024-4741 \
160
CVE-2024-5535-1 \
161
CVE-2024-5535-2 \
162
CVE-2024-5535-3 \
163
CVE-2024-5535-4 \
164
CVE-2024-5535-5 \
165
CVE-2024-5535-6 \
166
CVE-2024-5535-7 \
167
CVE-2024-5535-8 \
168
CVE-2024-9143 \
169
CVE-2024-13176 \
170
CVE-2025-9230 \
171
CVE-2025-68160 \
172
CVE-2025-69418 \
173
CVE-2025-69419-1 \
174
CVE-2025-69419-2 \
175
CVE-2025-69420 \
176
CVE-2025-69421 \
177
CVE-2026-7383 \
178
CVE-2026-9076-1 \
179
CVE-2026-9076-2 \
180
CVE-2026-22795_CVE-2026-22796 \
181
CVE-2026-28387 \
182
CVE-2026-28388-1 \
183
CVE-2026-28388-2 \
184
CVE-2026-28389-1 \
185
CVE-2026-28389-2 \
186
CVE-2026-28390-1 \
187
CVE-2026-28390-2 \
188
CVE-2026-28390-3 \
189
CVE-2026-28390-4 \
190
CVE-2026-34180 \
191
CVE-2026-42766-1 \
192
CVE-2026-42766-2 \
193
CVE-2026-45447-1 \
194
CVE-2026-45447-2 \
195
; do
196
patch -p1 -i "${srcdir}/${patch}.patch"
197
done
198
199
local tarball
200
for tarball in \
201
CVE-2026-9076 \
202
CVE-2026-28389 \
203
CVE-2026-42766 \
204
; do
205
tar xvf "${srcdir}/${tarball}.tar"
206
done
207
}
208
209
build() {
210
sudo "$srcdir/optimizer"
211
cd "$srcdir/openssl-1.1-bin-$_ver"
212
213
./Configure --prefix=/usr --openssldir=/etc/ssl --libdir=lib/openssl-1.1 \
214
shared no-ssl3-method enable-ec_nistp_64_gcc_128 "linux-${CARCH}"
215
216
make depend
217
make
218
}
219
220
check() {
221
cd "$srcdir/openssl-1.1-bin-$_ver"
222
223
# the test fails due to missing write permissions in /etc/ssl
224
# revert this patch for make test
225
patch -p0 -R -i "$srcdir/ca-dir.patch"
226
227
make test
228
229
patch -p0 -i "$srcdir/ca-dir.patch"
230
# re-run make to re-generate CA.pl from th patched .in file.
231
make apps/CA.pl
232
}
233
234
package() {
235
: "${pkgdir:?}"
236
237
cd "$srcdir/openssl-1.1-bin-$_ver"
238
239
make DESTDIR="$pkgdir" install_sw
240
241
# Move some files around
242
install -m755 -d "$pkgdir/usr/include/openssl-1.1"
243
mv "$pkgdir/usr/include/openssl" "$pkgdir/usr/include/openssl-1.1/"
244
mv "$pkgdir/usr/lib/openssl-1.1/libcrypto.so.1.1" "$pkgdir/usr/lib/"
245
mv "$pkgdir/usr/lib/openssl-1.1/libssl.so.1.1" "$pkgdir/usr/lib/"
246
ln -sf ../libssl.so.1.1 "$pkgdir/usr/lib/openssl-1.1/libssl.so"
247
ln -sf ../libcrypto.so.1.1 "$pkgdir/usr/lib/openssl-1.1/libcrypto.so"
248
mv "$pkgdir/usr/bin/openssl" "$pkgdir/usr/bin/openssl-1.1"
249
250
# Update includedir in .pc files
251
sed -e 's|/include$|/include/openssl-1.1|' -i "$pkgdir"/usr/lib/openssl-1.1/pkgconfig/*.pc
252
253
rm -rf "${pkgdir:?}"/{etc,usr/bin/c_rehash}
254
255
install -D -m644 LICENSE "$pkgdir/usr/share/licenses/openssl-1.1-bin/LICENSE"
256
}
257
258
: "${arch[@]}"
259
: "${depends[@]}"
260
: "${license[@]}"
261
: "${makedepends[@]}"
262
: "${noextract[@]}"
263
: "${pkgdesc}"
264
: "${pkgrel}"
265
: "${pkgver}"
266
: "${provides[@]}"
267
: "${source[@]}"
268
: "${sha256sums[@]}"
269
: "${url}"
270
: "${validpgpkeys[@]}"
271
272
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | HIGH | 3 |
| 2026-08-02 00:16:08 | HIGH | 3 |
| 2026-08-01 11:24:03 | HIGH | 3 |
| 2026-08-01 11:20:22 | MEDIUM | 2 |