sangfor-atrust-bin

LOW

maintainer sinbud2004 0 votes scanned 2026-09-22 13:40:55.623632

View on AUR

Why flagged

The .deb is downloaded from atrustcdn.sangfor.com, which is plausibly Sangfor's own CDN for their official aTrust client, with a pinned sha256 checksum; the bundled local files (bsod_checker.js, launcher, loginctl wrapper, systemd drop-ins) are all local sources with checksums; no obfuscated payloads, no exfiltration, and no redirection of official endpoints — this is a legitimate repackaging of a proprietary VPN client with minor compatibility fixes.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The .deb is downloaded from atrustcdn.sangfor.com, which is plausibly Sangfor's own CDN for their official aTrust client, with a pinned sha256 checksum; the bundled local files (bsod_checker.js, launcher, loginctl wrapper, systemd drop-ins) are all local sources with checksums; no obfuscated payloads, no exfiltration, and no redirection of official endpoints — this is a legitimate repackaging of a proprietary VPN client with minor compatibility fixes.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:42 "${pkgname%-bin}-${pkgver}.deb::https://atrustcdn.sangfor.com/standard/linux/${pkgver}/uos/amd64/${_pkgname}Installer_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sinbud2004 <sinbud2004@gmail.com>
    
      2# Contributor: zxp19821005 <zxp19821005 at 163 dot com> (atrust-bin: bsod_checker.js & electron-lib removal)
    
      3#
    
      4# 与上游 atrust-bin 的关键区别(后者在部分 Arch 机器上装完无法正常使用):
    
      5#   1. 保留 deb 自带的 Electron, 不依赖系统 electron9
    
      6#   2. 没有 chown ${USER}:${USER} (在主组不是用户名同名的组时必挂)
    
      7#   3. .install 钩子完整复刻官方 deb 的 postinst 初始化:
    
      8#      chmod 777 resources/app、.aTrust/var, dmidecode 工具加权,
    
      9#      InstallLocation + eaio_packman 注册, 启用/重启 aTrustDaemon
    
      10#      ——缺少这些初始化是"装上但核心服务不启动"的根因
    
      11#   4. systemd drop-in 修复关机/重启时 systemd-shutdown 长时间等待
    
      12#      (官方 KillMode=process 只杀主进程, 低权限子进程残留占住 /home /tmp)
    
      13#   5. 钩子向 /etc/environment 声明 XDG_SESSION_TYPE=x11: 桌面经 xinit/startx
    
      14#      直启时 logind 会话 Type=tty, aTrust 的登录用户检测要求 x11|wayland,
    
      15#      否则判定"无登录用户"导致核心服务拒绝以该用户运行(卸载即还原)
    
      16pkgname=sangfor-atrust-bin
    
      17_pkgname=aTrust
    
      18pkgver=2.5.16.30
    
      19pkgrel=1
    
      20pkgdesc="Sangfor aTrust SDP client (prebuilt, bundled Electron; postinst replicated, works out of the box)"
    
      21arch=('x86_64')
    
      22url="https://www.sangfor.com/"
    
      23license=('LicenseRef-unknown')
    
      24conflicts=('atrust-bin' 'sangfor-atrust')
    
      25provides=('sangfor-atrust' 'atrust')
    
      26depends=(
    
      27    'libxss'
    
      28    'qt5-base'
    
      29    'java-runtime'
    
      30    'gtk3'
    
      31    'libxrandr'
    
      32    'cairo'
    
      33    'libxcomposite'
    
      34    'at-spi2-core'
    
      35    'alsa-lib'
    
      36    'libxtst'
    
      37    'nodejs'
    
      38)
    
      39options=('!strip' '!emptydirs')
    
      40install="${pkgname}.install"
    
      41source=(
    
      42    "${pkgname%-bin}-${pkgver}.deb::https://atrustcdn.sangfor.com/standard/linux/${pkgver}/uos/amd64/${_pkgname}Installer_amd64.deb"
    
      43    "bsod_checker.js"
    
      44    "atrust-launcher.sh"
    
      45    "atrust-loginctl"
    
      46    "atrust-daemon-path.conf"
    
      47    "atrust-daemon-shutdown.conf"
    
      48)
    
      49sha256sums=('aa8ba93532ae250dcab3d75d3b103fb01a93b97b49cbc6d9066c5ed1f70b75a6'
    
      50            'ae82a7e0575d2ed8778134fc7d5c9c85001c955a7d26710a13101ff2363c53e6'
    
      51            'c6f3e5b6da549ec3ad85f6721f72d058f94672b53e6e869dca27e8b8e6ff008b'
    
      52            'cceabc37c7ac5dcc1e0683478f0ee10b7dd5fe273f3ddb2a2797c31a7e04895c'
    
      53            'fe46dc7552321cdc01ccf90ca3acca81a155be51e8b487dfaa5cf984e2675412'
    
      54            'ad0df6c189c831a189c415db0e968f297b2bdaa43176bc665a4f051a0f0e0b64')
    
      55
    
      56prepare() {
    
      57    # makepkg 已自动解开 deb, 此处解出 data 包
    
      58    bsdtar -xf data.tar.xz
    
      59
    
      60    # 剔除与系统库冲突的自带库
    
      61    rm -f \
    
      62        "usr/share/sangfor/${_pkgname}/resources/lib/libstdc++.so.6" \
    
      63        "usr/share/sangfor/${_pkgname}/resources/lib/libqxcb.so" \
    
      64        "usr/share/sangfor/${_pkgname}/resources/lib/libxcb.so.1" \
    
      65        "usr/share/sangfor/${_pkgname}/resources/lib/libxcb-xinerama.so.0" \
    
      66        "usr/share/sangfor/${_pkgname}/uem/lib/libstdc++.so.6"
    
      67
    
      68    # 覆盖 nodejs 兼容性修复脚本
    
      69    install -Dm644 "${srcdir}/bsod_checker.js" \
    
      70        "usr/share/sangfor/${_pkgname}/resources/app/src/service/bsod_checker.js"
    
      71
    
      72    # 桌面入口指向启动器
    
      73    sed -i -e 's|^Exec=.*|Exec=atrust|' -e 's|^Icon=.*|Icon=aTrust|' \
    
      74        "usr/share/applications/cn.com.sangfor.atrust.desktop"
    
      75}
    
      76
    
      77package() {
    
      78    # 主程序树 (agent 的路径白名单硬编码要求位于 /usr/share/sangfor)
    
      79    install -d "${pkgdir}/usr/share"
    
      80    cp -Pr --no-preserve=ownership "usr/share/sangfor" "${pkgdir}/usr/share/"
    
      81
    
      82    # 启动器
    
      83    install -Dm755 "${srcdir}/atrust-launcher.sh" "${pkgdir}/usr/bin/atrust"
    
      84
    
      85    # systemd 单元 (守护进程运行的正解环境)
    
      86    install -d "${pkgdir}/usr/lib/systemd/system"
    
      87    install -Dm644 usr/lib/systemd/system/*.service -t "${pkgdir}/usr/lib/systemd/system/"
    
      88    if [ -d usr/lib/systemd/user ] && ls usr/lib/systemd/user/*.service >/dev/null 2>&1; then
    
      89        install -d "${pkgdir}/usr/lib/systemd/user"
    
      90        install -Dm644 usr/lib/systemd/user/*.service -t "${pkgdir}/usr/lib/systemd/user/"
    
      91    fi
    
      92
    
      93    # 图标与桌面文件
    
      94    install -Dm644 "usr/share/pixmaps/${_pkgname}.png" \
    
      95        "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      96    install -Dm644 "usr/share/applications/cn.com.sangfor.atrust.desktop" \
    
      97        "${pkgdir}/usr/share/applications/cn.com.sangfor.atrust.desktop"
    
      98
    
      99    # 兼容层: 非 display-manager 桌面(如 xinit/startx, logind 会话 Type=tty)
    
      100    # 会导致 agent 的登录用户检测失败、核心服务不启动。
    
      101    # 包装器把 show-session 的 Type=tty 改写为 Type=x11, 经 drop-in 注入 PATH。
    
      102    install -Dm755 "${srcdir}/atrust-loginctl" "${pkgdir}/usr/lib/sangfor-atrust/loginctl"
    
      103    install -Dm644 "${srcdir}/atrust-daemon-path.conf" \
    
      104        "${pkgdir}/etc/systemd/system/aTrustDaemon.service.d/path.conf"
    
      105    # 关机卡住修复: KillMode=process 导致子进程残留, 拖住 /home /tmp 卸载
    
      106    install -Dm644 "${srcdir}/atrust-daemon-shutdown.conf" \
    
      107        "${pkgdir}/etc/systemd/system/aTrustDaemon.service.d/shutdown.conf"
    
      108}
    
      109

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 13:40:55	Low	3
2026-09-22 13:37:53	Medium	3