ssmtp

MEDIUM

maintainer dcelasun 10 votes scanned 2026-09-15 13:19:52.153816

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

PKGBUILD:84 chmod 2755 "${pkgdir}/usr/bin/ssmtp"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: D. Can Celasun <can[at]dcc[dot]im>
    
      2
    
      3# To use, put `AuthMethod=XOAUTH2` and `AuthPass=<your obtained OAuth2 access token>` in `/etc/ssmtp/ssmtp.conf`.
    
      4#
    
      5# Remember that your OAuth2 access token is often short-lived and will expire in small intervals. (for example, Gmail access tokens expire in 1 hour) You will need a script to refresh it using a long-term refresh token.
    
      6#
    
      7# For Gmail, oauth2l (https://github.com/google/oauth2l, https://aur.archlinux.org/packages/oauth2l) can be used to obtain and refresh the access token using your own registered client secret with Google. Example script:
    
      8#
    
      9# #!/bin/bash
    
      10# ACCESS_TOKEN=$(oauth2l fetch --scope=https://mail.google.com/ \
    
      11#     --credentials=/etc/oauth2l.json --cache=/etc/ssmtp/oauth2l.cache --refresh)
    
      12# sed -i "s/^AuthPass=.*$/AuthPass=$ACCESS_TOKEN/" /etc/ssmtp/ssmtp.conf
    
      13#
    
      14# To refresh the access token every time before sending an email from the command line:
    
      15#
    
      16# /etc/oauth2l.json is your client ID info
    
      17# /etc/ssmtp/oauth2l.cache is the oauth2l cache location for storing the refresh token.
    
      18
    
      19pkgname=ssmtp
    
      20pkgver=2.66
    
      21pkgrel=1
    
      22pkgdesc="Extremely simple MTA to get mail off the system to a mailhub (with Fedora patches)"
    
      23arch=('i686' 'x86_64' 'aarch64' 'armv7h')
    
      24license=('GPL-2.0-or-later')
    
      25url="https://github.com/Project-OSS-Revival/ssmtp"
    
      26depends=('openssl' 'inetutils')
    
      27makedepends=('systemd') # Needed for sysusers.d to create the 'mail' group
    
      28conflicts=('exim' 'smtp-forwarder')
    
      29provides=('smtp-forwarder')
    
      30backup=('etc/ssmtp/ssmtp.conf' 'etc/ssmtp/revaliases')
    
      31options=('!makeflags' '!emptydirs')
    
      32source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Project-OSS-Revival/ssmtp/archive/refs/tags/v${pkgver}.tar.gz"
    
      33        'ssmtp-defaultvalues.patch'
    
      34        'ssmtp-aliases.patch'
    
      35        'xoauth2.patch'
    
      36)
    
      37sha256sums=('6e639eafce4c8a3b7782c2a8a2d467be097c5896eae86fcde0f608666ea88249'
    
      38            '4d50ffa5e6fb52c69fe05fd19ec8e76c71199e29bb515a95ea08aecd79f54a0a'
    
      39            'd2c8f7ea00c4ec4f1be5b26ec058c342f9bb6676c84f3cad934ff12a80417236'
    
      40            '6006a3e14f45b69618c4f2bf982b820938f306ab21aa2a0b7d1b4309d59f6cb5')
    
      41
    
      42prepare() {
    
      43  cd "${srcdir}/${pkgname}-${pkgver}"
    
      44
    
      45  # Patches from https://src.fedoraproject.org/rpms/ssmtp/tree/main
    
      46  patch -p1 -i "${srcdir}/ssmtp-defaultvalues.patch"
    
      47  patch -p1 -i "${srcdir}/ssmtp-aliases.patch"
    
      48
    
      49  # Other patches
    
      50  patch -p1 -i "${srcdir}/xoauth2.patch"
    
      51}
    
      52
    
      53build() {
    
      54  cd "${srcdir}/${pkgname}-${pkgver}"
    
      55
    
      56  autoreconf
    
      57
    
      58  CFLAGS="-Wno-pointer-to-int-cast -Wno-discarded-qualifiers -Wno-int-conversion" \
    
      59  ./configure --prefix=/usr \
    
      60              --sysconfdir=/etc \
    
      61              --mandir=/usr/share/man \
    
      62              --enable-ssl\
    
      63              --enable-inet6
    
      64  make
    
      65}
    
      66
    
      67package() {
    
      68  cd "${srcdir}/${pkgname}-${pkgver}"
    
      69  yes | make prefix="${pkgdir}/usr" mandir="${pkgdir}/usr/share/man/man8" etcdir="${pkgdir}/etc" install
    
      70
    
      71  install -D -m644 ssmtp.conf.5 "${pkgdir}/usr/share/man/man5/ssmtp.conf.5"
    
      72  install -m644 ssmtp.conf "${pkgdir}/etc/ssmtp/ssmtp.conf"
    
      73
    
      74  chown -R root:mail "${pkgdir}/etc/ssmtp"
    
      75  chmod 770 "${pkgdir}/etc/ssmtp"
    
      76
    
      77  ln -s ssmtp "${pkgdir}/usr/sbin/sendmail"
    
      78  ln -s ssmtp "${pkgdir}/usr/sbin/newaliases"
    
      79  ln -s ssmtp "${pkgdir}/usr/sbin/mailq"
    
      80  cd "$pkgdir"
    
      81  mv usr/sbin usr/bin
    
      82
    
      83  chown root:mail "${pkgdir}/usr/bin/ssmtp"
    
      84  chmod 2755 "${pkgdir}/usr/bin/ssmtp"
    
      85}
    
      86

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-15 13:19
@@ -17,60 +17,36 @@
 # /etc/ssmtp/oauth2l.cache is the oauth2l cache location for storing the refresh token.
 
 pkgname=ssmtp
-pkgver=2.64
-pkgrel=21
+pkgver=2.66
+pkgrel=1
 pkgdesc="Extremely simple MTA to get mail off the system to a mailhub (with Fedora patches)"
 arch=('i686' 'x86_64' 'aarch64' 'armv7h')
 license=('GPL-2.0-or-later')
-url="https://wiki.debian.org/sSMTP"
+url="https://github.com/Project-OSS-Revival/ssmtp"
 depends=('openssl' 'inetutils')
 makedepends=('systemd') # Needed for sysusers.d to create the 'mail' group
 conflicts=('exim' 'smtp-forwarder')
 provides=('smtp-forwarder')
 backup=('etc/ssmtp/ssmtp.conf' 'etc/ssmtp/revaliases')
 options=('!makeflags' '!emptydirs')
-source=("http://ftp.debian.org/debian/pool/main/s/ssmtp/${pkgname}_${pkgver}.orig.tar.bz2"
+source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Project-OSS-Revival/ssmtp/archive/refs/tags/v${pkgver}.tar.gz"
+        'ssmtp-defaultvalues.patch'
         'ssmtp-aliases.patch'
-        'ssmtp-c23.patch'
-        'ssmtp-defaultvalues.patch'
-        'ssmtp-md5auth-non-rsa.patch'
-        'ssmtp-validate-TLS-server-cert.patch'
-        'ssmtp-authpass.patch'
-        'ssmtp-configure-c99.patch'
-        'ssmtp-garbage_writes.patch'
-        'ssmtp-remote-addr.patch'
-        'openssl_crypto.patch'
         'xoauth2.patch'
 )
-sha256sums=('22c37dc90c871e8e052b2cab0ad219d010fa938608cd66b21c8f3c759046fa36'
-            'fe031849b891e0fa72114b01e2b87f6a2e75c51832727fb5abaf9d8db83b4d29'
-            '98db498234da573a9d837dcb0220686c849411fc0aeccf0e8d702c51ac2de4f2'
-            'c39c6ddd90fb7311440ec1709a4bcda2d600c9a7b3a9c93be8ab899b932f04e8'
-            '71d3f333d05ffbb6dcbe27a6e4655593c8298a95ade52673c4dfd5ae46d923cd'
-            '85598c3964862b4d4d2314ab8f783eefaef6cbb22fb8a3a339cd60e611dad6ff'
-            '7f89cfa626e198660da37cae0339d02f42216cf92eadcdeda05efe35c3c41a71'
-            '1fa4fe4070ced28ccdd74dc284c71fe13e19091f7d01b47fdf34fe23539b8d58'
-            '831caf28a16c729e56e08600eee8d19c20f3bdb3a5df56815cde45a248555358'
-            '36edd03e4cfcde14830e345256b05b8630d9f25ce714455cf1a910d5ab30c341'
-            '6cfcc8660968c97ff95e1df0b0725076838b4d35ffaa17c65afcf09ebca3170d'
-            'fc8d166a97329755cff25a1f444b3892071ff5618ef698e27de5bfb004373937')
+sha256sums=('6e639eafce4c8a3b7782c2a8a2d467be097c5896eae86fcde0f608666ea88249'
+            '4d50ffa5e6fb52c69fe05fd19ec8e76c71199e29bb515a95ea08aecd79f54a0a'
+            'd2c8f7ea00c4ec4f1be5b26ec058c342f9bb6676c84f3cad934ff12a80417236'
+            '6006a3e14f45b69618c4f2bf982b820938f306ab21aa2a0b7d1b4309d59f6cb5')
 
 prepare() {
   cd "${srcdir}/${pkgname}-${pkgver}"
 
   # Patches from https://src.fedoraproject.org/rpms/ssmtp/tree/main
-  patch -p1 -i "${srcdir}/ssmtp-md5auth-non-rsa.patch"
-  patch -p1 -i "${srcdir}/ssmtp-garbage_writes.patch"
-  patch -p1 -i "${srcdir}/ssmtp-authpass.patch"
+  patch -p1 -i "${srcdir}/ssmtp-defaultvalues.patch"
   patch -p1 -i "${srcdir}/ssmtp-aliases.patch"
-  patch -p1 -i "${srcdir}/ssmtp-remote-addr.patch"
-  patch -p1 -i "${srcdir}/ssmtp-validate-TLS-server-cert.patch"
-  patch -p1 -i "${srcdir}/ssmtp-defaultvalues.patch"
-  patch -p1 -i "${srcdir}/ssmtp-configure-c99.patch"
-  patch -p1 -i "${srcdir}/ssmtp-c23.patch"
 
   # Other patches
-  patch -p1 -i "${srcdir}/openssl_crypto.patch"
   patch -p1 -i "${srcdir}/xoauth2.patch"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-15 13:19:52	Medium	1
2026-06-18 16:11:54	Clean	0