ssmtp
LOW
maintainer dcelasun
10 votes
scanned 2026-10-30 00:29:30.650963
Why flagged
The package sets setuid on ssmtp, which is a privileged operation, but this is a standard requirement for ssmtp to function as a setuid MTA to send mail; it is not inherently malicious or unusual for this software.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package sets setuid on ssmtp, which is a privileged operation, but this is a standard requirement for ssmtp to function as a setuid MTA to send mail; it is not inherently malicious or unusual for this software.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:84
chmod 2755 "${pkgdir}/usr/bin/ssmtp"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: D. Can Celasun <can[at]dcc[dot]im>
2
3
# To use, put `AuthMethod=XOAUTH2` and `AuthPass=<your obtained OAuth2 access token>` in `/etc/ssmtp/ssmtp.conf`.
4
#
5
# Remember that your OAuth2 access token is often short-lived and will expire in small intervals. (for example, Gmail access tokens expire in 1 hour) You will need a script to refresh it using a long-term refresh token.
6
#
7
# For Gmail, oauth2l (https://github.com/google/oauth2l, https://aur.archlinux.org/packages/oauth2l) can be used to obtain and refresh the access token using your own registered client secret with Google. Example script:
8
#
9
# #!/bin/bash
10
# ACCESS_TOKEN=$(oauth2l fetch --scope=https://mail.google.com/ \
11
# --credentials=/etc/oauth2l.json --cache=/etc/ssmtp/oauth2l.cache --refresh)
12
# sed -i "s/^AuthPass=.*$/AuthPass=$ACCESS_TOKEN/" /etc/ssmtp/ssmtp.conf
13
#
14
# To refresh the access token every time before sending an email from the command line:
15
#
16
# /etc/oauth2l.json is your client ID info
17
# /etc/ssmtp/oauth2l.cache is the oauth2l cache location for storing the refresh token.
18
19
pkgname=ssmtp
20
pkgver=2.66
21
pkgrel=1
22
pkgdesc="Extremely simple MTA to get mail off the system to a mailhub (with Fedora patches)"
23
arch=('i686' 'x86_64' 'aarch64' 'armv7h')
24
license=('GPL-2.0-or-later')
25
url="https://github.com/Project-OSS-Revival/ssmtp"
26
depends=('openssl' 'inetutils')
27
makedepends=('systemd') # Needed for sysusers.d to create the 'mail' group
28
conflicts=('exim' 'smtp-forwarder')
29
provides=('smtp-forwarder')
30
backup=('etc/ssmtp/ssmtp.conf' 'etc/ssmtp/revaliases')
31
options=('!makeflags' '!emptydirs')
32
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Project-OSS-Revival/ssmtp/archive/refs/tags/v${pkgver}.tar.gz"
33
'ssmtp-defaultvalues.patch'
34
'ssmtp-aliases.patch'
35
'xoauth2.patch'
36
)
37
sha256sums=('6e639eafce4c8a3b7782c2a8a2d467be097c5896eae86fcde0f608666ea88249'
38
'4d50ffa5e6fb52c69fe05fd19ec8e76c71199e29bb515a95ea08aecd79f54a0a'
39
'd2c8f7ea00c4ec4f1be5b26ec058c342f9bb6676c84f3cad934ff12a80417236'
40
'6006a3e14f45b69618c4f2bf982b820938f306ab21aa2a0b7d1b4309d59f6cb5')
41
42
prepare() {
43
cd "${srcdir}/${pkgname}-${pkgver}"
44
45
# Patches from https://src.fedoraproject.org/rpms/ssmtp/tree/main
46
patch -p1 -i "${srcdir}/ssmtp-defaultvalues.patch"
47
patch -p1 -i "${srcdir}/ssmtp-aliases.patch"
48
49
# Other patches
50
patch -p1 -i "${srcdir}/xoauth2.patch"
51
}
52
53
build() {
54
cd "${srcdir}/${pkgname}-${pkgver}"
55
56
autoreconf
57
58
CFLAGS="-Wno-pointer-to-int-cast -Wno-discarded-qualifiers -Wno-int-conversion" \
59
./configure --prefix=/usr \
60
--sysconfdir=/etc \
61
--mandir=/usr/share/man \
62
--enable-ssl\
63
--enable-inet6
64
make
65
}
66
67
package() {
68
cd "${srcdir}/${pkgname}-${pkgver}"
69
yes | make prefix="${pkgdir}/usr" mandir="${pkgdir}/usr/share/man/man8" etcdir="${pkgdir}/etc" install
70
71
install -D -m644 ssmtp.conf.5 "${pkgdir}/usr/share/man/man5/ssmtp.conf.5"
72
install -m644 ssmtp.conf "${pkgdir}/etc/ssmtp/ssmtp.conf"
73
74
chown -R root:mail "${pkgdir}/etc/ssmtp"
75
chmod 770 "${pkgdir}/etc/ssmtp"
76
77
ln -s ssmtp "${pkgdir}/usr/sbin/sendmail"
78
ln -s ssmtp "${pkgdir}/usr/sbin/newaliases"
79
ln -s ssmtp "${pkgdir}/usr/sbin/mailq"
80
cd "$pkgdir"
81
mv usr/sbin usr/bin
82
83
chown root:mail "${pkgdir}/usr/bin/ssmtp"
84
chmod 2755 "${pkgdir}/usr/bin/ssmtp"
85
}
86
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |