tresorit

maintainer chriffpy · 11 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer from 'installerstorage.blob.core.windows.net', which is Microsoft Azure Blob Storage. This is actually a plausible official distribution channel for Tresorit (a commercial encrypted cloud storage product), as many vendors use Azure CDN/blob storage for their installers. The sha512sum is present and pins the binary, which provides integrity protection against substitution at the CDN level. However, signature verification is explicitly disabled (commented out) due to OpenSSL 3 compatibility issues, meaning the only protection is the sha512sum in the PKGBUILD itself. The installer is a self-extracting archive that gets unpacked and installed to /opt/tresorit, including binaries that will be executed. The concern is real but moderate: the sha512sum provides meaningful protection, the Azure host is consistent with Tresorit's known distribution infrastructure, and the package is for a legitimate commercial product. The disabled cryptographic signature verification is a genuine regression in security posture, but the sha512sum pinning partially compensates. This remains a medium-risk package due to the prebuilt binary from a CDN host with disabled signature verification, though it is not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("tresorit_installer_${pkgver}.run::https://installerstorage.blob.core.windows.net/public/install/tresorit_installer.run"
PKGBUILD:17 "check_signature.sh::https://support.tresorit.com/hc/en-us/article_attachments/25125072592530"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer from 'installerstorage.blob.core.windows.net', which is Microsoft Azure Blob Storage. This is actually a plausible official distribution channel for Tresorit (a commercial encrypted cloud storage product), as many vendors use Azure CDN/blob storage for their installers. The sha512sum is present and pins the binary, which provides integrity protection against substitution at the CDN level. However, signature verification is explicitly disabled (commented out) due to OpenSSL 3 compatibility issues, meaning the only protection is the sha512sum in the PKGBUILD itself. The installer is a self-extracting archive that gets unpacked and installed to /opt/tresorit, including binaries that will be executed. The concern is real but moderate: the sha512sum provides meaningful protection, the Azure host is consistent with Tresorit's known distribution infrastructure, and the package is for a legitimate commercial product. The disabled cryptographic signature verification is a genuine regression in security posture, but the sha512sum pinning partially compensates. This remains a medium-risk package due to the prebuilt binary from a CDN host with disabled signature verification, though it is not clearly malicious.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Christopher Gertig <hi@chriffpy.de>
    
      2# Contributor: Gerardo Junior <me@gerardo-junior.com>
    
      3# Contributor: Xaver Hellauer <software@hellauer.bayern>
    
      4# Previous Maintainer: Michael Stapelberg <michael@stapelberg.ch>
    
      5
    
      6pkgname=tresorit
    
      7pkgver=3.5.1281.4700
    
      8pkgrel=1
    
      9pkgdesc='Encrypted cloud storage for your confidential files. Using Tresorit, files are encrypted before being uploaded to the cloud. Start encrypting files for free.'
    
      10arch=('i686' 'x86_64')
    
      11url="http://www.tresorit.com/"
    
      12install=tresorit.install
    
      13license=('custom:tresorit')
    
      14depends=(bash libglvnd)
    
      15makedepends=('xxd' 'sed')
    
      16source=("tresorit_installer_${pkgver}.run::https://installerstorage.blob.core.windows.net/public/install/tresorit_installer.run"
    
      17        "check_signature.sh::https://support.tresorit.com/hc/en-us/article_attachments/25125072592530"
    
      18        "tresorit.service")
    
      19sha512sums=('a329ee3e5870481dd357d389da664711230add49c7ba74db04bd0bb0116b6ffde9930e6a320481d4d7d1ee0ed00b2afaa38ede948da16fe81e4faf7e07a817e9'
    
      20            '73515383174adc51c9da24e6f238e92ede445cbf75d55f927cb51a1a57f630ed95eda2740ac52d2997daf6105f2e22f11591b3208c4296c7d614daaa5f3c57ed'
    
      21            '58aa3738fd17d5930ed76b9491a3ef0dd481b918f5329b56650e6d77078ad74caeea60c9cf83d524a483a9be7fc41aba2712400922d4ab3db775f1c2a1365765')
    
      22
    
      23prepare() {
    
      24  # NOTE: signature verification is temporarily disabled because it no longer
    
      25  # works with OpenSSL 3. I reached out to tresorit via email, asking them to
    
      26  # update their script to work with OpenSSL 3.
    
      27
    
      28  # # Validate signature
    
      29  # sed -i -- "s/tresorit_installer.run/tresorit_installer_${pkgver}.run/g" check_signature.sh
    
      30  # chmod u+x check_signature.sh
    
      31  # VERIFICATION_RESULT=`./check_signature.sh`
    
      32  # echo "$VERIFICATION_RESULT"
    
      33  # if [ "$VERIFICATION_RESULT" != "Verified OK" ]; then
    
      34  #   echo "    ! Binary signature verification failed"
    
      35  #   exit 1
    
      36  # fi
    
      37
    
      38  SKIP=`head tresorit_installer_${pkgver}.run | grep "^SKIP" | sed 's/SKIP=//'`
    
      39  mkdir -p tresorit
    
      40  tail -n+$SKIP tresorit_installer_${pkgver}.run | tar xz -C tresorit
    
      41}
    
      42
    
      43package() {
    
      44  mkdir -p "${pkgdir}/opt/$pkgname"
    
      45  install -Dm755 ../archlinux_user_install "$pkgdir/opt/tresorit/archlinux_user_install"
    
      46  install -Dm755 ../systemd_runner "$pkgdir/opt/tresorit/systemd_runner"
    
      47  install -Dm644 "$srcdir"/tresorit.service "$pkgdir"/usr/lib/systemd/user/tresorit.service
    
      48
    
      49  if [ $CARCH == "x86_64" ]; then
    
      50      cp -r ./tresorit/tresorit_x64/* "$pkgdir/opt/$pkgname"
    
      51  else
    
      52      cp -r ./tresorit/tresorit_x86/* "$pkgdir/opt/$pkgname"
    
      53  fi
    
      54
    
      55  desktop="${pkgdir}/opt/tresorit/tresorit.desktop"
    
      56
    
      57  # Set Exec
    
      58  if grep -q '^Exec=' "$desktop"; then
    
      59    sed -i 's|^Exec=.*|Exec=\$HOME/.local/share/tresorit/tresorit --hidden|' "$desktop"
    
      60  else
    
      61    echo 'Exec=$HOME/.local/share/tresorit/tresorit --hidden' >> "$desktop"
    
      62  fi
    
      63
    
      64  # Set Icon
    
      65  if grep -q '^Icon=' "$desktop"; then
    
      66    sed -i 's|^Icon=.*|Icon=/opt/tresorit/tresorit.png|' "$desktop"
    
      67  else
    
      68    echo 'Icon=/opt/tresorit/tresorit.png' >> "$desktop"
    
      69  fi
    
      70
    
      71  mkdir -p "${pkgdir}"/usr/share/licenses/tresorit
    
      72  ln -s /opt/tresorit/LICENSES.txt \
    
      73        "${pkgdir}"/usr/share/licenses/tresorit/LICENSE
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2