trustplugin

MEDIUM

maintainer utrack 0 votes scanned 2026-08-28 11:36:51.139158

View on AUR

Why flagged

Downloads and executes a self-extracting shell script (.deb.sh) from the vendor's own domain (iitrust.ru) to extract a proprietary prebuilt binary; the checksum is pinned so tampering is detectable, but the payload is a prebuilt closed-source executable from a non-mainstream vendor whose infrastructure could be swapped — acceptable risk level for a proprietary native messaging host, but warrants caution.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:47 'trustplugin-linux-debian.deb.sh::https://iitrust.ru/downloads/trustplugin/trustplugin-linux-debian.deb.sh'

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and executes a self-extracting shell script (.deb.sh) from the vendor's own domain (iitrust.ru) to extract a proprietary prebuilt binary; the checksum is pinned so tampering is detectable, but the payload is a prebuilt closed-source executable from a non-mainstream vendor whose infrastructure could be swapped — acceptable risk level for a proprietary native messaging host, but warrants caution.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nikita Koptelov <aur@koptelov.me>
    
      2pkgname=trustplugin
    
      3pkgver=1.4.0.0
    
      4pkgrel=1
    
      5pkgdesc='Native messaging host for the InfoTeCS electronic signature service'
    
      6arch=('x86_64')
    
      7url='https://iitrust.ru/trustplugin'
    
      8license=('LicenseRef-proprietary')
    
      9depends=(
    
      10  'bash'
    
      11  'dbus'
    
      12  'fontconfig'
    
      13  'freetype2'
    
      14  'glib2'
    
      15  'glibc'
    
      16  'harfbuzz'
    
      17  'libcups'
    
      18  'libdrm'
    
      19  'libgcc'
    
      20  'libglvnd'
    
      21  'libice'
    
      22  'libinput'
    
      23  'libpng'
    
      24  'libsm'
    
      25  'libstdc++'
    
      26  'libx11'
    
      27  'libxcb'
    
      28  'libxi'
    
      29  'libxrender'
    
      30  'mesa'
    
      31  'mtdev'
    
      32  'pcsclite'
    
      33  'sqlite'
    
      34  'systemd-libs'
    
      35  'xdg-utils'
    
      36  'zlib'
    
      37)
    
      38makedepends=('patchelf')
    
      39optdepends=(
    
      40  'ccid: smart-card reader support'
    
      41  'libjpeg6-turbo: JPEG image format support'
    
      42  'opensc: additional smart-card tools and drivers'
    
      43  'pcsc-tools: smart-card diagnostics'
    
      44)
    
      45options=('!strip')
    
      46source=(
    
      47  'trustplugin-linux-debian.deb.sh::https://iitrust.ru/downloads/trustplugin/trustplugin-linux-debian.deb.sh'
    
      48  'LICENSE.upstream'
    
      49)
    
      50noextract=('trustplugin-linux-debian.deb.sh')
    
      51sha256sums=(
    
      52  'c5ef312bf21116f18a106e43b3228dda0cec8ef99d2575df3563501b1d83c4cb'
    
      53  'ade960341b5cc7d662aa44259264410a43b1fdb59e262d32cd050d53571ea618'
    
      54)
    
      55
    
      56prepare() {
    
      57  local payload_line
    
      58  payload_line="$(awk '/^PAYLOAD:$/ { print NR + 1; exit }' "$srcdir/trustplugin-linux-debian.deb.sh")"
    
      59  [[ -n "$payload_line" ]]
    
      60
    
      61  tail -n +"$payload_line" "$srcdir/trustplugin-linux-debian.deb.sh" | bsdtar -xf -
    
      62  bsdtar -xf "trust-plugin_${pkgver}-1_amd64.deb"
    
      63}
    
      64
    
      65package() {
    
      66  bsdtar --no-same-owner -xf "$srcdir/data.tar.xz" -C "$pkgdir"
    
      67
    
      68  # $ORIGIN must remain literal for expansion by the dynamic linker.
    
      69  # shellcheck disable=SC2016
    
      70  patchelf --set-rpath '$ORIGIN/../lib' \
    
      71    "$pkgdir/opt/iitrust/trust_plugin/lib/libxml-security-c.so.20.0.4"
    
      72  install -Dm644 "$srcdir/LICENSE.upstream" \
    
      73    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      74  rm -rf "$pkgdir/usr/lib64" "$pkgdir/usr/share/mozilla"
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-28 11:36:51	Medium	3
2026-08-28 11:35:03	Medium	3