warsaw

maintainer nicolascomman · 39 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary installer (.run file) from cloud.gastecnologia.com.br, which is the official distribution host for GAS Tecnologia's Warsaw banking security module (used by Banco do Brasil and other Brazilian banks). The host is the legitimate vendor's own CDN/cloud storage, not a random personal host. However, the concern is real: this is a closed-source, prebuilt binary that gets extracted and installed as a privileged security daemon with multiple shared libraries (.so files) and binaries running as root-level services. The sha256 checksums are present and pinned, which mitigates substitution attacks at download time, but the binary itself is opaque and could contain anything. The package is well-known in the Brazilian Linux community and has been in the AUR for years. The medium rating is appropriate not because the host is suspicious per se, but because installing an opaque, closed-source binary security daemon from any vendor — even a legitimate one — carries inherent supply-chain risk: if the vendor's server is compromised or the vendor pushes a malicious update, users get arbitrary code execution with system-level access. This is a genuine medium-severity concern (executed binary from a non-open-source vendor host), not a false positive, but also not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=(https://cloud.gastecnologia.com.br/bb/downloads/ws/warsaw_64_installer.run)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): This PKGBUILD downloads a prebuilt binary installer (.run file) from cloud.gastecnologia.com.br, which is the official distribution host for GAS Tecnologia's Warsaw banking security module (used by Banco do Brasil and other Brazilian banks). The host is the legitimate vendor's own CDN/cloud storage, not a random personal host. However, the concern is real: this is a closed-source, prebuilt binary that gets extracted and installed as a privileged security daemon with multiple shared libraries (.so files) and binaries running as root-level services. The sha256 checksums are present and pinned, which mitigates substitution attacks at download time, but the binary itself is opaque and could contain anything. The package is well-known in the Brazilian Linux community and has been in the AUR for years. The medium rating is appropriate not because the host is suspicious per se, but because installing an opaque, closed-source binary security daemon from any vendor — even a legitimate one — carries inherent supply-chain risk: if the vendor's server is compromised or the vendor pushes a malicious update, users get arbitrary code execution with system-level access. This is a genuine medium-severity concern (executed binary from a non-open-source vendor host), not a false positive, but also not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: afterSt0rm <ateles.1@gmail.com>
    
      2# Contributor: Rafael Fontenlle <rafaelff@gnome.org>
    
      3
    
      4pkgname=warsaw
    
      5pkgver=1.12.3.11
    
      6pkgrel=3
    
      7pkgdesc="Banking security tool developed by GAS Tecnologia"
    
      8arch=(x86_64)
    
      9url="https://seg.bb.com.br"
    
      10license=('custom')
    
      11depends=('openssl' 'nss')
    
      12makedepends=('chrpath')
    
      13options=(!strip)
    
      14conflicts=('warsaw-bin')
    
      15provides=('warsaw')
    
      16source=(warsaw.service)
    
      17source_x86_64=(https://cloud.gastecnologia.com.br/bb/downloads/ws/warsaw_64_installer.run)
    
      18sha256sums=('dde06741817b8b77d9b1150bd10110d8b22330f8e2900fcae06dcedeee10a09e')
    
      19sha256sums_x86_64=('d8d637a2910aed6ab5e9baa9d2bd85c00259ee133e4aa6219bbf7d1dd3b04f40')
    
      20
    
      21_installer=warsaw_64_installer.run
    
      22_warsawdir=tmp/warsaw_x64
    
      23
    
      24prepare() {
    
      25  cd $srcdir
    
      26  
    
      27    # Make sure to have a cleaned up warsaw directory
    
      28  [ ! -d $pkgname-$pkgver ] && mkdir $pkgname-$pkgver
    
      29  [ -d $_warsawdir ] && rm -rf $_warsawdir
    
      30  
    
      31    # Extracts the binary content starting from the line number "L"
    
      32    # (L was informed within the installer)
    
      33  L=363
    
      34  tail -n +$L $_installer | tar -zxvf - -C $pkgname-$pkgver
    
      35}
    
      36
    
      37build() {
    
      38  cd $pkgname-$pkgver/$_warsawdir
    
      39  ./configure --prefix=/usr --sysconfdir=/etc
    
      40}
    
      41
    
      42package() {
    
      43  cd $pkgname-$pkgver/$_warsawdir
    
      44  make DESTDIR="$pkgdir" install
    
      45    
    
      46    # Enable executable permission for binaries
    
      47  chmod +x "$pkgdir/usr/bin/warsaw/core"
    
      48  chmod +x "$pkgdir/usr/bin/warsaw/migratecache"
    
      49  chmod +x "$pkgdir/usr/bin/warsaw/wsatspi"
    
      50  chmod +x "$pkgdir/usr/bin/warsaw/wscertmgr"
    
      51    
    
      52    # Set paths in comply with Arch Packaging Standards
    
      53    # i.e. Use /usr/bin, /etc, and /tmp
    
      54  sed -i 's|/usr/local/etc|/etc|g;s|/var/tmp|/tmp|' \
    
      55    "$pkgdir/usr/bin/warsaw/wscertmgr"
    
      56  sed -i 's|/usr/local/bin|/usr/bin|' \
    
      57    "$pkgdir/etc/xdg/autostart/warsaw.desktop"
    
      58  
    
      59    # Install copyright and license in proper directory
    
      60  install -Dm644 "$pkgdir"/usr/share/{doc,licenses}/warsaw/copyright
    
      61  rm -rf "$pkgdir/usr/share/doc"
    
      62  
    
      63    # Fix insecure RPATH to /usr/local/ directories
    
      64  chrpath -d "$pkgdir/usr/bin/warsaw/migratecache"
    
      65  chrpath -d "$pkgdir/usr/lib/warsaw/wsftuan.so"
    
      66  chrpath -d "$pkgdir/usr/lib/warsaw/wslbmid.so"
    
      67  chrpath -d "$pkgdir/usr/lib/warsaw/wsftup.so"
    
      68  chrpath -d "$pkgdir/usr/lib/warsaw/wsftbmo.so"
    
      69  chrpath -d "$pkgdir/usr/lib/warsaw/wsftbco.so"
    
      70  chrpath -d "$pkgdir/usr/lib/warsaw/wsftbid.so"
    
      71  chrpath -d "$pkgdir/usr/lib/warsaw/wsftdl.so"
    
      72  chrpath -d "$pkgdir/usr/lib/warsaw/wsbrmu.so"
    
      73  
    
      74    # Use systemd service instead of SysVinit script
    
      75  install -Dm644 "$srcdir/warsaw.service" \
    
      76    "$pkgdir/usr/lib/systemd/system/warsaw.service"
    
      77  rm -rf "$pkgdir/etc/init.d"
    
      78  
    
      79    # Use native libraries
    
      80  rm "$pkgdir/usr/lib/warsaw/ld-linux-x86-64.so.2"
    
      81  rm "$pkgdir/usr/lib/warsaw/libc.so.6"
    
      82  rm "$pkgdir/usr/lib/warsaw/libpthread.so.0"
    
      83  rm "$pkgdir/usr/lib/warsaw/libdl.so.2"
    
      84  rm "$pkgdir/usr/lib/warsaw/librt.so.1"
    
      85
    
      86  ln -s /usr/lib/ld-linux-x86-64.so.2 "$pkgdir/usr/lib/warsaw/ld-linux-x86-64.so.2"
    
      87  ln -s /usr/lib/libc.so.6 "$pkgdir/usr/lib/warsaw/libc.so.6"
    
      88  ln -s /usr/lib/libpthread.so.0 "$pkgdir/usr/lib/warsaw/libpthread.so.0"
    
      89  ln -s /usr/lib/libdl.so.2 "$pkgdir/usr/lib/warsaw/libdl.so.2"
    
      90  ln -s /usr/lib/librt.so.1 "$pkgdir/usr/lib/warsaw/librt.so.1"
    
      91
    
      92    # Fix .desktop file
    
      93  sed -i 's/X-GNOME-AutoRestart=true/X-GNOME-AutoRestart=false/g' "$pkgdir/etc/xdg/autostart/warsaw.desktop"
    
      94
    
      95    # Symlink to /usr/local, as the binaries still expect them to be valid
    
      96  install -dm755 "$pkgdir/usr/local/"{etc,bin,lib}
    
      97  ln -s /etc/warsaw/     "$pkgdir/usr/local/etc/warsaw"
    
      98  ln -s /usr/bin/warsaw/ "$pkgdir/usr/local/bin/warsaw"
    
      99  ln -s /usr/lib/warsaw/ "$pkgdir/usr/local/lib/warsaw"
    
      100}
    
      101

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2