warsaw-openrc

MEDIUM

maintainer ryukinix 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

This PKGBUILD downloads a prebuilt binary installer (.run file) from cloud.gastecnologia.com.br, which is the official GAS Tecnologia (Warsaw) vendor infrastructure — Warsaw is a well-known Brazilian banking security module required by Banco do Brasil and other banks. The host is plausibly official. However, the package installs prebuilt closed-source binaries and shared libraries (.so files) directly into the system, uses MD5 checksums (weak, but present), and notably copies system libraries (ld-linux, libc, libdl, libpthread) from the host system into the package directory. The binary installer is extracted and its embedded configure/make is run, meaning arbitrary prebuilt code from the vendor is executed. This is a genuine medium-risk supply-chain concern: prebuilt binaries from a non-GitHub/non-standard host with only MD5 integrity checks, no source build, and the package installs kernel-level networking sysctl changes and a system daemon. The risk is real but consistent with legitimate (if invasive) banking security software packaging rather than an active attack.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_i686=(https://cloud.gastecnologia.com.br/bb/downloads/ws/warsaw_32_installer.run)

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary installer (.run file) from cloud.gastecnologia.com.br, which is the official GAS Tecnologia (Warsaw) vendor infrastructure — Warsaw is a well-known Brazilian banking security module required by Banco do Brasil and other banks. The host is plausibly official. However, the package installs prebuilt closed-source binaries and shared libraries (.so files) directly into the system, uses MD5 checksums (weak, but present), and notably copies system libraries (ld-linux, libc, libdl, libpthread) from the host system into the package directory. The binary installer is extracted and its embedded configure/make is run, meaning arbitrary prebuilt code from the vendor is executed. This is a genuine medium-risk supply-chain concern: prebuilt binaries from a non-GitHub/non-standard host with only MD5 integrity checks, no source build, and the package installs kernel-level networking sysctl changes and a system daemon. The risk is real but consistent with legitimate (if invasive) banking security software packaging rather than an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Fontenlle <rafaelff@gnome.org>
    
      2# Collaborator: Manoel Vilela <manoel_vilela@engineer.com>
    
      3
    
      4pkgname=warsaw-openrc
    
      5pkgver=1.12.3.11
    
      6pkgrel=5
    
      7pkgdesc="Banking security tool developed by GAS Tecnologia"
    
      8arch=(i686 x86_64)
    
      9url="https://seg.bb.com.br"
    
      10license=('custom')
    
      11depends=('openssl' 'nss' 'openrc')
    
      12makedepends=('chrpath')
    
      13conflicts=("warsaw")
    
      14provides=("warsaw")
    
      15options=(!strip)
    
      16source=(warsaw.service warsaw.openrc)
    
      17source_i686=(https://cloud.gastecnologia.com.br/bb/downloads/ws/warsaw_32_installer.run)
    
      18source_x86_64=(https://cloud.gastecnologia.com.br/bb/downloads/ws/warsaw_64_installer.run)
    
      19md5sums=('d614d1164666e3071d9c2001109b0f18'
    
      20         '0996288430a741c50dc1b89d1909823b')
    
      21md5sums_i686=('b53b1696e2a0624f54eb516538ac655b')
    
      22md5sums_x86_64=('2d19b66de26dbd01a7980427a0535a8f')
    
      23
    
      24
    
      25
    
      26if [[ $CARCH == x86_64 ]]; then
    
      27  _installer=warsaw_64_installer.run
    
      28  _warsawdir=tmp/warsaw_x64
    
      29else
    
      30  _installer=warsaw_32_installer.run
    
      31  _warsawdir=tmp/warsaw_x86
    
      32fi
    
      33
    
      34prepare() {
    
      35  cd $srcdir
    
      36
    
      37  # Make sure to have a cleaned up warsaw directory
    
      38  [ ! -d $pkgname-$pkgver ] && mkdir $pkgname-$pkgver
    
      39  [ -d $_warsawdir ] && rm -rf $_warsawdir
    
      40
    
      41  # Extracts the binary content starting from the line number "L"
    
      42  # (L was informed within the installer)
    
      43  L=363
    
      44  tail -n +$L $_installer | tar -zxvf - -C $pkgname-$pkgver
    
      45}
    
      46
    
      47build() {
    
      48  cd $pkgname-$pkgver/$_warsawdir
    
      49  ./configure --prefix=/usr --sysconfdir=/etc
    
      50}
    
      51
    
      52package() {
    
      53  cd $pkgname-$pkgver/$_warsawdir
    
      54  make DESTDIR="$pkgdir" install
    
      55
    
      56  # Enable executable permission for binaries
    
      57  chmod +x "$pkgdir/usr/bin/warsaw/core"
    
      58  chmod +x "$pkgdir/usr/bin/warsaw/migratecache"
    
      59  chmod +x "$pkgdir/usr/bin/warsaw/wsatspi"
    
      60  chmod +x "$pkgdir/usr/bin/warsaw/wscertmgr"
    
      61
    
      62  # Set paths in comply with Arch Packaging Standards
    
      63  # i.e. Use /usr/bin, /etc, and /tmp
    
      64  sed -i 's|/usr/local/etc|/etc|g;s|/var/tmp|/tmp|' \
    
      65    "$pkgdir/usr/bin/warsaw/wscertmgr"
    
      66  sed -i 's|/usr/local/bin|/usr/bin|' \
    
      67    "$pkgdir/etc/xdg/autostart/warsaw.desktop"
    
      68
    
      69  # this should be replaced to the systemd/openrc daemon
    
      70  rm -rf "$pkgdir/etc/xdg/"
    
      71
    
      72  # Install copyright and license in proper directory
    
      73  install -Dm644 "$pkgdir"/usr/share/{doc,licenses}/warsaw/copyright
    
      74  rm -rf "$pkgdir/usr/share/doc"
    
      75
    
      76  # Fix insecure RPATH to /usr/local/ directories
    
      77  chrpath -d "$pkgdir/usr/bin/warsaw/migratecache"
    
      78  chrpath -d "$pkgdir/usr/lib/warsaw/wsftuan.so"
    
      79  chrpath -d "$pkgdir/usr/lib/warsaw/wslbmid.so"
    
      80  chrpath -d "$pkgdir/usr/lib/warsaw/wsftup.so"
    
      81  chrpath -d "$pkgdir/usr/lib/warsaw/wsftbmo.so"
    
      82  chrpath -d "$pkgdir/usr/lib/warsaw/wsftbco.so"
    
      83  chrpath -d "$pkgdir/usr/lib/warsaw/wsftbid.so"
    
      84  chrpath -d "$pkgdir/usr/lib/warsaw/wsftdl.so"
    
      85  chrpath -d "$pkgdir/usr/lib/warsaw/wsbrmu.so"
    
      86
    
      87  # :: Use systemd or openrc service instead of SysVinit script
    
      88  # if user use openrc, so then install warsaw.openrc
    
      89  if (pacman -Qi openrc &> /dev/null); then
    
      90      # override sysinit to OpenRC script
    
      91      install -Dm755 "$srcdir/warsaw.openrc" "$pkgdir/etc/init.d/warsaw"
    
      92  else
    
      93      install -Dm644 "$srcdir/warsaw.service" \
    
      94              "$pkgdir/usr/lib/systemd/system/warsaw.service"
    
      95      rm -rf "$pkgdir/etc/init.d"
    
      96  fi
    
      97
    
      98
    
      99  # Symlink to /usr/local, as the binaries still expect them to be valid
    
      100  install -dm755 "$pkgdir/usr/local/"{etc,bin,lib}
    
      101  ln -s /etc/warsaw/     "$pkgdir/usr/local/etc/warsaw"
    
      102  ln -s /usr/bin/warsaw/ "$pkgdir/usr/local/bin/warsaw"
    
      103  ln -s /usr/lib/warsaw/ "$pkgdir/usr/local/lib/warsaw"
    
      104
    
      105  # fixing the new 2018 cancer from
    
      106  # fbello comments at https://aur.archlinux.org/packages/warsaw/?comments=all
    
      107  for i in ld-linux-x86-64.so.2 libc.so.6 libdl.so.2 libpthread.so.0; do
    
      108    cp /usr/lib/$i $pkgdir/usr/lib/warsaw/$i
    
      109  done
    
      110
    
      111  install -dm755  $pkgdir/etc/sysctl.d/
    
      112  cat << EOF > $pkgdir/etc/sysctl.d/warsaw.conf
    
      113net.ipv4.tcp_syncookies=1
    
      114net.ipv4.tcp_synack_retries=3
    
      115net.ipv4.tcp_max_syn_backlog=65536
    
      116EOF
    
      117}
    
      118

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2