warsaw-openrc
maintainer ryukinix
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
This PKGBUILD downloads a prebuilt binary installer (.run file) from cloud.gastecnologia.com.br, which is the official GAS Tecnologia (Warsaw) vendor infrastructure — Warsaw is a well-known Brazilian banking security module required by Banco do Brasil and other banks. The host is plausibly official. However, the package installs prebuilt closed-source binaries and shared libraries (.so files) directly into the system, uses MD5 checksums (weak, but present), and notably copies system libraries (ld-linux, libc, libdl, libpthread) from the host system into the package directory. The binary installer is extracted and its embedded configure/make is run, meaning arbitrary prebuilt code from the vendor is executed. This is a genuine medium-risk supply-chain concern: prebuilt binaries from a non-GitHub/non-standard host with only MD5 integrity checks, no source build, and the package installs kernel-level networking sysctl changes and a system daemon. The risk is real but consistent with legitimate (if invasive) banking security software packaging rather than an active attack.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
source_i686=(https://cloud.gastecnologia.com.br/bb/downloads/ws/warsaw_32_installer.run)
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary installer (.run file) from cloud.gastecnologia.com.br, which is the official GAS Tecnologia (Warsaw) vendor infrastructure — Warsaw is a well-known Brazilian banking security module required by Banco do Brasil and other banks. The host is plausibly official. However, the package installs prebuilt closed-source binaries and shared libraries (.so files) directly into the system, uses MD5 checksums (weak, but present), and notably copies system libraries (ld-linux, libc, libdl, libpthread) from the host system into the package directory. The binary installer is extracted and its embedded configure/make is run, meaning arbitrary prebuilt code from the vendor is executed. This is a genuine medium-risk supply-chain concern: prebuilt binaries from a non-GitHub/non-standard host with only MD5 integrity checks, no source build, and the package installs kernel-level networking sysctl changes and a system daemon. The risk is real but consistent with legitimate (if invasive) banking security software packaging rather than an active attack.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Rafael Fontenlle <rafaelff@gnome.org>
2
# Collaborator: Manoel Vilela <manoel_vilela@engineer.com>
3
4
pkgname=warsaw-openrc
5
pkgver=1.12.3.11
6
pkgrel=5
7
pkgdesc="Banking security tool developed by GAS Tecnologia"
8
arch=(i686 x86_64)
9
url="https://seg.bb.com.br"
10
license=('custom')
11
depends=('openssl' 'nss' 'openrc')
12
makedepends=('chrpath')
13
conflicts=("warsaw")
14
provides=("warsaw")
15
options=(!strip)
16
source=(warsaw.service warsaw.openrc)
17
source_i686=(https://cloud.gastecnologia.com.br/bb/downloads/ws/warsaw_32_installer.run)
18
source_x86_64=(https://cloud.gastecnologia.com.br/bb/downloads/ws/warsaw_64_installer.run)
19
md5sums=('d614d1164666e3071d9c2001109b0f18'
20
'0996288430a741c50dc1b89d1909823b')
21
md5sums_i686=('b53b1696e2a0624f54eb516538ac655b')
22
md5sums_x86_64=('2d19b66de26dbd01a7980427a0535a8f')
23
24
25
26
if [[ $CARCH == x86_64 ]]; then
27
_installer=warsaw_64_installer.run
28
_warsawdir=tmp/warsaw_x64
29
else
30
_installer=warsaw_32_installer.run
31
_warsawdir=tmp/warsaw_x86
32
fi
33
34
prepare() {
35
cd $srcdir
36
37
# Make sure to have a cleaned up warsaw directory
38
[ ! -d $pkgname-$pkgver ] && mkdir $pkgname-$pkgver
39
[ -d $_warsawdir ] && rm -rf $_warsawdir
40
41
# Extracts the binary content starting from the line number "L"
42
# (L was informed within the installer)
43
L=363
44
tail -n +$L $_installer | tar -zxvf - -C $pkgname-$pkgver
45
}
46
47
build() {
48
cd $pkgname-$pkgver/$_warsawdir
49
./configure --prefix=/usr --sysconfdir=/etc
50
}
51
52
package() {
53
cd $pkgname-$pkgver/$_warsawdir
54
make DESTDIR="$pkgdir" install
55
56
# Enable executable permission for binaries
57
chmod +x "$pkgdir/usr/bin/warsaw/core"
58
chmod +x "$pkgdir/usr/bin/warsaw/migratecache"
59
chmod +x "$pkgdir/usr/bin/warsaw/wsatspi"
60
chmod +x "$pkgdir/usr/bin/warsaw/wscertmgr"
61
62
# Set paths in comply with Arch Packaging Standards
63
# i.e. Use /usr/bin, /etc, and /tmp
64
sed -i 's|/usr/local/etc|/etc|g;s|/var/tmp|/tmp|' \
65
"$pkgdir/usr/bin/warsaw/wscertmgr"
66
sed -i 's|/usr/local/bin|/usr/bin|' \
67
"$pkgdir/etc/xdg/autostart/warsaw.desktop"
68
69
# this should be replaced to the systemd/openrc daemon
70
rm -rf "$pkgdir/etc/xdg/"
71
72
# Install copyright and license in proper directory
73
install -Dm644 "$pkgdir"/usr/share/{doc,licenses}/warsaw/copyright
74
rm -rf "$pkgdir/usr/share/doc"
75
76
# Fix insecure RPATH to /usr/local/ directories
77
chrpath -d "$pkgdir/usr/bin/warsaw/migratecache"
78
chrpath -d "$pkgdir/usr/lib/warsaw/wsftuan.so"
79
chrpath -d "$pkgdir/usr/lib/warsaw/wslbmid.so"
80
chrpath -d "$pkgdir/usr/lib/warsaw/wsftup.so"
81
chrpath -d "$pkgdir/usr/lib/warsaw/wsftbmo.so"
82
chrpath -d "$pkgdir/usr/lib/warsaw/wsftbco.so"
83
chrpath -d "$pkgdir/usr/lib/warsaw/wsftbid.so"
84
chrpath -d "$pkgdir/usr/lib/warsaw/wsftdl.so"
85
chrpath -d "$pkgdir/usr/lib/warsaw/wsbrmu.so"
86
87
# :: Use systemd or openrc service instead of SysVinit script
88
# if user use openrc, so then install warsaw.openrc
89
if (pacman -Qi openrc &> /dev/null); then
90
# override sysinit to OpenRC script
91
install -Dm755 "$srcdir/warsaw.openrc" "$pkgdir/etc/init.d/warsaw"
92
else
93
install -Dm644 "$srcdir/warsaw.service" \
94
"$pkgdir/usr/lib/systemd/system/warsaw.service"
95
rm -rf "$pkgdir/etc/init.d"
96
fi
97
98
99
# Symlink to /usr/local, as the binaries still expect them to be valid
100
install -dm755 "$pkgdir/usr/local/"{etc,bin,lib}
101
ln -s /etc/warsaw/ "$pkgdir/usr/local/etc/warsaw"
102
ln -s /usr/bin/warsaw/ "$pkgdir/usr/local/bin/warsaw"
103
ln -s /usr/lib/warsaw/ "$pkgdir/usr/local/lib/warsaw"
104
105
# fixing the new 2018 cancer from
106
# fbello comments at https://aur.archlinux.org/packages/warsaw/?comments=all
107
for i in ld-linux-x86-64.so.2 libc.so.6 libdl.so.2 libpthread.so.0; do
108
cp /usr/lib/$i $pkgdir/usr/lib/warsaw/$i
109
done
110
111
install -dm755 $pkgdir/etc/sysctl.d/
112
cat << EOF > $pkgdir/etc/sysctl.d/warsaw.conf
113
net.ipv4.tcp_syncookies=1
114
net.ipv4.tcp_synack_retries=3
115
net.ipv4.tcp_max_syn_backlog=65536
116
EOF
117
}
118
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |