yubihsm2-sdk
LOW
maintainer Ganji
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt RPMs from Yubico's official developer domain, extracts and installs binaries and libraries; while the host is not a standard code forge, it is the official vendor site, and the installed components are legitimate SDK tools and libraries for YubiHSM2, with no evidence of malicious or obfuscated code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt RPMs from Yubico's official developer domain, extracts and installs binaries and libraries; while the host is not a standard code forge, it is the official vendor site, and the installed components are legitimate SDK tools and libraries for YubiHSM2, with no evidence of malicious or obfuscated code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
"https://developers.yubico.com/YubiHSM2/Releases/yubihsm2-sdk-2024-09-fedora40-amd64.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nicolas Stalder <n+archlinux@stalder.io>
2
pkgname=yubihsm2-sdk
3
pkgver=2024.09
4
pkgrel=1
5
pkgdesc="YubiHSM2 SDK"
6
url="https://developers.yubico.com/YubiHSM2/Releases/"
7
arch=(x86_64)
8
license=(Apache "custom:https://www.yubico.com/support/terms-conditions/yubico-license-agreement/")
9
# bind contains pkcs11.h
10
# libusb contains libusb-1.0.so
11
# openssl contains libcrypto.so
12
depends=(bind curl libusb)
13
14
source=(
15
"https://developers.yubico.com/YubiHSM2/Releases/yubihsm2-sdk-2024-09-fedora40-amd64.tar.gz"
16
"70-yubihsm2.rules"
17
"yubihsm-connector.service"
18
"yubihsm-connector.yaml"
19
)
20
sha256sums=('aa0bf9dbca4e3b392a57b085ff2141246e4f7a30953d85a4f043e61fe8d4dd86'
21
'SKIP'
22
'SKIP'
23
'SKIP')
24
25
prepare() {
26
cd $srcdir
27
28
mkdir -p yubihsm-connector
29
bsdtar -xf yubihsm2-sdk/yubihsm-connector-3.0.5-1.fc40.x86_64.rpm -C yubihsm-connector
30
31
mkdir -p yubihsm-devel
32
bsdtar -xf yubihsm2-sdk/yubihsm-devel-2.6.0-1.fc40.x86_64.rpm -C yubihsm-devel
33
34
mkdir -p yubihsm-setup
35
bsdtar -xf yubihsm2-sdk/yubihsm-setup-2.3.2-1.fc40.x86_64.rpm -C yubihsm-setup
36
37
mkdir -p yubihsm-shell
38
bsdtar -xf yubihsm2-sdk/yubihsm-shell-2.6.0-1.fc40.x86_64.rpm -C yubihsm-shell
39
40
}
41
42
package() {
43
# yubihsm-connector
44
install -Dt "$pkgdir/usr/bin" yubihsm-connector/usr/bin/yubihsm-connector
45
install -Dt "$pkgdir/usr/share/licenses/$pkgname/yubihsm-connector" yubihsm-connector/usr/share/licenses/yubihsm-connector/LICENSE
46
47
# yubihsm-devel
48
install -Dt "$pkgdir/usr/include" yubihsm-devel/usr/include/yubihsm.h
49
# install -Dt "$pkgdir/usr/include/pkcs11" yubihsm-devel/usr/include/pkcs11/pkcs11.h
50
install -Dt "$pkgdir/usr/include/pkcs11" yubihsm-devel/usr/include/pkcs11/pkcs11y.h
51
52
mkdir "$pkgdir/usr/lib"
53
cp -d yubihsm-devel/usr/lib64/libyubihsm_http.so "$pkgdir/usr/lib"
54
cp -d yubihsm-devel/usr/lib64/libyubihsm.so "$pkgdir/usr/lib"
55
cp -d yubihsm-devel/usr/lib64/libyubihsm_usb.so "$pkgdir/usr/lib"
56
install -Dt "$pkgdir/usr/lib/pkgconfig" yubihsm-devel/usr/lib64/pkgconfig/yubihsm.pc
57
58
# yubihsm-setup
59
install -Dt "$pkgdir/usr/bin" yubihsm-setup/usr/bin/yubihsm-setup
60
61
# yubihsm-shell
62
shell_version=2.6.0
63
install -Dt "$pkgdir/usr/bin" yubihsm-shell/usr/bin/yubihsm-shell
64
install -Dt "$pkgdir/usr/bin" yubihsm-shell/usr/bin/yubihsm-wrap
65
cp -d yubihsm-shell/usr/lib64/libyubihsm_http.so.2 "$pkgdir/usr/lib"
66
install -Dt "$pkgdir/usr/lib" yubihsm-shell/usr/lib64/libyubihsm_http.so.${shell_version}
67
cp -d yubihsm-shell/usr/lib64/libyubihsm.so.2 "$pkgdir/usr/lib"
68
install -Dt "$pkgdir/usr/lib" yubihsm-shell/usr/lib64/libyubihsm.so.${shell_version}
69
cp -d yubihsm-shell/usr/lib64/libykhsmauth.so.2 "$pkgdir/usr/lib"
70
install -Dt "$pkgdir/usr/lib" yubihsm-shell/usr/lib64/libykhsmauth.so.${shell_version}
71
cp -d yubihsm-shell/usr/lib64/libyubihsm_usb.so.2 "$pkgdir/usr/lib"
72
install -Dt "$pkgdir/usr/lib" yubihsm-shell/usr/lib64/libyubihsm_usb.so.${shell_version}
73
install -Dt "$pkgdir/usr/lib/pkcs11" yubihsm-shell/usr/lib64/pkcs11/yubihsm_pkcs11.so
74
install -Dt "$pkgdir/usr/share/licenses/$pkgname/yubihsm-shell" yubihsm-shell/usr/share/licenses/yubihsm-shell/LICENSE
75
76
# udev rule
77
# NB: /usr/lib/udev/rules.d/30-systemd-udev-reload.hook a triggers on installation
78
# of this file, so we don't need additional post_{install,upgrade} scripts
79
install -m644 -Dt "$pkgdir/usr/lib/udev/rules.d" 70-yubihsm2.rules
80
81
# sample systemd service
82
install -Dm644 yubihsm-connector.service -t $pkgdir/usr/lib/systemd/system
83
install -Dm644 yubihsm-connector.yaml -t $pkgdir/etc
84
85
}
86
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |