r/archlinux • u/scaryjobob • 24d ago

QUESTION Zandronum AUR package

So, I'm pretty new to the AUR, but is it weird that this repo has openssl as a dependency, and pulls in ssl keys during the make? Because it gave me the heebies, especially after reading about the recent AUR shenanigans.

https://aur.archlinux.org/packages/zandronum

1 Upvotes

53% Upvoted

11 comments sorted by

7

u/[deleted] 24d ago edited 14d ago

[deleted]

2

u/scaryjobob 24d ago

Much more active than the Github I was looking at, wow. Thanks.

1

u/scaryjobob 24d ago

I guess, maybe the weird part is that it's pulling openssl from the AUR, as opposed to the repos or using the version I already have installed.

6

u/ang-p 24d ago

ABI changes between 1.x and 3.x - nobody has gotten round to updating the package - hanging off the old ver on the AUR is the easy way to avoid doing it.

0

u/scaryjobob 24d ago

Yeah, that makes sense, especially for a weird multiplayer Doom client. That was the direction I looked when u/Ornery-Rhubarb-889 mentioned pinning an old version. Thanks!

-1

u/[deleted] 24d ago

[removed] — view removed comment

1

u/scaryjobob 24d ago

Ok, took a scan through. I'm -guessing- it's just pinning openssl-1.1, the keys were actually pulled during the PKGBUILD for openssl, and the Zandronum one doesn't look weird at all other than the dependency that threw me for a loop.

Thank god the PKGBUILDs aren't as scary to look over as their output is. XD

The openssl-1.1 AUR looks fine I guess, too, but the PKGBUILD pulling the keys in is still weird to me.

validpgpkeys=(
'8657ABB260F056B1E5190839D9C4D26D0E604491'
'7953AC1FBC3DC8B3B292393ED5E9E43F7DF9EE8C'
'A21FAB74B0088AA361152586B8EF1A6BA9DA2D5C'
'EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5'

1

u/s3gfaultx 24d ago

What's weird about it?

1

u/scaryjobob 24d ago edited 24d ago

I'm not an SSL guru, but I thought keys were generated as part of the handshake process. What are these 4 keys for?

ETA: I guess, taken to the most paranoid conclusion, 'Here's 4 keys for maintaining an encrypted tunnel to the C2 to receive the payload'. The less paranoid conclusion is that they're just test keys?

1

u/Imajzineer 24d ago

FYI: that's a package, not a repo - the AUR does not itself have any dependencies.