Arch Linux User Repository

I've adopted this package given the potential abuse it could receive, and security implications.

I encourage any users of this, and other financial related AUR packages to diligently verify the legitimacy of packages.

Three checks you can do to help with this:

1. Verify the source URL is pointing to the official Atomic Wallet domain.
2. Visit the official Atomic Wallet website, download the rpm file, and confirm the SHA256 sum exactly matches what's stated in the PKGBUILD file.
3. Note changes (diffs) that are pushed when the package is updated, for anything unusual.

@Bink Still happening for me; no change from what I reported yesterday.

Glad to assist if you have any suggs on how to go about investigating further. Could well be I'm doing something dumb on my end.

LATER NOTE (2025.02.26): No change. Issue persists and is 100% reproducible on my setup. wget fails every time.

Here's the wget chatter with --debug:

$ wget --debug https://releases.atomicwallet.io/AtomicWallet-2.90.6.rpm
DEBUG output created by Wget 1.25.0 on linux-gnu.

Reading HSTS entries from /home/gdg/.wget-hsts
URI encoding = ‘UTF-8’
Converted file name 'AtomicWallet-2.90.6.rpm' (UTF-8) -> 'AtomicWallet-2.90.6.rpm' (UTF-8)
--2025-02-26 08:43:10--  https://releases.atomicwallet.io/AtomicWallet-2.90.6.rpm
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Certificates loaded: 327
Resolving releases.atomicwallet.io (releases.atomicwallet.io)... 172.67.70.102, 104.26.6.232, 104.26.7.232, ...
Caching releases.atomicwallet.io => 172.67.70.102 104.26.6.232 104.26.7.232 2606:4700:20::681a:7e8 2606:4700:20::ac43:4666 2606:4700:20::681a:6e8
Connecting to releases.atomicwallet.io (releases.atomicwallet.io)|172.67.70.102|:443... connected.
Created socket 3.
Releasing 0x0000563bf6156910 (new refcount 1).
GnuTLS: An unexpected TLS packet was received.
Closed fd 3
Unable to establish SSL connection.

@grepfor, it looks like that certificates issue may have been a momentary server-side issue. I'm not able to replicate it here today, so hopefully what ever it was, is now resolved.

fyi: Attempting to build 2.90.6-1 from the current snapshot resulted in the following:

$ makepkg
==> Making package: atomicwallet 2.90.6-1 (Sat 22 Feb 2025 10:12:07 MST)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
  -> Downloading AtomicWallet-2.90.6.rpm...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) Send failure: Broken pipe
==> ERROR: Failure while downloading https://releases.atomicwallet.io/AtomicWallet-2.90.6.rpm
    Aborting...

Attempting to directly download the RPM via wget yields this:

$ wget  https://releases.atomicwallet.io/AtomicWallet-2.90.6.rpm
--2025-02-22 10:18:25--  https://releases.atomicwallet.io/AtomicWallet-2.90.6.rpm
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving releases.atomicwallet.io (releases.atomicwallet.io)... 104.26.6.232, 104.26.7.232, 172.67.70.102, ...
Connecting to releases.atomicwallet.io (releases.atomicwallet.io)|104.26.6.232|:443... connected.
GnuTLS: An unexpected TLS packet was received.
Unable to establish SSL connection.

However downloading the RPM via browser (Chromium) using the above URL succeeds, and the sha256sum of the RPM is identical to that shown in the PKGBUILD.

Not sure what I may be doing wrong here, certificate-wise.

@webcaptcha, try using another kernel other than linux-hardened.

The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Atomic Wallet/chrome-sandbox is owned by root and has mode 4755.

Thank You & you're welcome.

Thank you for the heads up @Exdebianmainuser. Updated now.

Greetings and thank you for picking up this project. I am going to say that there is a security update to 2.90 available. If you can do it that would be very helpful.

Thanks!!! Dean Loros

I've adopted this package given the potential abuse it could receive, and security implications.

I encourage any users of this, and other financial related AUR packages to diligently verify the legitimacy of packages.

Three checks you can do to help with this:

1. Verify the source URL is pointing to the official Atomic Wallet domain.
2. Visit the official Atomic Wallet website, download the rpm file, and confirm the SHA256 sum exactly matches what's stated in the PKGBUILD file.
3. Note changes (diffs) that are pushed when the package is updated, for anything unusual.

I'll just disown this. I don't use it anyway. There's a aur-cfg.sh file that was used for automatic maintenance, it can be deleted.