akia

maintainer ismet · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a prebuilt .deb from an official government domain using a predictable URL pattern; while the host is not a common whitelist entry, it is plausibly the project's official source, and the payload is unpacked and installed normally without remote code execution or obfuscation.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt .deb from an official government domain using a predictable URL pattern; while the host is not a common whitelist entry, it is plausibly the project's official source, and the payload is unpacked and installed normally without remote code execution or obfuscation.

PKGBUILD

      1# Maintainer: Ismet Togay <ismet.togay+archlinux@gmail.com>
    
      2# Contributor: Osman Karagöz <osmank3[at]gmail[dot]com>
    
      3# Contributor: Can Celasun <dcelasun[at]gmail[dot]com>
    
      4
    
      5pkgname=akia
    
      6pkgver=6.8.10
    
      7pkgrel=1
    
      8pkgdesc="TÜBİTAK AKİS smart card application"
    
      9arch=('x86_64')
    
      10url='https://akiskart.bilgem.tubitak.gov.tr/destek/'
    
      11license=('LicenseRef-custom')
    
      12depends=(
    
      13    'java-runtime>=8'
    
      14    'pcsclite'
    
      15    'ccid'
    
      16    'hicolor-icon-theme'
    
      17)
    
      18optdepends=(
    
      19    'pcsc-tools: smart card reader debugging utilities'
    
      20)
    
      21makedepends=(
    
      22    'icoutils'
    
      23)
    
      24provides=("akia-bin=${pkgver}")
    
      25conflicts=('akia-bin')
    
      26replaces=('akia-bin')
    
      27install='akia.install'
    
      28
    
      29# Upstream serves the .deb inside a WordPress-uploaded .zip whose path embeds
    
      30# the upload year/month. Bumping pkgver requires updating _debver and the
    
      31# _debyear/_debmonth segments below, then running `updpkgsums`.
    
      32_debver="${pkgver//./_}"
    
      33_debyear=2026
    
      34_debmonth=06
    
      35
    
      36source=(
    
      37    "${pkgname}-${pkgver}.deb.zip::${url%/destek/}/wp-content/uploads/sites/33/${_debyear}/${_debmonth}/Akia_linux_${_debver}.deb_.zip"
    
      38    'akia.sh'
    
      39    'akia.desktop'
    
      40    'akia.install'
    
      41    'LICENSE'
    
      42)
    
      43sha256sums=('2a72bc7979835121ff1f3f4e68e45f5724afd0475a2a6c90c9293f90192efb92'
    
      44            'f5854b72bc40f08747e5c9c7fa35fb890d28265eadb8efd9adb8dfda0d6bfa20'
    
      45            '2be59701fc5064051bb848eceb896bc90e25f5a141651576ce92c274fb01daf4'
    
      46            '82bda1d0f457d0e25db5186d1526b59daeb0cdab7db33a874fb3dc66bc87985a'
    
      47            '8c73c5a9978b14becc69df690ae870f46e409c8dc3ff1fe296099492557e16d5')
    
      48
    
      49# NOTE: namcap will warn that libakisp11.so lacks FORTIFY; this is a
    
      50# pre-built vendor binary we cannot recompile, so the warning is accepted.
    
      51
    
      52prepare() {
    
      53    cd "${srcdir}"
    
      54
    
      55    bsdtar -xf "${pkgname}-${pkgver}.deb.zip"
    
      56
    
      57    local debfile
    
      58    debfile=$(find . -maxdepth 3 -type f -name "Akia_linux_${_debver}.deb" | head -n1)
    
      59    if [ -z "${debfile}" ]; then
    
      60        echo "error: could not locate extracted .deb" >&2
    
      61        return 1
    
      62    fi
    
      63
    
      64    bsdtar -xf "${debfile}"
    
      65    bsdtar -xf data.tar.gz
    
      66
    
      67    icotool -x -i 2 -o akia.png opt/Akia/Akia.png
    
      68}
    
      69
    
      70package() {
    
      71    cd "${srcdir}"
    
      72
    
      73    install -Dm644 "opt/Akia/akia-${pkgver}.jar" \
    
      74        "${pkgdir}/usr/share/java/akia/akia.jar"
    
      75
    
      76    install -Dm755 opt/Akia/libakisp11.so \
    
      77        "${pkgdir}/usr/lib/akia/libakisp11.so"
    
      78
    
      79    # The jar (model.MRegistry) hardcodes the PKCS#11 library lookup to
    
      80    # /usr/lib/libakisp11.so. Ship a symlink so the jar finds it without
    
      81    # polluting /usr/lib with an unowned copy (upstream postinst `cp`s it
    
      82    # there; we use a pacman-owned symlink instead).
    
      83    install -dm755 "${pkgdir}/usr/lib"
    
      84    ln -s akia/libakisp11.so "${pkgdir}/usr/lib/libakisp11.so"
    
      85
    
      86    install -Dm755 "${srcdir}/akia.sh" "${pkgdir}/usr/bin/akia"
    
      87
    
      88    install -Dm644 "${srcdir}/akia.desktop" \
    
      89        "${pkgdir}/usr/share/applications/akia.desktop"
    
      90
    
      91    install -Dm644 akia.png \
    
      92        "${pkgdir}/usr/share/icons/hicolor/48x48/apps/akia.png"
    
      93
    
      94    install -dm755 "${pkgdir}/usr/share/doc/${pkgname}"
    
      95    install -m644 "opt/Akia/docs/Akia Uygulaması Kullanım Kılavuzu.pdf" \
    
      96        "${pkgdir}/usr/share/doc/${pkgname}/akia-user-guide.pdf"
    
      97    install -m644 "opt/Akia/docs/AkilliKartTeknolojisi.pdf" \
    
      98        "${pkgdir}/usr/share/doc/${pkgname}/smartcard-technology.pdf"
    
      99
    
      100    install -Dm644 "${srcdir}/LICENSE" \
    
      101        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      102}
    
      103

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 15:36:47	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 21:33:47	LOW	2