arksigner-pub

maintainer thorque · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from downloadark.com (the vendor's own download host for ArkSigner, a Turkish e-signature/smart card application) and extracts+installs it directly. The sha256sums are SKIP'd for both the .deb and the service file, meaning there is no integrity verification. The binary is executed at runtime (it's a daemon/service installed to /opt and run via systemd), and bundled OpenSSL 1.1 libraries are force-loaded via LD_PRELOAD in the wrapper script. While downloadark.com appears to be the official vendor download host for arksigner.com, it is still a non-standard host with no checksum verification, and the package installs a prebuilt closed-source binary with LD_PRELOAD injection of bundled crypto libraries. This is a genuine supply-chain concern: if the host is compromised or the binary is swapped, there is no integrity check to catch it. The SKIP checksums are the primary issue — this is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://downloadark.com/arksigner-pub-${pkgver}-portable.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary .deb from downloadark.com (the vendor's own download host for ArkSigner, a Turkish e-signature/smart card application) and extracts+installs it directly. The sha256sums are SKIP'd for both the .deb and the service file, meaning there is no integrity verification. The binary is executed at runtime (it's a daemon/service installed to /opt and run via systemd), and bundled OpenSSL 1.1 libraries are force-loaded via LD_PRELOAD in the wrapper script. While downloadark.com appears to be the official vendor download host for arksigner.com, it is still a non-standard host with no checksum verification, and the package installs a prebuilt closed-source binary with LD_PRELOAD injection of bundled crypto libraries. This is a genuine supply-chain concern: if the host is compromised or the binary is swapped, there is no integrity check to catch it. The SKIP checksums are the primary issue — this is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Erdener Karacan <erdener.karacan@gmail.com>
    
      2# Önceki Maintainer: Mete ÇİFTÇİ <e.meteciftci@gmail.com>
    
      3
    
      4pkgname=arksigner-pub
    
      5pkgver=2.3.17.2
    
      6pkgrel=1
    
      7pkgdesc="ArkSigner e-Imza ve AKİS Akıllı Kart Uygulaması"
    
      8arch=('x86_64')
    
      9url="https://www.arksigner.com"
    
      10license=('custom')
    
      11
    
      12depends=('pcsclite' 'ccid' 'nss')
    
      13install="arksigner-pub.install"
    
      14
    
      15source=("https://downloadark.com/arksigner-pub-${pkgver}-portable.deb"
    
      16        "arksigner.service")
    
      17sha256sums=('SKIP'
    
      18            'SKIP')
    
      19
    
      20package() {
    
      21    msg2 "DEB paketi açılıyor..."
    
      22    cd "${srcdir}"
    
      23    ar x "arksigner-pub-${pkgver}-portable.deb"
    
      24    tar -xf data.tar.* -C "${pkgdir}"
    
      25
    
      26    # Çakışan /lib dizinini sil (filesystem paketiyle çakışıyor)
    
      27    # Debian'ın init.d servisi yerine kendi arksigner.service'imizi kullanacağız
    
      28    rm -rf "${pkgdir}/lib"
    
      29
    
      30    # 1. macOS çöplerini temizle
    
      31    find "${pkgdir}" -name ".DS_Store" -type f -delete
    
      32
    
      33    # 2. Uygulamayı /opt altına taşı
    
      34    install -d "${pkgdir}/opt"
    
      35    mv "${pkgdir}/usr/bin/arksigner" "${pkgdir}/opt/arksigner"
    
      36
    
      37    # 3. Boş kalan usr/bin dizinini temizle
    
      38    rm -rf "${pkgdir}/usr/bin"
    
      39
    
      40    # 4. Bundled kütüphanelere DOKUNMA!
    
      41    msg2 "Bundled kütüphaneler korunuyor..."
    
      42
    
      43    # 5. OpenSSL 1.1 symlink'leri
    
      44    msg2 "OpenSSL 1.1 symlink'leri oluşturuluyor..."
    
      45    cd "${pkgdir}/opt/arksigner/libs"
    
      46    ln -sf libcrypto.so.1.1 libcrypto.so
    
      47    ln -sf libssl.so.1.1    libssl.so
    
      48
    
      49    # 6. Wrapper betik
    
      50    install -d "${pkgdir}/usr/bin"
    
      51
    
      52    cat > "${pkgdir}/usr/bin/arksigner-service" << 'EOF'
    
      53#!/bin/bash
    
      54export LD_LIBRARY_PATH="/opt/arksigner/libs:/usr/local/lib64:${LD_LIBRARY_PATH}"
    
      55export LD_PRELOAD="/opt/arksigner/libs/libssl.so.1.1:/opt/arksigner/libs/libcrypto.so.1.1"
    
      56cd /opt/arksigner
    
      57exec /opt/arksigner/arksigner-service "$@"
    
      58EOF
    
      59    chmod +x "${pkgdir}/usr/bin/arksigner-service"
    
      60
    
      61    # 7. Systemd servisi
    
      62    install -Dm644 "${srcdir}/arksigner.service" \
    
      63        "${pkgdir}/usr/lib/systemd/system/arksigner.service"
    
      64
    
      65    # 8. İzinleri düzelt
    
      66    chmod -R u=rwX,go=rX "${pkgdir}"
    
      67    chmod +x "${pkgdir}/opt/arksigner/arksigner-service"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2