arksigner-pub

MEDIUM

maintainer thorque 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (downloadark.com), which is not the project's official domain, creating a supply-chain risk if the host is compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 source=("https://downloadark.com/arksigner_${_debver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard host (downloadark.com), which is not the project's official domain, creating a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Erdener Karacan <erdener.karacan@gmail.com>
    
      2# Önceki Maintainer: Mete ÇİFTÇİ <e.meteciftci@gmail.com>
    
      3
    
      4pkgname=arksigner-pub
    
      5pkgver=3.0.12
    
      6_debver="${pkgver}_pardus25.11"
    
      7pkgrel=1
    
      8pkgdesc="ArkSigner e-İmza, Yönetim ve Tarayıcı Uzantısı Uygulaması"
    
      9arch=('x86_64')
    
      10url="https://www.arksigner.com"
    
      11license=('custom')
    
      12provides=('arksigner')
    
      13conflicts=('arksigner')
    
      14
    
      15depends=(
    
      16    'pcsclite'
    
      17    'ccid'
    
      18    'nss'
    
      19    'qt5-base'
    
      20    'qt5-svg'
    
      21    'poppler-qt5'
    
      22    'qpdf'
    
      23    'curl'
    
      24    'openssl'
    
      25    'zlib'
    
      26    'python'
    
      27)
    
      28install="arksigner-pub.install"
    
      29
    
      30source=("https://downloadark.com/arksigner_${_debver}_amd64.deb")
    
      31sha256sums=('010ae99b2e99ad718698abd5ae4fff5004f4433674b1cd9ce17e2c565308982e')
    
      32
    
      33package() {
    
      34    cd "${srcdir}"
    
      35    bsdtar --no-same-owner -xf data.tar.* -C "${pkgdir}"
    
      36
    
      37    # İzinleri standartlaştır
    
      38    chmod -R u=rwX,go=rX "${pkgdir}"
    
      39    chmod 755 "${pkgdir}/usr/lib/arksigner/truststore"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,68 +2,40 @@
 # Önceki Maintainer: Mete ÇİFTÇİ <e.meteciftci@gmail.com>
 
 pkgname=arksigner-pub
-pkgver=2.3.17.2
+pkgver=3.0.12
+_debver="${pkgver}_pardus25.11"
 pkgrel=1
-pkgdesc="ArkSigner e-Imza ve AKİS Akıllı Kart Uygulaması"
+pkgdesc="ArkSigner e-İmza, Yönetim ve Tarayıcı Uzantısı Uygulaması"
 arch=('x86_64')
 url="https://www.arksigner.com"
 license=('custom')
+provides=('arksigner')
+conflicts=('arksigner')
 
-depends=('pcsclite' 'ccid' 'nss')
+depends=(
+    'pcsclite'
+    'ccid'
+    'nss'
+    'qt5-base'
+    'qt5-svg'
+    'poppler-qt5'
+    'qpdf'
+    'curl'
+    'openssl'
+    'zlib'
+    'python'
+)
 install="arksigner-pub.install"
 
-source=("https://downloadark.com/arksigner-pub-${pkgver}-portable.deb"
-        "arksigner.service")
-sha256sums=('SKIP'
-            'SKIP')
+source=("https://downloadark.com/arksigner_${_debver}_amd64.deb")
+sha256sums=('010ae99b2e99ad718698abd5ae4fff5004f4433674b1cd9ce17e2c565308982e')
 
 package() {
-    msg2 "DEB paketi açılıyor..."
     cd "${srcdir}"
-    ar x "arksigner-pub-${pkgver}-portable.deb"
-    tar -xf data.tar.* -C "${pkgdir}"
+    bsdtar --no-same-owner -xf data.tar.* -C "${pkgdir}"
 
-    # Çakışan /lib dizinini sil (filesystem paketiyle çakışıyor)
-    # Debian'ın init.d servisi yerine kendi arksigner.service'imizi kullanacağız
-    rm -rf "${pkgdir}/lib"
-
-    # 1. macOS çöplerini temizle
-    find "${pkgdir}" -name ".DS_Store" -type f -delete
-
-    # 2. Uygulamayı /opt altına taşı
-    install -d "${pkgdir}/opt"
-    mv "${pkgdir}/usr/bin/arksigner" "${pkgdir}/opt/arksigner"
-
-    # 3. Boş kalan usr/bin dizinini temizle
-    rm -rf "${pkgdir}/usr/bin"
-
-    # 4. Bundled kütüphanelere DOKUNMA!
-    msg2 "Bundled kütüphaneler korunuyor..."
-
-    # 5. OpenSSL 1.1 symlink'leri
-    msg2 "OpenSSL 1.1 symlink'leri oluşturuluyor..."
-    cd "${pkgdir}/opt/arksigner/libs"
-    ln -sf libcrypto.so.1.1 libcrypto.so
-    ln -sf libssl.so.1.1    libssl.so
-
-    # 6. Wrapper betik
-    install -d "${pkgdir}/usr/bin"
-
-    cat > "${pkgdir}/usr/bin/arksigner-service" << 'EOF'
-#!/bin/bash
-export LD_LIBRARY_PATH="/opt/arksigner/libs:/usr/local/lib64:${LD_LIBRARY_PATH}"
-export LD_PRELOAD="/opt/arksigner/libs/libssl.so.1.1:/opt/arksigner/libs/libcrypto.so.1.1"
-cd /opt/arksigner
-exec /opt/arksigner/arksigner-service "$@"
-EOF
-    chmod +x "${pkgdir}/usr/bin/arksigner-service"
-
-    # 7. Systemd servisi
-    install -Dm644 "${srcdir}/arksigner.service" \
-        "${pkgdir}/usr/lib/systemd/system/arksigner.service"
-
-    # 8. İzinleri düzelt
+    # İzinleri standartlaştır
     chmod -R u=rwX,go=rX "${pkgdir}"
-    chmod +x "${pkgdir}/opt/arksigner/arksigner-service"
+    chmod 755 "${pkgdir}/usr/lib/arksigner/truststore"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 19:28:13	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2