arubasign-rolling-bin

maintainer fedexmachina · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary archive (an Electron/Chromium-based app with bundled JRE, .exe files run under Wine/Mono, and native Linux binaries) from updatesfirma.aruba.it — the official Aruba PEC update server for their ArubaSign product. Aruba is a well-known Italian CA/digital-signature vendor, and this URL pattern matches their official software distribution infrastructure. However, the checksum is SKIP'd, meaning every build fetches whatever the server currently serves with no integrity verification. The '-latest-' in the filename confirms this is a rolling/mutable artifact. This is a genuine supply-chain concern: if the Aruba update server is compromised, or if the download is intercepted (MITM), arbitrary code would be executed on the user's machine with no checksum to detect tampering. The binary bundle includes a full JRE, Electron runtime, and .exe files, all of which are executed. The host itself appears legitimate (official vendor), but the absence of any checksum on an executed binary bundle keeps this at MEDIUM rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 source=("ArubaSign-latest-LINUX.tar.zst::https://updatesfirma.aruba.it/downloads/ArubaSign-latest-LINUX.tar.zst"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary archive (an Electron/Chromium-based app with bundled JRE, .exe files run under Wine/Mono, and native Linux binaries) from updatesfirma.aruba.it — the official Aruba PEC update server for their ArubaSign product. Aruba is a well-known Italian CA/digital-signature vendor, and this URL pattern matches their official software distribution infrastructure. However, the checksum is SKIP'd, meaning every build fetches whatever the server currently serves with no integrity verification. The '-latest-' in the filename confirms this is a rolling/mutable artifact. This is a genuine supply-chain concern: if the Aruba update server is compromised, or if the download is intercepted (MITM), arbitrary code would be executed on the user's machine with no checksum to detect tampering. The binary bundle includes a full JRE, Electron runtime, and .exe files, all of which are executed. The host itself appears legitimate (official vendor), but the absence of any checksum on an executed binary bundle keeps this at MEDIUM rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fedexmachina
    
      2_pkgname=arubasign
    
      3pkgname=${_pkgname}-rolling-bin
    
      4pkgver=25.2.0
    
      5pkgrel=2
    
      6pkgdesc='Aruba Digital Signature Suite for signing and verifying documents'
    
      7arch=('x86_64')
    
      8url='https://www.pec.it/Download.aspx'
    
      9license=('LicenseRef-ArubaPEC')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'ccid'
    
      15  'cups'
    
      16  'dbus'
    
      17  'expat'
    
      18  'gtk3'
    
      19  'hicolor-icon-theme'
    
      20  'libdrm'
    
      21  'libxcomposite'
    
      22  'libxdamage'
    
      23  'libxfixes'
    
      24  'libxkbcommon'
    
      25  'libxrandr'
    
      26  'mesa'
    
      27  'nspr'
    
      28  'nss'
    
      29  'pango'
    
      30  'pcsclite'
    
      31  'python'
    
      32)
    
      33optdepends=('pcsc-tools: smartcard debugging tools')
    
      34provides=("${_pkgname}")
    
      35conflicts=("${_pkgname}")
    
      36options=('!strip')
    
      37source=("ArubaSign-latest-LINUX.tar.zst::https://updatesfirma.aruba.it/downloads/ArubaSign-latest-LINUX.tar.zst"
    
      38  "${_pkgname}.sh"
    
      39  "${_pkgname}.desktop")
    
      40sha256sums=('SKIP'
    
      41  '44d5a13f18d60851de6c71d4a336a54a90f9a1f2b82813e52e685c22e46ac6d2'
    
      42  '4faa020d89f19c5f9f5c3cc5301c8a6f00cf12a769f0e4a4cd1f0cec73c864f9')
    
      43
    
      44pkgver() {
    
      45  awk -F' = ' '$1 == "pkgver" { sub(/-.*/, "", $2); print $2; exit }' .PKGINFO
    
      46}
    
      47
    
      48package() {
    
      49  install -dm755 "${pkgdir}/opt"
    
      50  cp -r "opt/${_pkgname}" "${pkgdir}/opt/"
    
      51
    
      52  chmod +x \
    
      53    "${pkgdir}/opt/${_pkgname}/app/lin-x64/ArubaSign" \
    
      54    "${pkgdir}/opt/${_pkgname}/app/lin-x64/arubasign.bat" \
    
      55    "${pkgdir}/opt/${_pkgname}/app/lin-x64/chrome_crashpad_handler" \
    
      56    "${pkgdir}/opt/${_pkgname}/app/lin-x64/chrome-sandbox" \
    
      57    "${pkgdir}/opt/${_pkgname}/asp/lin-x64/ArubaSignPlatform.exe" \
    
      58    "${pkgdir}/opt/${_pkgname}/asp/lin-x64/driver/util/convert.exe" \
    
      59    "${pkgdir}/opt/${_pkgname}/asp/lin-x64/driver/util/starthid.exe"
    
      60  chmod -R +x \
    
      61    "${pkgdir}/opt/${_pkgname}/runtime/jreLin64/bin/" \
    
      62    "${pkgdir}/opt/${_pkgname}/runtime/jreLin64/lib/"
    
      63
    
      64  install -Dm755 "${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      65  install -Dm644 "${_pkgname}.desktop" \
    
      66    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      67  install -Dm644 "opt/${_pkgname}/app/lin-x64/ico.png" \
    
      68    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      69  install -Dm644 "opt/${_pkgname}/app/lin-x64/LICENSE.electron.txt" \
    
      70    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      71  install -Dm644 "opt/${_pkgname}/app/lin-x64/LICENSES.chromium.html" \
    
      72    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2