atostekid

MEDIUM

maintainer 2-4601 7 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (files.fineid.fi) which is not a common source for AUR packages; since the deb is extracted and installed without rebuilding from source, and the host is not a well-known or official domain like GitHub or GitLab, it represents a supply-chain risk if the host were compromised or the download redirected.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "${pkgname}-${pkgver}.deb::https://files.fineid.fi/download/atostek/${pkgver}/linux/AtostekID_DEB_${pkgver}.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard host (files.fineid.fi) which is not a common source for AUR packages; since the deb is extracted and installed without rebuilding from source, and the host is not a well-known or official domain like GitHub or GitLab, it represents a supply-chain risk if the host were compromised or the download redirected.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 2-4601 <AUR@othermemory.org>
    
      2pkgname=atostekid
    
      3pkgver=4.5.1.0
    
      4pkgrel=1
    
      5pkgdesc="New desktop application for Finnish electronic ID cards"
    
      6arch=("x86_64")
    
      7url="https://dvv.fi/en/linux-versions"
    
      8license=("LicenseRef-Atostek")
    
      9depends=(
    
      10    "botan2"
    
      11    "ccid"
    
      12    "gnutls"
    
      13    "libqpdf29"
    
      14    "minizip"
    
      15    "nss"
    
      16    "pcsclite"
    
      17    "qt6-base"
    
      18    "qt6-wayland"
    
      19)
    
      20optdepends=(
    
      21    "gnome-shell-extension-appindicator: System tray indicator extension for GNOME desktop"
    
      22    "libappindicator: System tray support for desktop environments"
    
      23)
    
      24install="${pkgname}.install"
    
      25source=(
    
      26    "${pkgname}-${pkgver}.deb::https://files.fineid.fi/download/atostek/${pkgver}/linux/AtostekID_DEB_${pkgver}.deb"
    
      27    "atostek-id.module"
    
      28    "com.atostek.atostekid.desktop"
    
      29    "com.atostek.atostekid.png"
    
      30)
    
      31sha256sums=('c311445a569516705625c1242653a5cc7ecfa1f616946d675bef71000274a0bf'
    
      32            '42cf9a65e4913b42ea9b63ebe171050589bdf00d7a48df26d793b394c39efefa'
    
      33            '14bb723654f042e1c1973c0463156ee0299f320061e001726adb8391f8e18aeb'
    
      34            'fdfad6cf56013d55d5e7516a093494091fcb9c8a27409d488e780dd2ebebe895')
    
      35
    
      36package() {
    
      37    tar xf data.tar.xz -C "${pkgdir}"
    
      38
    
      39    # These libraries are not needed because they can be satisfied with system and AUR packages
    
      40    rm -rf "${pkgdir}/usr/lib/atostekid"
    
      41    # Install Atostek ID's PKCS #11 module configuration file
    
      42    install -D -m 644 atostek-id.module -t "${pkgdir}/usr/share/p11-kit/modules/"
    
      43    # Install Atostek ID's PKCS #11 module to the proper location
    
      44    install -D -m 644 "${pkgdir}/usr/lib/Atostek-ID-PKCS11.so" -t "${pkgdir}/usr/lib/pkcs11/"
    
      45    rm "${pkgdir}/usr/lib/Atostek-ID-PKCS11.so"
    
      46    # Handle license and documentation files
    
      47    install -D -m 644 "${pkgdir}/usr/share/doc/atostekid/copyright" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      48    install -m 644 "${pkgdir}"/usr/share/doc/atostekid/license_{en,fi,sv}.rtf -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      49    rm "${pkgdir}"/usr/share/doc/atostekid/{*.Debian,copyright,license_{en,fi,sv}.rtf}
    
      50    # Install desktop and icon files
    
      51    install -D -m 644 com.atostek.atostekid.desktop -t "${pkgdir}/usr/share/applications/"
    
      52    install -D -m 644 com.atostek.atostekid.png -t "${pkgdir}/usr/share/pixmaps/"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2