atostekid

maintainer 2-4601 · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-standard host (files.fineid.fi) which is not a common source for AUR packages; while the checksum is verified, the use of a binary blob from a non-upstream-looking domain creates a supply-chain risk if the host were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "${pkgname}-${pkgver}.deb::https://files.fineid.fi/download/atostek/${pkgver}/linux/AtostekID_DEB_${pkgver}.deb"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard host (files.fineid.fi) which is not a common source for AUR packages; while the checksum is verified, the use of a binary blob from a non-upstream-looking domain creates a supply-chain risk if the host were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 2-4601 <AUR@othermemory.org>
    
      2pkgname=atostekid
    
      3pkgver=4.5.0.0
    
      4pkgrel=1
    
      5pkgdesc="New desktop application for Finnish electronic ID cards"
    
      6arch=("x86_64")
    
      7url="https://dvv.fi/en/linux-versions"
    
      8license=("LicenseRef-Atostek")
    
      9depends=(
    
      10    "botan2"
    
      11    "ccid"
    
      12    "gnutls"
    
      13    "libqpdf29"
    
      14    "minizip"
    
      15    "nss"
    
      16    "pcsclite"
    
      17    "qt6-base"
    
      18    "qt6-wayland"
    
      19)
    
      20optdepends=(
    
      21    "gnome-shell-extension-appindicator: System tray indicator extension for GNOME desktop"
    
      22    "libappindicator: System tray support for desktop environments"
    
      23)
    
      24install="${pkgname}.install"
    
      25source=(
    
      26    "${pkgname}-${pkgver}.deb::https://files.fineid.fi/download/atostek/${pkgver}/linux/AtostekID_DEB_${pkgver}.deb"
    
      27    "atostek-id.module"
    
      28    "com.atostek.atostekid.desktop"
    
      29    "com.atostek.atostekid.png"
    
      30)
    
      31sha256sums=('14d2e980e27e8bdd0a27a3bec925864018540ae3f09baf146f19c4986890b3e4'
    
      32            '42cf9a65e4913b42ea9b63ebe171050589bdf00d7a48df26d793b394c39efefa'
    
      33            '14bb723654f042e1c1973c0463156ee0299f320061e001726adb8391f8e18aeb'
    
      34            'fdfad6cf56013d55d5e7516a093494091fcb9c8a27409d488e780dd2ebebe895')
    
      35
    
      36package() {
    
      37    tar xf data.tar.zst -C "${pkgdir}"
    
      38
    
      39    # These libraries are not needed because they can be satisfied with system and AUR packages
    
      40    rm -rf "${pkgdir}/usr/lib/atostekid"
    
      41    # Install Atostek ID's PKCS #11 module configuration file
    
      42    install -D -m 644 atostek-id.module -t "${pkgdir}/usr/share/p11-kit/modules/"
    
      43    # Install Atostek ID's PKCS #11 module to the proper location
    
      44    install -D -m 644 "${pkgdir}/usr/lib/Atostek-ID-PKCS11.so" -t "${pkgdir}/usr/lib/pkcs11/"
    
      45    rm "${pkgdir}/usr/lib/Atostek-ID-PKCS11.so"
    
      46    # Handle license and documentation files
    
      47    install -D -m 644 "${pkgdir}/usr/share/doc/atostekid/copyright" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      48    install -m 644 "${pkgdir}"/usr/share/doc/atostekid/license_{en,fi,sv}.rtf -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      49    rm "${pkgdir}"/usr/share/doc/atostekid/{*.Debian,copyright,license_{en,fi,sv}.rtf}
    
      50    # Install desktop and icon files
    
      51    install -D -m 644 com.atostek.atostekid.desktop -t "${pkgdir}/usr/share/applications/"
    
      52    install -D -m 644 com.atostek.atostekid.png -t "${pkgdir}/usr/share/pixmaps/"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2