barmer-ecare-bin

maintainer stop50 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a squashfs file from a dynamic URL obtained via the Snapcraft API, which is not listed in the source array and lacks a verifiable checksum, posing a supply-chain risk if the download endpoint is compromised.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:58 url=$(curl -H 'Snap-device-series: 16' -s https://api.snapcraft.io/v2/snaps/info/barmer-ecare | jq -r --arg channel "$_channel" '.["channel-map"][] | select(.channel.name == $channel) | .download.url')

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The PKGBUILD downloads a squashfs file from a dynamic URL obtained via the Snapcraft API, which is not listed in the source array and lacks a verifiable checksum, posing a supply-chain risk if the download endpoint is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sebastian Tobie <archlinux@sebastian-tobie.de>
    
      2_channel="stable"
    
      3_sizes=(16 24 32 48 64 72 96 128 192 256 384 512)
    
      4_root_dir=/opt/barmer-ecare
    
      5
    
      6
    
      7pkgname="barmer-ecare-bin"
    
      8pkgver=26.1.1
    
      9pkgrel=2
    
      10pkgdesc='Desktopanwendung für die Elektronische Patientenakte der BARMER extrahiert aus dem snap packet der BARMER'
    
      11arch=('x86_64')
    
      12url='https://www.barmer.de/unsere-leistungen/leistungen-a-z/online-services/ecare-elektronische-patientenakte/ecare-fuer-pc-laptop-1056418'
    
      13license=('Proprietary')
    
      14# These deps are the one retrieved from the barmer-ecare binary
    
      15depends=(
    
      16    gcc-libs
    
      17    glibc
    
      18    libasound.so=2-64
    
      19    libatk-1.0.so=0-64
    
      20    libatk-bridge-2.0.so=0-64
    
      21    libatspi.so=0-64
    
      22    libcairo.so=2-64
    
      23    libcups
    
      24    libdbus-1.so=3-64
    
      25    libexpat.so=1-64
    
      26    libgio-2.0.so=0-64
    
      27    libglib-2.0.so=0-64
    
      28    libgobject-2.0.so=0-64
    
      29    libgtk-3.so=0-64
    
      30    libpango-1.0.so=0-64
    
      31    libpcsclite.so=1-64
    
      32    libudev.so=1-64
    
      33    libx11
    
      34    libxcb
    
      35    libxcomposite
    
      36    libxdamage
    
      37    libxext
    
      38    libxfixes
    
      39    libxkbcommon.so=0-64
    
      40    libxrandr
    
      41    mesa
    
      42    nspr
    
      43    nss
    
      44    electron
    
      45)
    
      46
    
      47makedepends=('squashfs-tools' 'jq' 'curl' 'gendesk' 'patchelf' 'asar' 'modclean' 'imagemagick' 'uglify-js')
    
      48source=()
    
      49sha256sums=()
    
      50conflicts=()
    
      51
    
      52pkgver() {
    
      53    curl -H 'Snap-device-series: 16' -s https://api.snapcraft.io/v2/snaps/info/barmer-ecare | jq -r --arg channel "$_channel"  '.["channel-map"][] | select(.channel.name == $channel) | .version'
    
      54}
    
      55
    
      56prepare() {
    
      57    # URLs of the squashfs file are dynamic and are unpredictable
    
      58    url=$(curl -H 'Snap-device-series: 16' -s https://api.snapcraft.io/v2/snaps/info/barmer-ecare | jq -r --arg channel "$_channel" '.["channel-map"][] | select(.channel.name == $channel) | .download.url')
    
      59    curl -Lo barmer-ecare.squashfs "$url"
    
      60}
    
      61
    
      62build(){
    
      63    gendesk -f -n --pkgname "barmer-ecare-bin" --name "Barmer eCare" --pkgdesc "${pkgdesc}" --exec="$_root_dir/barmer-ecare" --categories='Network;MedicalSoftware' --icon barmer-ecare --path="$_root_dir"
    
      64    unsquashfs -d "." barmer-ecare.squashfs app meta
    
      65    # It removes the rpath to load the system libraries, hardcodes the path of the libffmpeg.so and removes unneeded deps.
    
      66    patchelf --remove-rpath --replace-needed libffmpeg.so "$_root_dir/libffmpeg.so" app/barmer-ecare
    
      67    rm -rfv app/libvk_swiftshader.so app/vk_swiftshader_icd.json app/libvulkan.so.1
    
      68    rm -rfv app/resources/ssl
    
      69    asar e app/resources/app.asar data
    
      70    rm -rf app/resources/app.asar app/resources/app.asar.unpacked
    
      71
    
      72    modclean -r -n default:safe -p data
    
      73    find data \
    
      74        \( -type f -iname '.*' -or -iname 'tsconfig.json' -or -iname 'LICENSE*.*' -or -iname '*.map' -or -iname '*.sass' -or -iname '*.hash' -or -iname '*.swf' -or -iname '*.[hc]' \) -or \
    
      75        \( -type d -empty \) \
    
      76        | xargs rm -rvf
    
      77    find data -iname '*.js' -or -iname '*.?js' -exec uglifyjs -c --no-annotations --keep-fnames --v8 -o {} -- {} \;
    
      78    hardlink --reflink=never -b 1G -mc data
    
      79    asar p --unpack '*.pdf' data app/resources/app.asar
    
      80    for size in ${_sizes[@]} ; do
    
      81        magick meta/gui/icon.png -resize "${size}x${size}" "${size}.png"
    
      82    done
    
      83}
    
      84
    
      85package() {
    
      86    install -d "${pkgdir}${_root_dir}"
    
      87    mv app/* "${pkgdir}${_root_dir}"
    
      88    install -DT -m 0644 barmer-ecare.desktop "${pkgdir}/usr/share/applications/barmer-ecare.desktop"
    
      89    for size in ${_sizes[@]} ; do
    
      90        install -DT -m 0644 "${size}.png" "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/barmer-ecare.png"
    
      91    done
    
      92    install -DT -m 0644 meta/gui/icon.png "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/barmer-ecare.png"
    
      93    install -d "${pkgdir}/usr/share/doc/barmer-ecare-bin"
    
      94    ln "${pkgdir}${_root_dir}/resources/app.asar.unpacked/pdf/Datenschutzerklaerung.pdf" "${pkgdir}/usr/share/doc/barmer-ecare-bin/Datenschutzerklärung.pdf"
    
      95    ln "${pkgdir}${_root_dir}/resources/app.asar.unpacked/pdf/Nutzungsbedingungen.pdf" "${pkgdir}/usr/share/doc/barmer-ecare-bin/Nutzungsbedingungen.pdf"
    
      96    ln "${pkgdir}${_root_dir}/resources/app.asar.unpacked/pdf/Nutzungsbedingungen_Linux.pdf" "${pkgdir}/usr/share/doc/barmer-ecare-bin/Nutzungsbedingungen_Linux.pdf"
    
      97    ln "${pkgdir}${_root_dir}/resources/app.asar.unpacked/pdf/Zugriffseinschraenkungen.pdf" "${pkgdir}/usr/share/doc/barmer-ecare-bin/Zugriffseinschränkungen.pdf"
    
      98}
    
      99

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2