cedula-uruguay-pkcs11
LOW
maintainer carlosplanchon
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a proprietary .deb from an official Uruguayan government host for repackaging; while the host is not whitelisted, it is plausibly official and the payload is a known, self-contained middleware component, not an obfuscated or universally swappable binary.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a proprietary .deb from an official Uruguayan government host for repackaging; while the host is not whitelisted, it is plausibly official and the payload is a known, self-contained middleware component, not an obfuscated or universally swappable binary.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
source=("libclassicclient.deb::https://archivos.agesic.gub.uy/nextcloud/index.php/s/8kqSb9z4xKABM8T/download")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Carlos A. Planchón <carlosandresplanchonprestes@gmail.com>
2
3
# This package is not affiliated with or endorsed by AGESIC.
4
# This package repackages proprietary middleware distributed by AGESIC for Arch Linux.
5
6
pkgname=cedula-uruguay-pkcs11
7
pkgver=7.5.0
8
pkgrel=2
9
pkgdesc="PKCS#11 middleware for the Uruguayan electronic ID card (cédula)"
10
arch=('x86_64')
11
url="https://www.gub.uy/agencia-gobierno-electronico-sociedad-informacion-conocimiento/firma-digital/drivers-para-usar-cedula-digital"
12
license=('custom')
13
depends=('pcsclite' 'ccid')
14
optdepends=('qt5-base: GUI for the secure PIN / bio dialogs (SecurePinDialog/SecureBioDialog)')
15
makedepends=('binutils' 'tar')
16
options=('!debug')
17
source=("libclassicclient.deb::https://archivos.agesic.gub.uy/nextcloud/index.php/s/8kqSb9z4xKABM8T/download")
18
sha256sums=('b6fd0150fcea2b952b0d82027324cf3250dea6f42eaac430d6d08ea22eb840ed')
19
20
prepare() {
21
cd "$srcdir"
22
ar x libclassicclient.deb
23
}
24
25
package() {
26
cd "$srcdir"
27
28
local extractdir="$srcdir/extract"
29
rm -rf "$extractdir"
30
mkdir -p "$extractdir"
31
32
tar -xf data.tar.* -C "$extractdir"
33
34
install -dm755 "$pkgdir/usr/lib/ClassicClient"
35
cp -a "$extractdir/usr/lib/ClassicClient/." "$pkgdir/usr/lib/ClassicClient/"
36
37
if [[ -d "$extractdir/etc/ClassicClient" ]]; then
38
install -dm755 "$pkgdir/etc/ClassicClient"
39
cp -a "$extractdir/etc/ClassicClient/." "$pkgdir/etc/ClassicClient/"
40
fi
41
42
install -dm755 "$pkgdir/usr/lib/pkcs11"
43
ln -sf ../ClassicClient/libgclib.so "$pkgdir/usr/lib/pkcs11/libgclib.so"
44
45
# Install the helper binaries the upstream .deb ships in /usr/bin (previously
46
# omitted by this package). The middleware launches SecurePinDialog / SecureBioDialog
47
# for PIN and biometric entry; PIN entry misbehaves if SecurePinDialog is absent.
48
install -dm755 "$pkgdir/usr/bin"
49
50
# standalone change-PIN tools (no Qt); referenced by the already-installed .desktop
51
install -m755 "$extractdir/usr/bin/CCChangePinService" "$pkgdir/usr/bin/"
52
install -m755 "$extractdir/usr/bin/CCChangePinTool" "$pkgdir/usr/bin/"
53
54
# Qt GUI dialogs: real binary next to Resources/, plus a small wrapper at the path
55
# the middleware launches. The wrapper uses Qt's offscreen platform when there is no
56
# display, so the dialogs also work on headless systems.
57
install -m755 "$extractdir/usr/bin/SecurePinDialog" "$pkgdir/usr/lib/ClassicClient/"
58
install -m755 "$extractdir/usr/bin/SecureBioDialog" "$pkgdir/usr/lib/ClassicClient/"
59
60
local d
61
for d in SecurePinDialog SecureBioDialog; do
62
cat > "$pkgdir/usr/bin/$d" <<EOF
63
#!/bin/sh
64
# Wrapper for the Classic Client secure dialog, shipped by $pkgname. Falls back to
65
# Qt's offscreen platform when no display is available so it works on headless systems.
66
[ -z "\${DISPLAY:-}" ] && [ -z "\${WAYLAND_DISPLAY:-}" ] && export QT_QPA_PLATFORM=offscreen
67
exec /usr/lib/ClassicClient/$d "\$@"
68
EOF
69
chmod 755 "$pkgdir/usr/bin/$d"
70
done
71
72
install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
73
cat > "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<'EOF'
74
This package installs proprietary middleware obtained from AGESIC distribution channels.
75
The user is responsible for complying with the vendor's license and usage terms.
76
EOF
77
}
78
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |