certiliamiddleware

MEDIUM

maintainer certilia 6 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (repo.certilia.com) which is not a common upstream source for AUR packages, and the checksum is provided but the origin is unverifiable; this creates a supply-chain risk if the host were compromised or the package tampered with in transit.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://repo.certilia.com/repository/debian/pool/c/${pkgname}/${pkgname}_${pkgver}-${pkgrel}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (repo.certilia.com) which is not a common upstream source for AUR packages, and the checksum is provided but the origin is unverifiable; this creates a supply-chain risk if the host were compromised or the package tampered with in transit.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Certilia <support@certilia.com>
    
      2
    
      3pkgname=certiliamiddleware
    
      4pkgver=3.9.10
    
      5pkgrel=2
    
      6pkgdesc="Certilia Middleware for AKD smart cards (Croatian eID, Certilia)"
    
      7arch=("x86_64")
    
      8url="https://www.certilia.com"
    
      9license=("LicenseRef-AKD-Middleware-EULA")
    
      10depends=("ca-certificates-utils" "ccid" "xcb-util-cursor" "xcb-util-keysyms" "xcb-util-wm")
    
      11source=("https://repo.certilia.com/repository/debian/pool/c/${pkgname}/${pkgname}_${pkgver}-${pkgrel}_amd64.deb")
    
      12options=("!strip" "staticlibs")
    
      13install="certiliamiddleware.install"
    
      14sha512sums=("d4197219e0e46746c19523422f4cc574afcb000ad42885c689a5536d85cbb6ba57f0e82f047b163c39a5bcfb36e3be5f6635e569bfe5b3a29110cfa8c0627603")
    
      15
    
      16package() {
    
      17  tar --no-same-owner --zstd -xvf data.tar.zst -C ${pkgdir}
    
      18  rm -rv ${pkgdir}/etc/apt
    
      19  mkdir -pv ${pkgdir}/usr/share/ca-certificates/trust-source
    
      20  mv -v ${pkgdir}/usr/share/ca-certificates/akd ${pkgdir}/usr/share/ca-certificates/trust-source/anchors
    
      21  install -vDm644 "${pkgdir}/opt/${pkgname}/licenses/MiddlewareLicense" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      22}
    
      23

Changes since previous scan

--- PKGBUILD @ 2026-09-07 00:30
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,8 +1,8 @@
 # Maintainer: Certilia <support@certilia.com>
 
 pkgname=certiliamiddleware
-pkgver=3.9.8
-pkgrel=1
+pkgver=3.9.10
+pkgrel=2
 pkgdesc="Certilia Middleware for AKD smart cards (Croatian eID, Certilia)"
 arch=("x86_64")
 url="https://www.certilia.com"
@@ -11,7 +11,7 @@
 source=("https://repo.certilia.com/repository/debian/pool/c/${pkgname}/${pkgname}_${pkgver}-${pkgrel}_amd64.deb")
 options=("!strip" "staticlibs")
 install="certiliamiddleware.install"
-sha512sums=("7c42e2c5a9b8ca6901c1d8612acdd8c39eff496ba629107b232f7551fd647175ee0f01332ee31d7836284e62cbabfd2426a1aec7b7e08be9624811493df08206")
+sha512sums=("d4197219e0e46746c19523422f4cc574afcb000ad42885c689a5536d85cbb6ba57f0e82f047b163c39a5bcfb36e3be5f6635e569bfe5b3a29110cfa8c0627603")
 
 package() {
   tar --no-same-owner --zstd -xvf data.tar.zst -C ${pkgdir}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 09:16:51	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 17:15:15	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2