certiliamiddleware

maintainer certilia · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from repo.certilia.com, which is the official repository of Certilia (the maintainer/vendor of the Croatian eID middleware). This is analogous to many AUR packages that pull vendor-hosted .deb files (e.g., Google Chrome, Slack, Zoom). The host is the vendor's own repository, not a random personal host. A sha512 checksum is provided, which mitigates casual tampering. However, the concern is real in the sense that: (1) this is a prebuilt binary blob executed/installed on the system, (2) the source host is not a widely-audited mirror, and (3) if repo.certilia.com were compromised, the checksum would need to be updated to catch it. The package also installs CA certificate trust anchors into the system trust store, which is a meaningful privilege escalation vector if the CA is malicious or compromised. These factors together justify a medium rating — it is a legitimate vendor package but carries inherent supply-chain risk from a prebuilt binary + CA anchor installation from a single vendor-controlled host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://repo.certilia.com/repository/debian/pool/c/${pkgname}/${pkgname}_${pkgver}-${pkgrel}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from repo.certilia.com, which is the official repository of Certilia (the maintainer/vendor of the Croatian eID middleware). This is analogous to many AUR packages that pull vendor-hosted .deb files (e.g., Google Chrome, Slack, Zoom). The host is the vendor's own repository, not a random personal host. A sha512 checksum is provided, which mitigates casual tampering. However, the concern is real in the sense that: (1) this is a prebuilt binary blob executed/installed on the system, (2) the source host is not a widely-audited mirror, and (3) if repo.certilia.com were compromised, the checksum would need to be updated to catch it. The package also installs CA certificate trust anchors into the system trust store, which is a meaningful privilege escalation vector if the CA is malicious or compromised. These factors together justify a medium rating — it is a legitimate vendor package but carries inherent supply-chain risk from a prebuilt binary + CA anchor installation from a single vendor-controlled host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Certilia <support@certilia.com>
    
      2
    
      3pkgname=certiliamiddleware
    
      4pkgver=3.9.8
    
      5pkgrel=1
    
      6pkgdesc="Certilia Middleware for AKD smart cards (Croatian eID, Certilia)"
    
      7arch=("x86_64")
    
      8url="https://www.certilia.com"
    
      9license=("LicenseRef-AKD-Middleware-EULA")
    
      10depends=("ca-certificates-utils" "ccid" "xcb-util-cursor" "xcb-util-keysyms" "xcb-util-wm")
    
      11source=("https://repo.certilia.com/repository/debian/pool/c/${pkgname}/${pkgname}_${pkgver}-${pkgrel}_amd64.deb")
    
      12options=("!strip" "staticlibs")
    
      13install="certiliamiddleware.install"
    
      14sha512sums=("7c42e2c5a9b8ca6901c1d8612acdd8c39eff496ba629107b232f7551fd647175ee0f01332ee31d7836284e62cbabfd2426a1aec7b7e08be9624811493df08206")
    
      15
    
      16package() {
    
      17  tar --no-same-owner --zstd -xvf data.tar.zst -C ${pkgdir}
    
      18  rm -rv ${pkgdir}/etc/apt
    
      19  mkdir -pv ${pkgdir}/usr/share/ca-certificates/trust-source
    
      20  mv -v ${pkgdir}/usr/share/ca-certificates/akd ${pkgdir}/usr/share/ca-certificates/trust-source/anchors
    
      21  install -vDm644 "${pkgdir}/opt/${pkgname}/licenses/MiddlewareLicense" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2