d.launcher2

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt AppImage from an archived official government site via web.archive.org; while the host is non-standard, the source is verifiable via a matching checksum and the content is a legitimate application installer, not an obfuscated payload or remote code execution script.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt AppImage from an archived official government site via web.archive.org; while the host is non-standard, the source is verifiable via a matching checksum and the content is a legitimate application installer, not an obfuscated payload or remote code execution script.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 https://web.archive.org/web/20231219104933if_/https://www.slovensko.sk/static/kep/apps/dlauncher2_2.x/sk.ditec.dlauncher2-linux-x86_64.zip

PKGBUILD

1 offending line(s) highlighted

      1#!/bin/bash
    
      2# Maintainer: Ľubomír 'the-k' Kučera <lubomir.kucera.jr at gmail.com>
    
      3
    
      4pkgname=d.launcher2
    
      5pkgver=2.0.0.4
    
      6pkgrel=1
    
      7pkgdesc="Application for Qualified Electronic Signature"
    
      8arch=(
    
      9    x86_64
    
      10)
    
      11url=https://www.slovensko.sk/sk/na-stiahnutie
    
      12license=(
    
      13    custom
    
      14)
    
      15depends=(
    
      16    gcc-libs
    
      17    glibc
    
      18    libzip
    
      19    openssl-1.1
    
      20    pacparser
    
      21    qt5-base
    
      22    qt5-svg
    
      23    xerces-c
    
      24    xml-security-c
    
      25)
    
      26makedepends=(
    
      27    fuse2
    
      28    gcc
    
      29    proot
    
      30)
    
      31source=(
    
      32    missing-symbols.cpp
    
      33    missing-symbols.version
    
      34    wrapper
    
      35)
    
      36source_x86_64=(
    
      37    https://web.archive.org/web/20231219104933if_/https://www.slovensko.sk/static/kep/apps/dlauncher2_2.x/sk.ditec.dlauncher2-linux-x86_64.zip
    
      38)
    
      39sha256sums=(
    
      40    SKIP
    
      41    SKIP
    
      42    SKIP
    
      43)
    
      44# https://www.slovensko.sk/static/kep/apps/dlauncher2_2.x/sk.ditec.dlauncher2.xml
    
      45# $ echo <sha256> | base64 -d | xxd -c 0 -p
    
      46sha256sums_x86_64=(
    
      47    76a5b15c812e14fc20610ae1bc976a29ca28c031763a1e31e5bff7d56562704a
    
      48)
    
      49
    
      50: "${pkgname}"
    
      51: "${pkgver}"
    
      52: "${pkgrel}"
    
      53: "${pkgdesc}"
    
      54: "${arch[@]}"
    
      55: "${url}"
    
      56: "${license[@]}"
    
      57: "${depends[@]}"
    
      58: "${makedepends[@]}"
    
      59: "${source[@]}"
    
      60: "${source_x86_64[@]}"
    
      61: "${sha256sums[@]}"
    
      62: "${sha256sums_x86_64[@]}"
    
      63
    
      64prepare() {
    
      65    ./DLauncher2.linux.x86_64.run --appimage-extract
    
      66}
    
      67
    
      68build() {
    
      69    IFS=" " read -r -a BUILD_FLAGS <<< "${CXXFLAGS} ${LDFLAGS} ${LTOFLAGS}"
    
      70
    
      71    # If the files exist, the installer attempts to reinstall the app.
    
      72    rm -rf install
    
      73
    
      74    mkdir -p install/{sbin,install/.local/share}
    
      75
    
      76    # Prevents the installer from trying to use systemctl
    
      77    ln -fs /usr/bin/true install/sbin/systemctl
    
      78
    
      79    for exe in dBridge2Nm dLauncher2; do
    
      80        install -Dm755 "squashfs-root/dlauncher2/${exe}" \
    
      81            "install/opt/${pkgname}/_${exe}"
    
      82
    
      83        ln -fs "/opt/${pkgname}/wrapper" "install/opt/${pkgname}/${exe}"
    
      84    done
    
      85
    
      86    # Fixes `undefined symbol: _ZdlPvm, version Qt_5` error.
    
      87    # https://community.esri.com/t5/qt-maps-sdk-questions/undefined-reference-to-operator-delete-void/m-p/238571/highlight/true#M1203
    
      88    g++ "${BUILD_FLAGS[@]}" -Wl,--version-script=missing-symbols.version \
    
      89        -shared -fPIC -o "install/opt/${pkgname}/libmissingsymbols.so" \
    
      90        missing-symbols.cpp
    
      91    install -Dm755 wrapper "install/opt/${pkgname}"
    
      92
    
      93    install -Dm644 squashfs-root/dlauncher2/*.png "install/opt/${pkgname}"
    
      94
    
      95    # --register fixes `path` in manifests.
    
      96    for mode in install register; do
    
      97        env -i proot -S install -b /bin -b /etc -b /lib64 -b /usr -w / /usr/bin/env \
    
      98            HOME=/install \
    
      99            PATH=/sbin:/usr/bin \
    
      100            QT_QPA_PLATFORM=offscreen \
    
      101            XDG_UTILS_INSTALL_MODE=user \
    
      102            "/opt/${pkgname}/dLauncher2" --headless "--${mode}"
    
      103    done
    
      104}
    
      105
    
      106package() {
    
      107    : "${pkgdir:?}"
    
      108
    
      109    cp -r install/opt "${pkgdir}"
    
      110
    
      111    install -Dm644 install/install/.ditec/dlauncher2/manifest-chrome.json \
    
      112        "${pkgdir}/etc/chromium/native-messaging-hosts/sk.ditec.dbridge2.nm.json"
    
      113    mkdir -p "${pkgdir}/etc/opt/chrome/native-messaging-hosts"
    
      114    ln -fs /etc/chromium/native-messaging-hosts/sk.ditec.dbridge2.nm.json \
    
      115        "${pkgdir}/etc/opt/chrome/native-messaging-hosts/sk.ditec.dbridge2.nm.json"
    
      116
    
      117    install -Dm644 install/install/.ditec/dlauncher2/manifest-firefox.json \
    
      118        "${pkgdir}/usr/lib/mozilla/native-messaging-hosts/sk.ditec.dbridge2.nm.json"
    
      119
    
      120    install -Dm644 install/install/.local/share/applications/sk.ditec.dlauncher2.desktop \
    
      121        "${pkgdir}/usr/share/applications/sk.ditec.dlauncher2.desktop"
    
      122    sed -i "s|/install/.local/share/dlauncher2/|/opt/${pkgname}/|g" \
    
      123        "${pkgdir}/usr/share/applications/sk.ditec.dlauncher2.desktop"
    
      124
    
      125    for size in 16 32 48 64 128 256 512; do
    
      126        mkdir -p "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/"{apps,mimetypes}
    
      127        ln -fs "/opt/${pkgname}/sk.ditec.dlauncher2_${size}.png" \
    
      128            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/sk.ditec.dlauncher2.png"
    
      129        ln -fs "/opt/${pkgname}/sk.ditec.dlauncher2_${size}.png" \
    
      130            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/mimetypes/gnome-mime-sk.ditec.dlauncher2.png"
    
      131        ln -fs "/opt/${pkgname}/sk.ditec.dlauncher2_${size}.png" \
    
      132            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/mimetypes/sk.ditec.dlauncher2.png"
    
      133    done
    
      134}
    
      135

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2