digsighost

maintainer zurajm · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from a Slovenian government tax portal (edavki.durs.si), which is the official distribution point for this e-signature helper application used with Slovenian e-tax services. The host is a legitimate government portal, not a personal or unofficial host. However, the package installs an unauditable prebuilt binary (a Comtrade DigSig component for digital signing), and the sha512sum provided has only 127 hex characters instead of the required 128, suggesting a truncated/corrupt checksum that would fail verification. The binary is executed on the user's system and handles cryptographic document signing, making supply-chain integrity critical. The combination of an unauditable binary payload and a malformed checksum (which may cause makepkg to skip or mishandle verification) elevates this above 'clean' but it is not clearly malicious — it is a real supply-chain concern typical of prebuilt binary AUR packages from non-PyPI/non-GitHub sources.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://edavki.durs.si/EdavkiPortal/[120]/OpenPortal/Controls/ESignDocControls/digsighost.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from a Slovenian government tax portal (edavki.durs.si), which is the official distribution point for this e-signature helper application used with Slovenian e-tax services. The host is a legitimate government portal, not a personal or unofficial host. However, the package installs an unauditable prebuilt binary (a Comtrade DigSig component for digital signing), and the sha512sum provided has only 127 hex characters instead of the required 128, suggesting a truncated/corrupt checksum that would fail verification. The binary is executed on the user's system and handles cryptographic document signing, making supply-chain integrity critical. The combination of an unauditable binary payload and a malformed checksum (which may cause makepkg to skip or mishandle verification) elevates this above 'clean' but it is not clearly malicious — it is a real supply-chain concern typical of prebuilt binary AUR packages from non-PyPI/non-GitHub sources.

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: Miha Zuraj <miha@zuraj.com>
    
      3pkgname=digsighost
    
      4pkgver=2.0.98.0
    
      5pkgrel=1
    
      6pkgdesc="This application is intended for all users of software solutions, which use Comtrade DigSig component for digital signing of documents."
    
      7arch=('any')
    
      8url="http://comtradedigital.com/digital-banking-security/#E-signature-and-PKI"
    
      9license=('GPL')
    
      10groups=('')
    
      11options=('!strip' '!emptydirs')
    
      12install=${pkgname}.install
    
      13source=("https://edavki.durs.si/EdavkiPortal/[120]/OpenPortal/Controls/ESignDocControls/digsighost.deb")
    
      14sha512sums=('30d88c579c9c2fe13254ea1422742b14442b9d767862059c82e64c8e7d1489571fe7ed15c450306883a2a7596353577ced1084d7d29fc64f68ef792a602cfb5a')
    
      15
    
      16package(){
    
      17
    
      18	# Extract package data
    
      19	tar xf data.tar.xz -C "${pkgdir}"
    
      20
    
      21	install -D -m644 "/usr/share/doc/digsighost/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      22
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2