disig-web-signer

maintainer the-k · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt Debian package from the official vendor's CDN (disigcdn.sk), which is plausibly the project's own release infrastructure; while the host is not whitelisted, the download is verifiable via checksums and installs only official binaries, so the risk is low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Debian package from the official vendor's CDN (disigcdn.sk), which is plausibly the project's own release infrastructure; while the host is not whitelisted, the download is verifiable via checksums and installs only official binaries, so the risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("https://download.disigcdn.sk/cdn/products/websigner2/disig-web-signer_${pkgver}-${_upstream_pkgrel}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1#!/bin/bash -e
    
      2# Maintainer: Ľubomír 'the-k' Kučera <lubomir.kucera.jr at gmail.com>
    
      3# Contributor: Fedor Piecka <teplavoda at gmail dot com>
    
      4
    
      5pkgname=disig-web-signer
    
      6pkgver=2.5.5
    
      7_upstream_pkgrel=1
    
      8pkgrel=2
    
      9pkgdesc="Slovak eID Web Signer by Disig"
    
      10arch=('i686' 'x86_64')
    
      11license=('LicenseRef-custom')
    
      12url="https://qesportal.sk/"
    
      13source_x86_64=("https://download.disigcdn.sk/cdn/products/websigner2/disig-web-signer_${pkgver}-${_upstream_pkgrel}_amd64.deb")
    
      14source_i686=("https://download.disigcdn.sk/cdn/products/websigner2/disig-web-signer_${pkgver}-${_upstream_pkgrel}_i386.deb")
    
      15sha256sums_i686=('82cd99ddbbaff71ee3f6cc1f45ca506253a1a56e4d522d915b405add3643c3a4')
    
      16sha256sums_x86_64=('f96101ddb9ffbb39810466d71c1196b416b29b221b65334aef66d9280fe7e521')
    
      17options=("!debug" "!strip")
    
      18
    
      19: "${arch[@]}"
    
      20: "${license[@]}"
    
      21: "${options[@]}"
    
      22: "${pkgdesc}"
    
      23: "${pkgrel}"
    
      24: "${sha256sums_i686[@]}"
    
      25: "${sha256sums_x86_64[@]}"
    
      26: "${source_i686[@]}"
    
      27: "${source_x86_64[@]}"
    
      28: "${url}"
    
      29
    
      30# Upstream uses Debian architecture naming convention. Let's prepare a variable for that.
    
      31_upstream_arch=
    
      32[[ "$CARCH" == "x86_64" ]] && _upstream_arch="amd64"
    
      33[[ "$CARCH" == "i686" ]] && _upstream_arch="i386"
    
      34
    
      35package() {
    
      36	depends=(
    
      37		glibc
    
      38		libgcc_s.so
    
      39		libstdc++.so
    
      40		openssl-1.1
    
      41		qt5-base
    
      42		qt5-websockets
    
      43		qt5-xmlpatterns
    
      44		sh
    
      45	)
    
      46	optdepends=(
    
      47		"gnome-shell-extension-appindicator: for system tray icon on GNOME"
    
      48	)
    
      49
    
      50	: "${depends[@]}"
    
      51	: "${optdepends[@]}"
    
      52	: "${pkgdir:?}"
    
      53	: "${srcdir:?}"
    
      54
    
      55	ar p "${srcdir}/disig-web-signer_${pkgver}-${_upstream_pkgrel}_${_upstream_arch}.deb" data.tar.xz | tar -xJ -C "${pkgdir}"
    
      56
    
      57	# The libraries are provided by the system.
    
      58	rm -r "${pkgdir}"/opt/disig/websigner/{bin/qt.conf,lib,plugins,share/doc/*/}
    
      59
    
      60	mkdir -p "${pkgdir}/usr/share/licenses/${pkgname}"
    
      61	ln -s /opt/disig/websigner/share/doc/copyright "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2