e-dowod

maintainer darekp · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .run installer binary from www.gov.pl (the official Polish government domain) and executes it inside a fakechroot environment. The source host is the official upstream vendor (Polish Ministry of Interior), not a personal or unofficial mirror, which significantly reduces supply-chain risk compared to a random third-party host. However, the package still executes an opaque prebuilt binary installer rather than building from source, and the fakechroot sandbox provides only weak isolation — the .run file runs arbitrary code during the build phase. The md5sum provides minimal integrity assurance. This is a legitimate but inherently risky packaging pattern (executed binary from an external host), warranting medium severity rather than high, since the host is the official government source and there is no evidence of malicious intent.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://www.gov.pl/pliki/edowod/$pkgname-$pkgver.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The package downloads a prebuilt .run installer binary from www.gov.pl (the official Polish government domain) and executes it inside a fakechroot environment. The source host is the official upstream vendor (Polish Ministry of Interior), not a personal or unofficial mirror, which significantly reduces supply-chain risk compared to a random third-party host. However, the package still executes an opaque prebuilt binary installer rather than building from source, and the fakechroot sandbox provides only weak isolation — the .run file runs arbitrary code during the build phase. The md5sum provides minimal integrity assurance. This is a legitimate but inherently risky packaging pattern (executed binary from an external host), warranting medium severity rather than high, since the host is the official government source and there is no evidence of malicious intent.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dariusz Dumas <dariusz@dareme.org>
    
      2pkgname=e-dowod
    
      3pkgver=4.3.0
    
      4pkgrel=1
    
      5pkgdesc="Helper tools for managing Polish electronic identity documents, enabling secure authentication and digital signing."
    
      6arch=('x86_64')
    
      7url="https://www.gov.pl/web/mswia/oprogramowanie-do-pobrania"
    
      8license=('custom' "MIT")
    
      9depends=()
    
      10makedepends=('fakeroot' 'fakechroot')
    
      11source=("https://www.gov.pl/pliki/edowod/$pkgname-$pkgver.run")
    
      12md5sums=('8bf382fa53377e05bd58398b592449e7')
    
      13options=(!strip)
    
      14
    
      15build() {
    
      16WORKDIR="$srcdir/chroot"
    
      17rm -rf $WORKDIR 
    
      18mkdir -p $WORKDIR
    
      19cd $WORKDIR
    
      20mkdir tmp bin
    
      21ln -sf /bin/sh ./bin
    
      22ln -sf /bin/rm ./bin
    
      23ln -sf /bin/chmod ./bin
    
      24cp $srcdir/$pkgname-$pkgver.run ./bin/$pkgname-$pkgver.run
    
      25chmod +x ./bin/$pkgname-$pkgver.run
    
      26
    
      27mkdir -p ./usr/share/applications/
    
      28mkdir -p ./etc/xdg/autostart
    
      29
    
      30export PATH="/bin:$PATH"
    
      31fakechroot fakeroot chroot . $pkgname-$pkgver.run  install --accept-licenses --confirm-command
    
      32
    
      33# remove temporary files for fakechroot
    
      34rm -rf bin tmp
    
      35
    
      36# move licenses to proper folder
    
      37mkdir -p usr/share/
    
      38mv opt/$pkgname/Licenses/ usr/share/licenses
    
      39
    
      40# remove installer files
    
      41cd opt/$pkgname && rm -rf uninstall* installerResources installer.dat components.xml InstallationLog.txt
    
      42}
    
      43
    
      44package() {
    
      45cp -R $srcdir/chroot/* $pkgdir/
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2