e-imzo-bin

LOW

maintainer KOSMOSTAR 1 votes scanned 2026-08-25 13:29:14.317564

View on AUR

Why flagged

Downloads a tarball from dls.soliq.uz which appears to be the official distribution server for the Uzbek tax authority's E-IMZO signing tool (related to e-imzo.soliq.uz); checksums are provided and non-SKIP, so integrity is verifiable; the main concern is that this is a prebuilt Java application from a government/vendor host that is not widely known, but it is plausibly the project's own official infrastructure rather than a swappable personal host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a tarball from dls.soliq.uz which appears to be the official distribution server for the Uzbek tax authority's E-IMZO signing tool (related to e-imzo.soliq.uz); checksums are provided and non-SKIP, so integrity is verifiable; the main concern is that this is a prebuilt Java application from a government/vendor host that is not widely known, but it is plausibly the project's own official infrastructure rather than a swappable personal host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("${_pkgname}-${pkgver}.tar.gz::https://dls.soliq.uz/v${pkgver}/E-IMZO-v${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: KOSMOSTAR <kosmostaruzb at gmail dot com> https://telegram.me/KOSMOSTAR_UZB
    
      2
    
      3pkgname=e-imzo-bin
    
      4_pkgname=e-imzo
    
      5pkgver=6.4.7
    
      6pkgrel=1
    
      7pkgdesc="Uzbek state web identity proving & key signing (E-IMZO)"
    
      8arch=('any')
    
      9url="https://e-imzo.soliq.uz"
    
      10license=('Unlicense')
    
      11depends=('java-runtime>=8')
    
      12provides=("${_pkgname}=${pkgver}")
    
      13conflicts=("$_pkgname" "${_pkgname}-manager")
    
      14
    
      15source=("${_pkgname}-${pkgver}.tar.gz::https://dls.soliq.uz/v${pkgver}/E-IMZO-v${pkgver}.tar.gz"
    
      16        "e-imzo"
    
      17        "${_pkgname}.desktop"
    
      18        "${_pkgname}.service")
    
      19
    
      20sha256sums=('c077152064cd44c8ade4ba877177061a2edfa039a2c0755751cc65e199611a76'
    
      21            '095a64e9f78ede2e34fbf889845fb720d276d0f4dce45f074ab189c162ab7259'
    
      22            'ff25fda84d5bd9a50d704f908671577bf9d3c5b8fe74331f6a12951ae53f6ed9'
    
      23            'ab5e7e5ffa113b4f7a1e3b0e8b27ec4cd7760010b63dd576be06894e4fb5f5f9')
    
      24
    
      25package() {
    
      26    install -d "$pkgdir/usr/share/$_pkgname"
    
      27
    
      28    cp -r "$srcdir/E-IMZO/." "$pkgdir/usr/share/$_pkgname/"
    
      29
    
      30    install -Dm755 "$srcdir/e-imzo" "$pkgdir/usr/bin/e-imzo"
    
      31    install -Dm644 "$srcdir/e-imzo.desktop" "$pkgdir/usr/share/applications/e-imzo.desktop"
    
      32    install -Dm644 "$srcdir/e-imzo.service" "$pkgdir/usr/lib/systemd/user/e-imzo.service"
    
      33    chmod 755 "${pkgdir}/usr/share/${_pkgname}"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-25 13:29:14	Low	3
2026-08-25 13:26:42	Medium	2