edo-sign

maintainer darekp · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .run installer binary from www.gov.pl (the official Polish government domain) and executes it inside a fakechroot environment during the build phase. The source host is the official upstream vendor (Polish Ministry of Interior), so this is not an unofficial or personal host — it is the canonical distribution point for this software. However, the package still presents a real supply-chain concern: (1) only an MD5 checksum is used for integrity verification, which is cryptographically weak and provides minimal protection against substitution; (2) the .run file is an opaque, unreviewed binary blob that is directly executed, meaning any compromise of the gov.pl server or the file itself would result in arbitrary code execution on the builder's system; (3) the fakechroot/fakeroot chroot is not a real security boundary and does not prevent the installer from affecting the host system in meaningful ways. The cheaper model's MEDIUM rating is correct: this is a legitimate upstream source executing an unreviewable binary with weak integrity verification, which is a genuine supply-chain risk pattern even if not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://www.gov.pl/pliki/edowod/eDOSign-$pkgver.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .run installer binary from www.gov.pl (the official Polish government domain) and executes it inside a fakechroot environment during the build phase. The source host is the official upstream vendor (Polish Ministry of Interior), so this is not an unofficial or personal host — it is the canonical distribution point for this software. However, the package still presents a real supply-chain concern: (1) only an MD5 checksum is used for integrity verification, which is cryptographically weak and provides minimal protection against substitution; (2) the .run file is an opaque, unreviewed binary blob that is directly executed, meaning any compromise of the gov.pl server or the file itself would result in arbitrary code execution on the builder's system; (3) the fakechroot/fakeroot chroot is not a real security boundary and does not prevent the installer from affecting the host system in meaningful ways. The cheaper model's MEDIUM rating is correct: this is a legitimate upstream source executing an unreviewable binary with weak integrity verification, which is a genuine supply-chain risk pattern even if not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dariusz Dumas <dariusz@dareme.org>
    
      2pkgname=edo-sign
    
      3pkgver=1.9.106
    
      4pkgrel=1
    
      5pkgdesc="Helper tools for managing Polish electronic identity documents, enabling secure authentication and digital signing."
    
      6arch=('x86_64')
    
      7url="https://www.gov.pl/web/mswia/oprogramowanie-do-pobrania"
    
      8license=('custom')
    
      9depends=()
    
      10makedepends=('fakeroot' 'fakechroot')
    
      11source=("https://www.gov.pl/pliki/edowod/eDOSign-$pkgver.run")
    
      12md5sums=('77d145f04c18030211d6722171a610cc')
    
      13options=(!strip)
    
      14
    
      15build() {
    
      16WORKDIR="$srcdir/chroot"
    
      17rm -rf $WORKDIR 
    
      18mkdir -p $WORKDIR
    
      19cd $WORKDIR
    
      20mkdir tmp bin
    
      21ln -sf /bin/chmod ./bin
    
      22ln -sf /bin/cp ./bin
    
      23ln -sf /bin/rm ./bin
    
      24ln -sf /bin/sh ./bin
    
      25cp $srcdir/eDOSign-$pkgver.run ./bin/$pkgname-$pkgver.run
    
      26chmod +x ./bin/$pkgname-$pkgver.run
    
      27
    
      28mkdir -p ./usr/share/applications/
    
      29
    
      30export PATH="/bin:$PATH"
    
      31fakechroot fakeroot chroot . $pkgname-$pkgver.run  install --accept-licenses --confirm-command
    
      32
    
      33# remove temporary files for fakechroot
    
      34rm -rf bin tmp
    
      35
    
      36# move licenses to proper folder
    
      37mkdir -p usr/share/
    
      38mv opt/edo-sign/Licenses usr/share/licenses
    
      39
    
      40# remove installer files
    
      41cd opt/edo-sign && rm -rf uninstall* installerResources installer.dat components.xml InstallationLog.txt
    
      42}
    
      43
    
      44package() {
    
      45cp -R $srcdir/chroot/* $pkgdir/
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2