efisc2026-bin

LOW

maintainer StPauliFan 0 votes scanned 2026-10-27 00:23:28.674093

View on AUR

Why flagged

Downloads a prebuilt .deb from efisc.kttg.ch, which is the official canton of Thurgau tax software subdomain matching the declared project URL (efisc.tg.ch); the host is plausibly the vendor's own official distribution infrastructure, the checksum is provided, and the package simply extracts and installs the binary without any obfuscated payloads or exfiltration.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt .deb from efisc.kttg.ch, which is the official canton of Thurgau tax software subdomain matching the declared project URL (efisc.tg.ch); the host is plausibly the vendor's own official distribution infrastructure, the checksum is provided, and the package simply extracts and installs the binary without any obfuscated payloads or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://efisc.kttg.ch/update/eFisc/2026/${_pkgname}_${_debver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: StPauliFan
    
      2
    
      3pkgname=efisc2026-bin
    
      4_pkgname=efisc2026
    
      5pkgver=1.0.0.76
    
      6_debver=1.0.0-76
    
      7pkgrel=1
    
      8pkgdesc="Steuererklärungssoftware des Kantons Thurgau für das Steuerjahr 2025 (eFisc2026)"
    
      9arch=('x86_64')
    
      10url="https://efisc.tg.ch/"
    
      11license=('LicenseRef-proprietary')
    
      12depends=('alsa-lib' 'fontconfig' 'freetype2' 'glibc' 'gtk3' 'hicolor-icon-theme'
    
      13         'libx11' 'libxext' 'libxi' 'libxrender' 'libxtst' 'zlib')
    
      14provides=("$_pkgname")
    
      15conflicts=("$_pkgname")
    
      16options=('!strip' '!debug')
    
      17source=("https://efisc.kttg.ch/update/eFisc/2026/${_pkgname}_${_debver}_amd64.deb")
    
      18sha256sums=('fec5baf9d3e58d9b2846ff2f317e7281bc8f167cc198f318493d9a9f03003b8b')
    
      19noextract=("${_pkgname}_${_debver}_amd64.deb")
    
      20
    
      21prepare() {
    
      22  mkdir -p data
    
      23  bsdtar -xOf "${_pkgname}_${_debver}_amd64.deb" 'data.tar.*' | bsdtar -xf - -C data
    
      24}
    
      25
    
      26package() {
    
      27  cd data
    
      28
    
      29  install -dm755 "$pkgdir/usr/share"
    
      30  cp -a usr/share/$_pkgname "$pkgdir/usr/share/"
    
      31
    
      32  # Bundled Windows remote-support tool, useless on Linux
    
      33  rm -f "$pkgdir/usr/share/$_pkgname/TeamViewerQS.exe"
    
      34  # Only needed by the Debian postinst
    
      35  rm -f "$pkgdir/usr/share/$_pkgname/$_pkgname.sharedmimeinfo"
    
      36
    
      37  # Jars and config files ship with +x; only the launcher and JRE need it
    
      38  find "$pkgdir/usr/share/$_pkgname" -maxdepth 1 -type f ! -name "$_pkgname.sh" -exec chmod 644 {} +
    
      39
    
      40  install -dm755 "$pkgdir/usr/bin"
    
      41  ln -s /usr/share/$_pkgname/$_pkgname.sh "$pkgdir/usr/bin/$_pkgname"
    
      42
    
      43  install -Dm644 usr/share/applications/$_pkgname.desktop -t "$pkgdir/usr/share/applications"
    
      44  sed -i -e "s|^Icon=.*|Icon=$_pkgname|" -e "s|^Exec=.*|Exec=$_pkgname %U|" \
    
      45    "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      46
    
      47  install -Dm644 usr/share/mime/packages/$_pkgname.xml -t "$pkgdir/usr/share/mime/packages"
    
      48
    
      49  install -Dm644 usr/share/$_pkgname/$_pkgname.png \
    
      50    "$pkgdir/usr/share/icons/hicolor/48x48/apps/$_pkgname.png"
    
      51  install -Dm644 usr/share/$_pkgname/$_pkgname.png \
    
      52    "$pkgdir/usr/share/icons/hicolor/48x48/mimetypes/application-$_pkgname.png"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 00:23:28	Low	3
2026-10-26 21:50:42	Low	3
2026-10-26 21:45:59	Medium	3