eparaksts-token-signing

LOW

maintainer kaaposc 5 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a Debian package from the official project domain for building, which is a normal AUR practice; the source is not executed remotely and the build extracts and installs local files, posing no significant risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Debian package from the official project domain for building, which is a normal AUR practice; the source is not executed remotely and the build extracts and installs local files, posing no significant risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://www.eparaksts.lv/files/ep3updates/debian/pool/eparaksts/e/${pkgname}/${pkgname}_${pkgver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Māris Vilks <kaaposc@gmail.com>
    
      2pkgname=eparaksts-token-signing
    
      3pkgver=2.3.10
    
      4pkgrel=1
    
      5pkgdesc="eParaksts browser plugins"
    
      6arch=('x86_64')
    
      7url="https://www.eparaksts.lv"
    
      8license=('LGPL-2.1-or-later')
    
      9groups=('eparaksts')
    
      10depends=('pcsclite' 'qt5-base')
    
      11optdepends=('latvia-eid-middleware: libraries for Latvia eID cards')
    
      12install='eparaksts.install'
    
      13source=("https://www.eparaksts.lv/files/ep3updates/debian/pool/eparaksts/e/${pkgname}/${pkgname}_${pkgver}_amd64.deb")
    
      14sha512sums=('91e38c613d9729b59fc42d33b6817580d1bbdc1696fee5c0717ba6f141bbabac269d7525c6fc44964fe3596a04cf75f20cd95ca4e8e4da6ab5d98d286ca554fe')
    
      15
    
      16package() {
    
      17
    
      18  tar -xf data.tar.zst -C "${pkgdir}"
    
      19
    
      20  install -D "${pkgdir}/usr/share/doc/${pkgname}/copyright" "${pkgdir}/usr/share/licenses/$pkgname/copyright"
    
      21
    
      22  # clean up some broken symbolic links
    
      23  rm "${pkgdir}/usr/share/chromium/extensions/ecdpmdojhacnkledeihffppfimadpdcb.json"
    
      24  rm "${pkgdir}/usr/share/chromium-browser/extensions/ecdpmdojhacnkledeihffppfimadpdcb.json"
    
      25  rm "${pkgdir}/usr/share/google-chrome/extensions/ecdpmdojhacnkledeihffppfimadpdcb.json"
    
      26
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Māris Vilks <kaaposc@gmail.com>
 pkgname=eparaksts-token-signing
-pkgver=2.3.9
-pkgrel=2
+pkgver=2.3.10
+pkgrel=1
 pkgdesc="eParaksts browser plugins"
 arch=('x86_64')
 url="https://www.eparaksts.lv"
@@ -11,7 +11,7 @@
 optdepends=('latvia-eid-middleware: libraries for Latvia eID cards')
 install='eparaksts.install'
 source=("https://www.eparaksts.lv/files/ep3updates/debian/pool/eparaksts/e/${pkgname}/${pkgname}_${pkgver}_amd64.deb")
-sha512sums=('ab87619acde07248ad23770023cdd7f83d75314f556be539e8ea8c492e1fdeca1113e6c838e1f15041f988217fea37b6bbf3f1c4559320cc3e01af4be9376ba7')
+sha512sums=('91e38c613d9729b59fc42d33b6817580d1bbdc1696fee5c0717ba6f141bbabac269d7525c6fc44964fe3596a04cf75f20cd95ca4e8e4da6ab5d98d286ca554fe')
 
 package() {
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 11:16:06	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1