eusw
LOW
maintainer mpolishchuck
4 votes
scanned 2026-10-23 00:02:19.781852
Why flagged
The package downloads a source tarball from the project's official domain (iit.com.ua) for building the software, which is a normal AUR practice; the non-whitelisted host is the vendor's own site, and the downloaded content is part of the official software distribution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a source tarball from the project's official domain (iit.com.ua) for building the software, which is a normal AUR practice; the non-whitelisted host is the vendor's own site, and the downloaded content is part of the official software distribution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
"${_src_filename}::https://iit.com.ua/download/productfiles/${_srcuri_filename}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Maksym Polishchuk <mpolishchuck[at]gmail[dot]com>
2
3
pkgbase=eusw
4
pkgname=(
5
"${pkgbase}"
6
"${pkgbase}-npapi-plugin"
7
"${pkgbase}-nmh-manifest"
8
"${pkgbase}-pcsc-driver"
9
)
10
pkgver=1.3.1.109
11
pkgrel=1
12
pkgdesc="IIT End User CA-1. Sign (web)"
13
url="https://iit.com.ua"
14
license=('custom')
15
arch=('i686' 'x86_64')
16
makedepends=('execstack')
17
18
if [[ $CARCH = i686 ]]; then
19
_src_md5sum='0705ed03a466e25c9af24c3dcd287749'
20
_srcuri_filename='euswi.tar'
21
_src_filename="eusw_${pkgver}_i386.tar"
22
else
23
_src_md5sum='9a1296b1794ba50042bb43ad53e5c2aa'
24
_srcuri_filename='euswi.64.tar'
25
_src_filename="eusw_${pkgver}_amd64.tar"
26
fi
27
28
source=(
29
"${_src_filename}::https://iit.com.ua/download/productfiles/${_srcuri_filename}"
30
'chrome.ua.com.iit.eusign.nmh.json'
31
'mozilla.ua.com.iit.eusign.nmh.json'
32
'NO-LICENSE'
33
)
34
noextract=("${_src_filename}")
35
md5sums=(
36
"${_src_md5sum}"
37
'64ed17e9ee22c1cbd05593131c492f33'
38
'9d9c48e1078d3c58a3d82b216ff98cbc'
39
'9a35d24d8c91d1cdf8b9b4b306aa178d'
40
)
41
42
package_eusw() {
43
pkgdesc="IIT End User CA-1. Sign (web). Base program."
44
depends=('glibc' 'gcc-libs')
45
backup=(
46
'opt/iit/eu/sw/osplm.ini'
47
)
48
49
msg2 "Extracting the ${_src_filename}..."
50
bsdtar -xf "${_src_filename}" -C "$pkgdir/"
51
52
# Moving udev rules file under /usr/lib.
53
mkdir -p ${pkgdir}/usr/lib/udev/rules.d
54
mv ${pkgdir}/etc/udev/rules.d/60-iit-e-keys.rules ${pkgdir}/usr/lib/udev/rules.d/60-iit-e-keys.rules
55
rmdir ${pkgdir}/etc/udev/rules.d
56
rmdir ${pkgdir}/etc/udev
57
rmdir ${pkgdir}/etc
58
# Fixing permissions of udev rules file
59
chmod a-x ${pkgdir}/usr/lib/udev/rules.d/60-iit-e-keys.rules
60
61
# Removing 'execstack' flag from the lib.
62
# Since GLIBC 2.41 that lib cannot be loaded because it has 'execstack' flag.
63
# However, it seems like that lib actually does not do code excution from stack.
64
# At least it works when we remove the flag.
65
execstack -c ${pkgdir}/opt/iit/eu/sw/libav337p11d.so
66
67
# Removing install/uninstall scripts
68
rm ${pkgdir}/opt/iit/eu/sw/install.sh
69
rm ${pkgdir}/opt/iit/eu/sw/uninstall.sh
70
71
# Install license information file
72
install -Dm644 "${srcdir}/NO-LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/NO-LICENSE"
73
}
74
75
package_eusw-npapi-plugin() {
76
pkgdesc="IIT End User CA-1. Sign (web). NPAPI plugin."
77
depends=("${pkgbase}")
78
79
mkdir -p ${pkgdir}/usr/lib/mozilla/plugins
80
ln -s /opt/iit/eu/sw/npeuscp.so ${pkgdir}/usr/lib/mozilla/plugins/npeuscp.so
81
82
# Install license information file
83
install -Dm644 "${srcdir}/NO-LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/NO-LICENSE"
84
}
85
86
package_eusw-nmh-manifest() {
87
pkgdesc="IIT End User CA-1. Sign (web). Native Messaging Host manifest."
88
depends=("${pkgbase}")
89
90
# Installing native messaging host manifest (Chrome)
91
install -Dm644 ${srcdir}/chrome.ua.com.iit.eusign.nmh.json ${pkgdir}/etc/opt/chrome/native-messaging-hosts/ua.com.iit.eusign.nmh.json
92
# Installing native messaging host manifest (Chromium)
93
install -Dm644 ${srcdir}/chrome.ua.com.iit.eusign.nmh.json ${pkgdir}/etc/chromium/native-messaging-hosts/ua.com.iit.eusign.nmh.json
94
# Installing native messaging host manifest (Mozilla)
95
install -Dm644 ${srcdir}/mozilla.ua.com.iit.eusign.nmh.json ${pkgdir}/usr/lib/mozilla/native-messaging-hosts/ua.com.iit.eusign.nmh.json
96
97
# Install license information file
98
install -Dm644 "${srcdir}/NO-LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/NO-LICENSE"
99
}
100
101
package_eusw-pcsc-driver() {
102
pkgdesc="IIT End User CA-1. Sign (web). PC/SC driver(s)."
103
depends=("${pkgbase}" 'pcsclite')
104
105
mkdir -p ${pkgdir}/usr/lib
106
ln -s /opt/iit/eu/sw/libav337p11d.so ${pkgdir}/usr/lib/libav337p11d.so
107
108
# Install license information file
109
install -Dm644 "${srcdir}/NO-LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/NO-LICENSE"
110
}
111
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |